HijackThis Log for spyware caught at MySpace

Sorry folks, I'm new here, got referred by the good people at spybot. I guess I should have put in a bit of explanation. I'm 99% sure i caught something thanks to an invitation to join a group on MySpace. Stupid, I know, but I clicked on it:

Hi ,

You have been invited to join the girl on girl romance show group on MySpace.

Click the link below to see the group:
http://groups.myspace.com/index.cfm?fuseac…oupID=104003568



Now don't click on it unless you know what you're doing!
Another thing, I guess I should have done the scan while my PC was running molasses slow. I didn't. Now when it starts up again, I'll run the scan and post the new log. Thanks!
-Dan

Hello again, I ran a program called ProcessExplorer while my PC was being hijacked and it found what I think is the problem. It's called Office Dog and runs a program which changes name every time, this time called: c:\Windows|temp\AP5824.EXE with a little icon of a terrier. Here below is the "image" of what ProcessExplorer gave me: ————————- Ajj Bjj Ajj jjj Bjj jjj jjj jjjjj Bjj Bjj jjj Bjj jjj Ajj !This program cannot be run in DOS mode. CRich .text `.rdata @.data .rsrc tBU RPV h8AB h(AB h8AB h8AB SUVWu D$8Pj RUS D$(UP QRVS VUj RPV RPV t`SUVW3 SUV3 PUh PQV hHAB UhxAB SVW QWV WhdAB PhXAB SVW3 lVB D$,Rh PIh T$,QR h,EB h,EB hhEB h$FB lVB lVB hhFB hHFB T$|C;~ Ajj (null) u Vj SVW 8csm u SW SVW ?csm 8csm SVW YYPW tVj YYP YYP QQSVW t:jtj Yt)V @PH_B u?jtj Yt&V FP=H_B QQSVW QQSVW (SVW wLVSP VSW uSVj VSj VSW u>Wj YWu SVW u>Vj QSV vXj VC20XC00U SVWU tEVU SVW uFWWj "WWSh E WW tfS tMWWS WWu VSh WVS VWu t9UW QQS3 VWu PSSW PVW SS@SSPVSS t#SSUP t$$VSS UWV HSVWh 8MZu t>j,P uiSj pD#U SVW NCu SVW SUVWu QSV QQSV SQP sN;E PPPPPPPP PPPPPPPP PPPPPPPP WVS SVW PVh WSV eYt,F PSW 8csm QQSVWj PSj? PSj? >:uNFV >:u#FV SVW3 QPS WQPWS WWWj WWSj PSS WWWj WWj t%WV t%WV SVW3 tbj Yu!j YYj SVWu VWuBh tPh SVWj SVW t!CS SVWj SVW PPPP PPPP @PWV SVWf Wte WSP WsX SWj SVWj tYPV YYF;5 HSVHWtgHHtF NTuI vXj FTu vQW \SVW HHt YYj YYj YYj +ttHHtd sYA oZA NYu QSUV WWWWj PWj t/WWUPj WVS FGQPS VWsr tRS KYu tAVW 0SVW PWPSS PWPSS SSV tySS t-VW QQSVW3 tUj= QQV3 VVVj SPj SVW3 YtM VPS 5lVB 5lVB lVB SVW tA<#u HHt nt2Ht#Ht hlVB hVB hVB hVB lVB j@jP h=zA hozA lVB hWj@_; pVB lVB ;5pVB pVB lVB lVB pVB GWS lVB SVW t$$SS Vug PuV QQSV Vue 4SVW VhI tBSh VWj @SVW btZ- VWh} tLj tKj VWhI VhI NWV ,SVW SWj tMVW u@hI 9HPu uSV QSV SSj SSj SSj SSj JPR SVW SQj Hui t>Ht Ht SVW btU QQSVW QSV WWW PjB SVW jXW jZW tBSh QSVW3 lVB QQS N US+ )SPj V(RW QQSV WQP N SW F(_+F$^[;E lVB QQVj lVB tEV YYj tBSh SVW QQV QQV QQV QQV QQV QQV tBSh SVW3 SShv lVB 1GG;E CGGC 1FF;E Vu4j uTVW QQUV QSVW QSV QQSVW QSV Vht SVW SVW CStringArray CObject CTempWnd CWnd AfxOldWndProc423 AfxWnd42s AfxControlBar42s AfxMDIFrame42s AfxFrameOrView42s AfxOleControl42s GetMonitorInfoA EnumDisplayMonitors MonitorFromPoint MonitorFromRect MonitorFromWindow GetSystemMetrics USER32 DISPLAY commctrl_DragListMsg ime InitCommonControlsEx COMCTL32.DLL CNotSupportedException CMemoryException