What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

VUPDMAN32 TROJAN BACKDOOR HELP

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi
I accidentally allowed vupdman32 through my firewall and BOOM! my computer starts stuffing up. I followed the instructions and posted my HijackThis log here. Help would be appreciated. THANKS

Logfile of HijackThis v1.99.1
Scan saved at 8:18:36 AM, on 30/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Parent\ewido anti-spyware 4.0\guard.exe
D:\Other\Programs\NERO\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\RsaServer.exe
D:\Other\Programs\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\Novell\XTAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Parent\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pc-ap.fujitsu.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\Other\Programs\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\Other\Programs\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Fomine WinPopup] D:\t4o5.2\Winpopup LAN Messenger\WinPopup.exe
O4 - HKCU\..\Run: [Winpopup LAN Messenger] D:\t4o5.2\Winpopup LAN Messenger\WinPopup.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: WordWeb Pro.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - D:\Other\Programs\Download Accelerator Plus\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Other\Programs\Download Accelerator Plus\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - D:\Other\Programs\Download Accelerator Plus\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\Other\Programs\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet3_88.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-ap.fujitsu.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.0.69.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: winwpy32 - winwpy32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (file missing)
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Parent\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Other\Programs\NERO\Nero 7\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\PSSDNSVC.EXE
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: Remote Shutdown Service (RsaService) - Emco Software Ltd. - C:\WINDOWS\system32\RsaServer.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - D:\Other\Programs\Spyware Doctor\sdhelp.exe
O23 - Service: Tenebril antispyware satellite (TNBRLDS) - Unknown owner - D:\Parent\My Pictures\Other Stuf\1\2\3\GhostSurf 2005\DeleteSvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.ex
Post #2
azn_auron :D

Welcome to the forum, sorry for the delay.


Lets do this.

Not always but sometimes removing NewDotNet will disrupt your internet access, so download this tool first to your desktop, only use it in the event you lose internet access after removing NewDotNet.
Winsockxpfix

Please open your Add/Remove programs in the Control Panel and uninstall New.Net or NewDotNet from there if listed. If it is not listed, follow these instructions:
  • From a computer that has Internet access, click on the following link:
    Uninstall .
  • Download and save uninstall6_90.exe to the Desktop.
  • Go to the Desktop and double-click on uninstall6_90.exe
  • Click on the OK button.
  • After removal, you may be prompted to reboot. Please reboot even if not prompted.





Open HJT Scan Only, close your browser and all open windows, check these and click on Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

O20 - Winlogon Notify: winwpy32 - winwpy32.dll (file missing)




You have Ewido installed, set it up this way , update it , run the scan and post the report.


Download and install the 30 day trial of Ewido Anti Spyware to your desktop.
  • Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run Ewido and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close Ewido Anti-Spyware <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • Ewido will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close Ewido


I need to see the Ewido report and a new HJT log please.
Post #3
Hi
Thanks for the quick reply. I have done all that you asked and included the new HijackThis report and the ewido scan log here.

HIJACKTHIS LOG:
Logfile of HijackThis v1.99.1
Scan saved at 8:42:44 PM, on 7/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Parent\ewido anti-spyware 4.0\guard.exe
D:\Other\Programs\NERO\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\RsaServer.exe
D:\Other\Programs\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\Novell\XTAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
D:\Parent\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pc-ap.fujitsu.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\Other\Programs\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\Other\Programs\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Fomine WinPopup] D:\t4o5.2\Winpopup LAN Messenger\WinPopup.exe
O4 - HKCU\..\Run: [Winpopup LAN Messenger] D:\t4o5.2\Winpopup LAN Messenger\WinPopup.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: WordWeb Pro.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - D:\Other\Programs\Download Accelerator Plus\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Other\Programs\Download Accelerator Plus\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - D:\Other\Programs\Download Accelerator Plus\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\Other\Programs\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-ap.fujitsu.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.0.69.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (file missing)
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Parent\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Other\Programs\NERO\Nero 7\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\PSSDNSVC.EXE
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: Remote Shutdown Service (RsaService) - Emco Software Ltd. - C:\WINDOWS\system32\RsaServer.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - D:\Other\Programs\Spyware Doctor\sdhelp.exe
O23 - Service: Tenebril antispyware satellite (TNBRLDS) - Unknown owner - D:\Parent\My Pictures\Other Stuf\1\2\3\GhostSurf 2005\DeleteSvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe

EWIDO LOG:
———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 7:52:47 PM 7/09/2006

+ Scan result:



C:\Documents and Settings\DCCStudent\Desktop\uninstall6_90.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
D:\Other\Win32DASM_v8.93.zip/W32Dasm 8.93 Patch.exe -> Backdoor.Theef.111 : Cleaned with backup (quarantined).
D:\Aaron's stuff\MSN\Hotmail.H.T.2005.Edition.rar/Dir\HotmailGen.zip/Hotmail-Gen.exe -> Not-A-Virus.Constructor.Win32.VB.af : Ignored and added to exceptions
D:\Other\Programs\NetBios\enum.zip/enum/enum.exe -> Not-A-Virus.HackTool.Win32.EnumPlus.a : Ignored and added to exceptions
C:\WINDOWS\system32\john-k6.zip/john.exe -> Not-A-Virus.HackTool.Win32.John : Ignored and added to exceptions
C:\WINDOWS\system32\john-mmx.zip/john.exe -> Not-A-Virus.HackTool.Win32.John : Ignored and added to exceptions
D:\t4o5.2\John-16w (password crack).zip/john-16/run/john-k6.zip/john.exe -> Not-A-Virus.HackTool.Win32.John : Ignored and added to exceptions
D:\t4o5.2\John-16w (password crack).zip/john-16/run/john-mmx.zip/john.exe -> Not-A-Virus.HackTool.Win32.John : Ignored and added to exceptions
D:\t4o5.2\John-16w (password crack).zip/john-16/run/john.exe -> Not-A-Virus.HackTool.Win32.John : Ignored and added to exceptions
C:\Documents and Settings\DCCStudent\Desktop\Text Documents\Crackftp.zip/Crackftp/CrackFTP.exe -> Not-A-Virus.HackTool.Win32.VB.ca : Ignored and added to exceptions
D:\t4o5.2\Crackftp.zip/Crackftp/CrackFTP.exe -> Not-A-Virus.HackTool.Win32.VB.ca : Ignored and added to exceptions
C:\Documents and Settings\DCCStudent\Desktop\Text Documents\gettingadmin\lophtcrack\l0phtcrack.zip/LC_CLI.EXE -> Not-A-Virus.PSWTool.Win32.Lopht.100 : Ignored and added to exceptions
C:\Documents and Settings\DCCStudent\Desktop\Text Documents\gettingadmin\lophtcrack\l0phtcrack.zip/lc_gui.exe -> Not-A-Virus.PSWTool.Win32.Lopht.100 : Ignored and added to exceptions
D:\Other\Programs\NetBios\Netpass\netpass.zip/netpass.exe -> Not-A-Virus.PSWTool.Win32.NetPass.b : Ignored and added to exceptions
D:\Other\Programs\NetBios\pqwak2.zip/PQwak2.exe -> Not-A-Virus.PSWTool.Win32.Pqwak.20a : Ignored and added to exceptions
D:\Aaron's stuff\bytesadder.zip/Bytes adder.exe -> Not-A-Virus.VirTool.Win32.Addbyte : Ignored and added to exceptions
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@7search[1].txt -> TrackingCookie.7search : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@admarketplace[2].txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Adnet : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@bfast[2].txt -> TrackingCookie.Bfast : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@bluemountain[2].txt -> TrackingCookie.Bluemountain : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Gamershell : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed]-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][2].txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@targetnet[2].txt -> TrackingCookie.Targetnet : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\dccstudent@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).
C:\Documents and Settings\DCCStudent\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
D:\TEMP\stuf\stuf\cardpro.zip/CARDPRO.EXE -> Trojan.Beazly : Cleaned with backup (quarantined).
D:\Aaron's stuff\Extreme\msnmsgr.zip/Aaron's stuff/Extreme/msnmsgr.exe -> Trojan.MSNTrick : Cleaned with backup (quarantined).
D:\Aaron's stuff\MSN\MSNFrx.zip/MSNFurax.exe -> Trojan.MSNTrick : Cleaned with backup (quarantined).
D:\Aaron's stuff\MSN\Hotmail.H.T.2005.Edition.rar/Dir\headfuck.zip/Edit Server.exe -> Trojan.VB.dw : Cleaned with backup (quarantined).
D:\Aaron's stuff\MSN\Hotmail.H.T.2005.Edition.rar/Dir\headfuck.zip/hotmailhack.exe -> Trojan.VB.eq : Cleaned with backup (quarantined).
D:\TEMP\stuf\stuf\passsteal.zip/Password Stealer.exe -> Trojan.VB.k : Ignored.