CException CArchiveException CCmdTarget combobox CMapPtrToPtr CTempMenu CMenu CTempGdiObject CTempDC CGdiObject CDC CUserException CResourceException csm H:mm:ss dddd, MMMM dd, yyyy M/d/yy December November October September August July June April March February January Dec Nov Oct Sep Aug Jul Jun May Apr Mar Feb Jan Saturday Friday Thursday Wednesday Tuesday Monday Sunday Sat Fri Thu Wed Tue Mon Sun EEE ppxxxx (null) __GLOBAL_HEAP_SELECTED __MSVCRT_HEAP_SELECT runtime error TLOSS error SING error DOMAIN error - unable to initialize heap - not enough space for lowio initialization - not enough space for stdio initialization - pure virtual function call - not enough space for _onexit/atexit table - unable to open console device - unexpected heap error - unexpected multithread lock error - not enough space for thread data abnormal program termination - not enough space for environment - not enough space for arguments - floating point not loaded Microsoft Visual C++ Runtime Library Runtime Error! Program: GAIsProcessorFeaturePresent KERNEL32 SunMonTueWedThuFriSat JanFebMarAprMayJunJulAugSepOctNovDec GetLastActivePopup GetActiveWindow MessageBoxA user32.dll 1#QNAN 1#INF 1#IND 1#SNAN SgA WgA PWB hWB hWB HXB hXB XYB XYB PWB XZB XZB xZB xZB WSOCK32.dll FreeLibrary GetProcAddress LoadLibraryA GetCurrentProcessId lstrcatA lstrcpyA WriteProcessMemory ReadProcessMemory CloseHandle OpenProcess GetExitCodeThread WaitForSingleObject GetModuleHandleA CreateMutexA GetLastError GetSystemDirectoryA ResetEvent SetEvent LeaveCriticalSection _lclose EnterCriticalSection FindClose FindNextFileA FindFirstFileA OpenFile lstrcmpiA GetCurrentDirectoryA InitializeCriticalSection CreateEventA DeleteCriticalSection GetTempFileNameA GetTempPathA GetComputerNameA GetVersionExA Sleep CreateProcessA CopyFileA GetPrivateProfileIntA GetTickCount DeleteFileA VirtualAlloc GetVersion MoveFileExA TerminateProcess GetModuleFileNameA LocalFree LocalAlloc lstrlenA WaitForMultipleObjects InterlockedIncrement InterlockedDecrement WideCharToMultiByte MultiByteToWideChar lstrcmpA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetCurrentThreadId SetLastError lstrcpynA TlsAlloc GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalReAlloc GlobalAlloc TlsSetValue LocalReAlloc TlsGetValue ResumeThread GlobalFlags GetProcessVersion GetCPInfo GetOEMCP GetCurrentProcess WriteFile SetFilePointer FlushFileBuffers GetFileAttributesA RtlUnwind CreateThread ExitThread GetTimeZoneInformation GetSystemTime GetLocalTime GetStartupInfoA GetCommandLineA ExitProcess HeapAlloc HeapFree RaiseException HeapSize HeapReAlloc GetACP UnhandledExceptionFilter LCMapStringA LCMapStringW FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA KERNEL32.dll RegisterWindowMessageA TranslateMessage DispatchMessageA GetMessageA RegisterClassExA LoadCursorA LoadIconA UpdateWindow ShowWindow CreateWindowExA DefWindowProcA PostQuitMessage SetTimer DestroyWindow KillTimer FindWindowA PostMessageA SendMessageA GetSystemMetrics GetWindowRect GetWindowPlacement IsIconic SystemParametersInfoA SetWindowPos SetWindowLongA GetWindowLongA GetWindow SetForegroundWindow GetForegroundWindow GetLastActivePopup GetMessagePos GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA GetKeyState GetDlgCtrlID GetWindowTextA GetDlgItem GetMenuItemID GetSubMenu GetMenuItemCount GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetParent MessageBoxA GetTopWindow EnableWindow CopyRect GetClientRect AdjustWindowRectEx SetFocus GetFocus PeekMessageA GetSysColor MapWindowPoints LoadStringA GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions SetWindowTextA IsWindowEnabled GetClassNameA PtInRect ClientToScreen GetSysColorBrush ReleaseDC GetDC DestroyMenu TabbedTextOutA DrawTextA GrayStringA USER32.dll GetClipBox SetTextColor SetBkColor GetObjectA CreateBitmap DeleteObject GetDeviceCaps DeleteDC SaveDC RestoreDC SelectObject GetStockObject SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GDI32.dll comdlg32.dll ClosePrinter DocumentPropertiesA OpenPrinterA WINSPOOL.DRV SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegDeleteValueA QueryServiceConfigA CloseServiceHandle OpenServiceA OpenSCManagerA StartServiceA QueryServiceStatus CreateServiceA DeleteService RegNotifyChangeKeyValue ADVAPI32.dll SHELL32.dll COMCTL32.dll OfcDog.exe ??0TmProcessGuard@@QAE@KHH@Z ??0TmProcessGuard@@QAE@PBD0HH@Z ??0TmProcessGuard@@QAE@XZ ??0TmServiceGuard@@QAE@PBD00HH@Z ??0TmServiceGuard@@QAE@PBDKHH@Z ??0TmServiceGuard@@QAE@XZ ??1TmProcessGuard@@UAE@XZ ??1TmServiceGuard@@UAE@XZ ??4TmProcessGuard@@QAEXAAV0@@Z ??4TmServiceGuard@@QAEXAAV0@@Z ??_7TmProcessGuard@@6B@ ??_7TmServiceGuard@@6B@ ?BackupService@TmServiceGuard@@IAEXXZ ?CheckProcess@TmProcessGuard@@QAE_NAAVCStringArray@@@Z ?GetGuardInfo@TmProcessGuard@@QBEXAAKAAVCString@@1AAH2@Z ?IsIPChanged@@YA_NPBDPADH@Z ?IsMonitor@TmProcessGuard@@IBE_NXZ ?IsNTPlatform@@YA_NXZ ?IsProcessAlive@TmProcessGuard@@MAE_NXZ ?IsProcessAlive@TmServiceGuard@@MAE_NXZ ?IsRetryNow@TmProcessGuard@@IBE_NXZ ?IsTheSame@TmProcessGuard@@QBE_NABVCString@@0@Z ?IsTheSame@TmProcessGuard@@QBE_NK@Z ?IsTheSame@TmProcessGuard@@QBE_NPBV1@@Z ?IsValidProcess@TmProcessGuard@@QBE_NXZ ?QueryAllLog@TmProcessGuard@@QBEXAAVCStringArray@@@Z ?RegWatchDog_Ofc@@YA_NXZ ?RegWatchDog_Ofc_95@@YA_NXZ ?RegWatchDog_Ofc_NTRT@@YA_NXZ ?RegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ ?RegWatchDog_Ofc_PCCNTMON@@YA_NXZ ?RegWatchDog_Ofc_TMLISTEN@@YA_NXZ ?ResetMonitor@TmProcessGuard@@IAEXXZ ?ResetRetryCount@TmProcessGuard@@QAEXXZ ?ResetRetryTick@TmProcessGuard@@QAEXXZ ?ResetRetryVar@TmProcessGuard@@QAEXXZ ?RetryWakeupProcess@TmProcessGuard@@MAE_NXZ ?RetryWakeupProcess@TmServiceGuard@@MAE_NXZ ?SetMonitor@TmProcessGuard@@IAEXXZ ?SetProcessID@TmProcessGuard@@QAEXK@Z ?SetRetryCountLimit@TmProcessGuard@@QAEXH@Z ?SetRetryTickLimit@TmProcessGuard@@QAEXH@Z ?StepMonitor@TmProcessGuard@@IAEXXZ ?StepRetry@TmProcessGuard@@IAEXXZ ?UnRegWatchDog_Ofc@@YA_NXZ ?UnRegWatchDog_Ofc_95@@YA_NXZ ?UnRegWatchDog_Ofc_NTRT@@YA_NXZ ?UnRegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ ?UnRegWatchDog_Ofc_PCCNTMON@@YA_NXZ ?UnRegWatchDog_Ofc_TMLISTEN@@YA_NXZ C_IsIPChanged C_RegWatchDog_Ofc C_RegWatchDog_Ofc_OFCPFWSVC C_RegWatchDog_Ofc_PCCNTMON C_RegWatchDog_Ofc_TMLISTEN C_UnRegWatchDog_Ofc C_UnRegWatchDog_Ofc_OFCPFWSVC C_UnRegWatchDog_Ofc_PCCNTMON C_UnRegWatchDog_Ofc_TMLISTEN GzA yzA http://%s%s Get loadhttp.dll OsceProt.dll CreateRemoteThread VirtualFreeEx VirtualAllocEx Kernel32.dll OSCEPROT.DLL FreeLibrary GetModuleHandleA Kernel32 %ClientFolder%Temp\ upgrade.exe ImmDisableIME Imm32.dll Software\Microsoft\Windows\CurrentVersion\RunServices OfficeScan95 "%spccwin97.exe" Application Path Process Register to watchdog by Name! Process UnRegister to watchdog by Name! Service Register to watchdog by NAME! WM_REGDOGLOCKFILES__A9DB83DB_A9FD_11D0_BFD1_444553540000__INCLUDED WM_REGDOGUNHOOKPROTECT__111222__ This is the only one instance. Another instance is running. Process returns. WinMain entry. SD_TraceA_0200 Feb 7 2006 SD_InitDebug_with_Ini_0200 [OfcDog] Load tmdbg20.dll error, Error code = %u tmdbg20.dll \ofcdebug.ini [OFCDOG] OFCDOG The malicious process %s(%u) attacked OfficeScan Client. The malicious process had been terminated and renamed as %s. %ClientFolder% .EXE .DLL Module32Next Module32First KERNEL32.DLL [DUMP] End [DUMP] m_arServiceGuard[%d] = [%d, %s, %s, %d, %d] [DUMP] m_arProcessGuard[%d] = [%d, %s, %s, %d, %d] [DUMP] [dwID, cPath, cName, nRetryCount, nRetryCountLimit] [OK ]OnCreate, GetCurrentDirectory() = %s [OnCreate]Check WinAPI %d OFCDOGUNLOCKDONE Global\OFCDOGUNLOCKDONE OnCreate==> [OK ]OnClose [FAIL]RegServ-The process is NOT a valid process, cName = %s, cPath = %s [OK ]RegServ-The process is add to m_arServiceGuard, cName = %s, cPath = %s [FAIL]OnRegProcByName-The process is NOT a valid process, cName = %s, cPath = %s [OK ]RegProc-The process is add to m_arProcessGuard, cName = %s, cPath = %s [OK ]RegProc-The process was registered before, cName = %s, cPath = %s, wRetryCount = %d, wRetryInterval = %d [FAIL]OnRegServByName-GetProcessInfoByName fail, cName = %s, cPath = %s [FAIL]UnRegProc- Can't find, cName = %s, cPath = %s [OK ]UnRegProc- remove from m_arServiceGuard, cName = %s, cPath = %s [OK ]UnRegProc- remove from m_arProcessGuard, cName = %s, cPath = %s [FAIL]OnRegProcByName-bPopName&bPopPath [OK ]OnRegProcByName-The process is add to m_arProcessGuard, cName = %s, cPath = %s [OK ]OnRegProcByName-The process was registered before, cName = %s, cPath = %s, wRetryCount = %d, wRetryInterval = %d [FAIL]OnRegProcByName-GetProcessInfoByName fail, cName = %s, cPath = %s DogVar-ProcessPath DogVar-ProcessName [FAIL]OnRegServByName-bPopServ&bPopName&bPopPath, bPopServ= %d, bPopName = %d, bPopPath = %d, cService = %s, cName = %s, cPath = %s [FAIL]OnRegServByName-The process is NOT a valid process, cName = %s, cPath = %s [OK ]OnRegServByName-The process is add to m_arServiceGuard, cName = %s, cPath = %s [OK ]OnRegServByName-The process was registered before, cName = %s, cPath = %s, wRetryCount = %d, wRetryInterval = %d