::Report end

Thanks once again.
AZN_AURON
Post #4
Good Morning, :D


You can remove this entry with HJT.

O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html


The rest of your log looks good, :thumbup: how are things running now??
Post #5
Hi Well, my computer is better but still disfunctioning. I'll try to explain as best as I can. :P Firstly my mouse scrolling doesn't work (scroll lock is off) and when I go into mouse propeties, it doesn't give me the normal Windows XP GUI interface. The tabs are restricted and my right-click becomes a left click (and visa versa) in that window only. However, when I plug in an external mouse, the scroll works (on the mouse, not the touchpad) but the GUI remains the same. The keyboard seems to be working alright except that it also doesn't give me the normal Windows XP GUI interface. The tabs are restricted as well. My application panel (I'm using a Fujitsu Lifebook) has working shortcuts but nothing happens when I press them. Everytime I restart, my toolbars get reset and turned off and I have just found out my internet options were disabled. Some programs that are supposed to run at startup were just deleted off the startup menu everytime I manually add it back in again. That is all I have discovered so far. I fear it is some sort of backdoor.trojan or possibly a worm. I've looked through Task Manager but I don't see any suspicious program running. Could you help me :unsure: ?
Post #6
azn_auron, :D

A few options for you

I would open Ewido and go to the Quarantine folder and remove it all, nothing in there you want to keep.

These 2 lines are for a remote desktop controller and shutdown service. If you did not install these then let me know and we will remove them, but dont fix them yet.

O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\PSSDNSVC.EXE
O23 - Service: Remote Shutdown Service (RsaService) - Emco Software Ltd. - C:\WINDOWS\system32\RsaServer.exe


Do this…
  • Click Start>Run
  • Type in sfc /scannow, hit Enter.
  • Note: there is a space between sfc and /scannow
  • This should replace any corrupted/missing system files and will hopefully fix things.
    You may need your XP disc in your CD drive for this.


Outside of the two questionalble entries above, the rest of your log looks ok :thumbup:


Run this quick scan, it may show if you have a Rootkit or something hidden on your HJT log.

Download and Save Blacklight to your desktop:
  • Double-click blbeta.exe
  • Then accept the agreement
  • leave [X]scan through Windows Explorer checked.
  • Click > scan then > next
  • You'll see a list of all items found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
  • Copy and paste this log in your next reply.
  • Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

Let me see the Blacklight log and let me know about those two programs.
Post #7
Hi

Sorry for the late reply. I have been trying to look for my Windows XP cd with no luck. Thought I'd let you know and I'll post again when I have found it and completed the first task.

O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\PSSDNSVC.EXE
O23 - Service: Remote Shutdown Service (RsaService) - Emco Software Ltd. - C:\WINDOWS\system32\RsaServer.exe

Those services I have installed myself to test. I am pretty sure they do not contain any viruses. If you would like to check, PsShutdown is freeware from http://www.sysinternals.com/Utilities/PsShutdown.html but I can't remember where I got Remote Shutdown Service.

I have followed your instructions for Blacklight except for

leave [X]scan through Windows Explorer checked.