DogVar-ServiceName [FAIL]OnUnRegProcByName-bPopName&bPopPath [OK ]OnUnRegProcByName- remove from m_arServiceGuard, cName = %s, cPath = %s [OK ]OnUnRegProcByName- remove from m_arProcessGuard, cName = %s, cPath = %s [FAIL]OnUnRegProcByName- Can't find, cName = %s, cPath = %s [FAIL]Fail to LoadLibrary( kernel32.dll ), err_no = %d [FAIL]Fail to GetProcAddress( RegisterServiceProcess ), err_no = %d [OK ]RegisterAsService RegisterServiceProcess kernel32.dll %s%s?computer=%s&desc=%s _dogtemp_ NO LOCALHOST INFO CgiOnSpecialLog ProxyPwd ProxyLogin ProxyPort ProxyServer UseProxy ServerPort /cgionspeciallog.exe VirtualPath Server Mode [MSG ]GuardAlert = %s Default Retry Interval Default Retry Count Application Filename ntrtscan.exe OFCNT Process Name ntrtscan OFCNT Service Name OFCDOG_CREATION WatchDogUseRandomName Global Setting WatchDogRunInTempDir \ofcscan.ini ofcscan.ini ofcdog.exe Dog Process Name .TMP 0fcd0g.tmp WatchDog Software\ Corp\CurrentVersion Max Log WatchDogCheckInterval WatchDogRetry EnumProcessModules GetModuleBaseNameA GetModuleFileNameExA EnumProcesses \PSAPI.DLL PSAPI.DLL Process32Next Process32First CreateToolhelp32Snapshot tmlisten.exe TmListen Process Name tmlisten TmListen Service Name OfcPfwSvc.exe OfcPfwSvc Process Name OfcPfwSvc OfcPfwSvc Service Name pccntmon.exe PccNTMon Process Name OFCDOG.EXE PrevName [%s%s(%u)] Wait for WakeUP, CountDown %d Client [%s(%u)] restarted successfully after [%d] tries. [%s%s(%u)] Alive, RetryTick=%d,RetryCount=%d MonitorTick = %d [%s%s(%u)] Monitor, RetryTick=%d,RetryCount=%d, MonitorTick = %d tVB .?AVCObject@@ .?AVCStringArray@@ .PAVCException@@ .PAVCArchiveException@@ .?AVCCmdTarget@@ .?AVCWnd@@ .?AVCCmdUI@@ .?AVCTestCmdUI@@ .?AVCTempWnd@@ .?AVCNoTrackObject@@ .?AV_AFX_CTL3D_STATE@@ .PAX .PAVCObject@@ .PAVCSimpleException@@ .PAVCMemoryException@@ .?AVCException@@ .?AVCSimpleException@@ .?AVCMemoryException@@ .?AVCNotSupportedException@@ .?AUCThreadData@@ .?AV_AFX_THREAD_STATE@@ .?AVAFX_MODULE_STATE@@ .?AVAFX_MODULE_THREAD_STATE@@ .?AV_AFX_BASE_MODULE_STATE@@ .?AVCArchiveException@@ .?AVCHandleMap@@ .?AVCMapPtrToPtr@@ .?AV_AFX_WIN_STATE@@ .?AVCMenu@@ .?AVCTempMenu@@ .?AVCDC@@ .?AVCGdiObject@@ .?AVCTempDC@@ .?AVCTempGdiObject@@ .?AVCResourceException@@ .?AVCUserException@@ .?AVtype_info@@ HPA HPA HPA HPA HPA HPA PST PDT HMXB S;uD z?aUY zc%C1 NKeb D:\OfficeScan\src\Client\OfcDog\Release\OfcDog.pd

I have the same problem. I can add some information: 1) I checked my PC with Spybot, Lavasoft, Spy Doctor, TrendMicro (my default antivirus is Officescan), McAfee, NOD32: no one found anything 2) If I kill this process, it will reappear after some time, with a different random letters name. And different file size. 3) I'm monitoring with Blink firewall, I does not seem to have any IP activity 4) I do not have any string in startup configuration (checked with Startup Control Panel 2.8) Please help!! Nazz

Hi, I found the same problem analyzed and maybe solved in another post!
http://forums.tomcoyote.org/index.php?show…c=74348&st=
Sorry.