I don't understand what this means but I skipped over that and completed the scan. Here is the log:

09/11/06 09:10:34 [Info]: BlackLight Engine 1.0.46 initialized
09/11/06 09:10:34 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/11/06 09:10:34 [Note]: 7019 4
09/11/06 09:10:34 [Note]: 7005 0
09/11/06 09:11:09 [Note]: 7006 0
09/11/06 09:11:09 [Note]: 7011 2104
09/11/06 09:11:09 [Note]: 7026 0
09/11/06 09:11:09 [Note]: 7026 0
09/11/06 09:11:45 [Note]: FSRAW library version 1.7.1019
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\U0X.DAT
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\hff-patch.exe
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\SETUP.EXE
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\UNINS000.DAT
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\UNINS000.EXE
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\HFF.EXE
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\HFF.BMP
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\HFF.HLP
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\HFF.CNT
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\uninstall.ico
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\CREF.DLR
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\README.TXT
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\HFF.exe.BAK
09/11/06 09:30:15 [Info]: Hidden file: d:\Other\Programs\HF\Thumbs.db
09/11/06 09:30:15 [Info]: Hidden file:

d:\Other\Programs\ADMINP~1\admin_paz_cd.zip
09/11/06 09:30:15 [Info]: Hidden file:

d:\Other\Programs\ADMINP~1\CD050303.ISO
09/11/06 09:30:16 [Info]: Hidden file:

d:\Other\Programs\ADMINP~1\ACCTMGR.ZIP
09/11/06 09:30:16 [Note]: 7002 0
09/11/06 09:30:16 [Note]: 7003 1
09/11/06 09:30:16 [Info]: Hidden file: d:\Other\Programs\MISC\VJ17.ZIP
09/11/06 09:30:16 [Note]: 7002 0
09/11/06 09:30:16 [Note]: 7003 1
09/11/06 09:30:18 [Note]: 2000 1006
09/11/06 09:42:42 [Note]: 7007 0

As I said, I'll get back to you about the sfc /scannow results. And once again, sorry for the late reply.

AZN_AURON
Post #8 last edited
azn_auron,

Lets do a couple of things.



We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Boot into Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
Go into D:\TEMP Open the folder , go to Edit > Select All , then right click and delete it all.

While in Safemode, if some files will not delete, look for this one and see if its still present,
D:\TEMP\stuf\stuf\passsteal.zip/Password Stealer.exe


Let me know if its gone or not.


Reboot and I need you to upload this file to see if its bad or not.
http://virusscan.jotti.org/

Use the browse feature and browse to this file if you can find it.
d:\Other\Programs\HF\HFF.EXE

HFF.exe is a program for hidding files and folders, do you remember ever installing it ???

It will give you a report, post that report in your next reply.
Post #9
Hi No luck on finding that XP cd yet…the study is very messy =P. As for the HFF, I installed it to keep my folders hidden from the sight of onlookers and to clean up my folders. That way, the folders that I hardly use are hidden and so I can access them when I need to. However, after running the Blacklight program, I can't seem to unprotect or protect my files any more. I try to run the program to stop folder hiding but it just doesn't come up. I have no access to the hidden folders and unfortunatly, as a secruity precaution, I hid the folder with HFF (Hide Files and Folders) in it. I have enabled the view of hidden files and folders, file extention for known types and protected operating system files without any luck. I chose this program because it hides the folders with or without these options. I guess I'm hoodwinked by my own secruity…=( I deleted Password Stealer and my whole TEMP folder but still nothing. What should I do next?
Post #10
azn_auron, :D

Blacklight just scans and gives us a report, the only thing it found was the HFF program that you said you installed. Blacklight didn't change anything. I am wondering if it somehow conflicts with the windows hide files and folders, reenable that and see if it makes a difference.

Do you have the CD to reinstall HFF? You might give them a call and see if they can help you out of this, myself, I have never heard of this program so don't know what to tell you. :(


I am going to give you some windows sites that maybe able to help you out. Your log is basically clean, Ewido removed a bunch of bad stuff, Blacklight came up clean, so this is most likely a windows or hardware problem.


IE Freezes
It's Not Always Malware


Windows Tech Support Forums

Tom Coyote <– Our own forum
PcPitStop <– You can take your system in for a checkup here.
Bleeping Computer <–Good XP Forum
Windows Helpnet <– Excellent XP Forum
Hardwareguys <– Another good one

Speedup Windows
TechBuilder


Windows Tips
Techruler
Kellys Korner


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


I wish I could be more help, but this is a forum for malware and virus removal and your clean.

Ken :D
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI