What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HijackThis Log for analysis

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 10:01:54 AM, on 12/11/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\llssrv.exe
C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe
C:\Program Files\OLAP Services\Bin\msmdsrv.exe
d:\Program Files\No-IP\DUC20.exe
C:\WINNT\system32\ntfrs.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\rpcnet.exe
C:\Program Files\Trend\Smex\InstMon.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend\Smex\RMonitor.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\Web\Service\NSAgent.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend\Smex\RMonUI.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wins.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\ismserv.exe
C:\WINNT\System32\modemshr.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Exchsrvr\bin\mad.exe
C:\WINNT\System32\mqsvc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\Program Files\Trend\Smex\InstRTS.exe
C:\Program Files\Microsoft Shared Fax\Bin\FXSSVC.exe
C:\Program Files\Trend\Smex\SmexVS.exe
C:\Program Files\Exchsrvr\bin\store.exe
C:\Program Files\Exchsrvr\bin\emsmta.exe
C:\Program Files\Trend\Smex\SMEXMA.exe
C:\Program Files\Trend\Smex\WebRoot\InstWeb.exe
D:\I3\IC\Common\EICLoggingU.exe
C:\Program Files\Trend\Smex\WebRoot\SmexHS.exe
C:\Program Files\Microsoft ISA Server\mspadmin.exe
C:\Program Files\Microsoft ISA Server\wspsrv.exe
C:\Program Files\Microsoft ISA Server\w3proxy.exe
C:\Program Files\Microsoft ISA Server\W3Prefch.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\autoback\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\WINNT\System32\mdm.exe
C:\WINNT\system32\mmc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\explorer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\autoback\svchost.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\msiexec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\MsiExec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\1\StartupList.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\1\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.2:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MSConfigs] c:\autoback\svchost.exe
O4 - HKLM\..\Run: [only23] C:\WINNT\SCVHOST.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://10.0.0.2:8085/officescan/console/Cl…ll/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - http://10.0.0.2:8085/officescan/console/Cl…ll/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://10.0.0.2:8085/officescan/console/Cl…stall/setup.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://10.0.0.2:8085/officescan/console/Cl…/RemoveCtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vialink.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{70E18308-1A38-4BE2-811A-B1D27CEB42F7}: NameServer = 205.152.132.23,205.152.37.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{B406549A-B1B8-4C7E-8422-E0956252FB1E}: NameServer = 205.152.132.23,205.152.37.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vialink.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vialink.local
O23 - Service: Backup Exec 8.x Agent Browser (BackupExecAgentBrowser) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benetns.exe
O23 - Service: Backup Exec 8.x Alert Server (BackupExecAlertServer) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\alertServer.exe
O23 - Service: Backup Exec 8.x Device & Media Service (BackupExecDeviceMediaService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\pvlsvr.exe
O23 - Service: Backup Exec 8.x Job Engine (BackupExecJobEngine) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\bengine.exe
O23 - Service: Backup Exec 8.x Naming Service (BackupExecNamingService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benser.exe
O23 - Service: Backup Exec 8.x Notification Server (BackupExecNotificationServer) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\nsvr.exe
O23 - Service: Backup Exec 8.x Server (BackupExecRPCService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\beserver.exe
O23 - Service: COM+ Application (COMSps) - Unknown owner - C:\WINNT\system.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Logical Man Services (dnsmens) - Unknown owner - C:\WINNT\lsas.exe
O23 - Service: EICLogging - Interactive Intelligence, Inc. - D:\I3\IC\Common\EICLoggingU.exe
O23 - Service: Microsoft H.323 Gatekeeper (GKSVC) - Unknown owner - svchost.exe (file missing)
O23 - Service: Indexing Helps (Indexingbox) - Unknown owner - %WINDIR%\system\svchest.exe (file missing)
O23 - Service: Microsoft Connector for POP3 Mailboxes (MSPOP3Connector) - Unknown owner - C:\Program Files\Microsoft BackOffice\Connectivity\POP3 Connector\vmimb.exe" /SERVICE (file missing)
O23 - Service: NetBackup Client Service (NetBackup INET Daemon) - Unknown owner - C:\VERITAS\NetBackup\bin\bpinetd.exe
O23 - Service: NetBackup Volume Manager - Unknown owner - C:\VERITAS\Volmgr\bin\bevmd.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - d:\Program Files\No-IP\DUC20.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScan Master Service (ofcservice) - Trend Micro Inc. - d:\Program Files\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Unknown owner - C:\WINNT\system32\rpcnet.exe
O23 - Service: ScanMail_MailAction - Trend Micro Inc. - C:\Program Files\Trend\Smex\SMEXMA.exe
O23 - Service: ScanMail_Monitor - Trend Micro Inc. - C:\Program Files\Trend\Smex\InstMon.exe
O23 - Service: ScanMail_RealTimeScan - Trend Micro Inc. - C:\Program Files\Trend\Smex\InstRTS.exe
O23 - Service: ScanMail_Web - Trend Micro Inc. - C:\Program Files\Trend\Smex\WebRoot\InstWeb.exe
O23 - Service: System Services - Unknown owner - C:\WINNT\system32\winfax32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

Thanks!
Post #3
_____________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!



_________________________

It looks like you have been infected by a backdoor trojan and keyloggers both.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files.

Keyloggers allows them to record every keystroke you make.

Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits.
While we can attempt to clean what we see in your logs, we can't guarantee that your computer will be completely in the clear since we have no way of knowing what has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found
here

I suggest you do the following immediately:
  • Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.
If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities.

Should you have any questions, please feel free to ask.

Please let me know what you decide to do in your next post.
Post #5
Yes, please–thank you. I'd like to clean the server as thoroughly as I can before I attempt to migrate to our backup server. I've done a good bit of work on this and will dump the latest hijackthis log later on this morning. Again, thanks.
Post #6
Ok, so here's what I've done (in brief). I've followed the forum's directions and run Spybot Search & Destroy, Ad-Aware, AVG Anti-Spyware, (with the Safe mode sweep), and ATF cleaner. I also identified a couple of the culprits myself and got rid of them from my registry. We have (what I thought was) a tight Fortinet hardware firewall, and I've locked down all but mandatory Internet traffic from this server. Scans throughout the network have revealed no similar hijacking problems, btw, so it looks like the culprits never got further than the proxy server. Here's the latest HT log (the removal of domain name is intentional):

Logfile of HijackThis v1.99.1
Scan saved at 9:54:22 AM, on 12/13/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\OLAP Services\Bin\msmdsrv.exe
d:\Program Files\No-IP\DUC20.exe
C:\WINNT\system32\ntfrs.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\rpcnet.exe
C:\Program Files\Trend\Smex\InstMon.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend\Smex\RMonitor.exe
C:\WINNT\System32\svchost.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe
d:\Program Files\Trend Micro\OfficeScan\PCCSRV\Web\Service\NSAgent.exe
d:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wins.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\ismserv.exe
C:\WINNT\System32\modemshr.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Exchsrvr\bin\mad.exe
C:\WINNT\System32\mqsvc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\Program Files\Trend\Smex\InstRTS.exe
C:\Program Files\Microsoft Shared Fax\Bin\FXSSVC.exe
C:\Program Files\Trend\Smex\SmexVS.exe
C:\Program Files\Exchsrvr\bin\store.exe
C:\Program Files\Exchsrvr\bin\emsmta.exe
C:\Program Files\Trend\Smex\SMEXMA.exe
C:\Program Files\Trend\Smex\WebRoot\InstWeb.exe
C:\Program Files\Trend\Smex\WebRoot\SmexHS.exe
C:\Program Files\Microsoft ISA Server\mspadmin.exe
C:\Program Files\Microsoft ISA Server\wspsrv.exe
C:\Program Files\Microsoft ISA Server\w3proxy.exe
C:\Program Files\Microsoft ISA Server\W3Prefch.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\Program Files\Trend Micro\OfficeScan Client\PCCNTMON.EXE
C:\WINNT\System32\mdm.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe
D:\I3\IC\Common\EICLoggingU.exe
C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlagent.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
d:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
D:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.2:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://10.0.0.2:8085/officescan/console/Cl…ll/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://10.0.0.2:8085/officescan/console/Cl…stall/setup.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://10.0.0.2:8085/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://10.0.0.2:8085/officescan/console/Cl…/RemoveCtrl.cab
O16 - DPF: {69B502DF-D12F-4FD7-9892-D8DFA2D96474} (OfficeScan Management Console) - http://10.0.0.2:8085/officescan/console/html/AtxConsole.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = .local
O17 - HKLM\System\CCS\Services\Tcpip\..\{70E18308-1A38-4BE2-811A-B1D27CEB42F7}: NameServer = 10.0.0.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{B406549A-B1B8-4C7E-8422-E0956252FB1E}: NameServer = 205.152.132.23,205.152.37.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = .local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = .local
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Backup Exec 8.x Agent Browser (BackupExecAgentBrowser) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benetns.exe
O23 - Service: Backup Exec 8.x Alert Server (BackupExecAlertServer) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\alertServer.exe
O23 - Service: Backup Exec 8.x Device & Media Service (BackupExecDeviceMediaService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\pvlsvr.exe
O23 - Service: Backup Exec 8.x Job Engine (BackupExecJobEngine) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\bengine.exe
O23 - Service: Backup Exec 8.x Naming Service (BackupExecNamingService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benser.exe
O23 - Service: Backup Exec 8.x Notification Server (BackupExecNotificationServer) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\nsvr.exe
O23 - Service: Backup Exec 8.x Server (BackupExecRPCService) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\beserver.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: EICLogging - Interactive Intelligence, Inc. - D:\I3\IC\Common\EICLoggingU.exe
O23 - Service: Microsoft H.323 Gatekeeper (GKSVC) - Unknown owner - svchost.exe (file missing)
O23 - Service: Microsoft Connector for POP3 Mailboxes (MSPOP3Connector) - Unknown owner - C:\Program Files\Microsoft BackOffice\Connectivity\POP3 Connector\vmimb.exe" /SERVICE (file missing)
O23 - Service: NetBackup Client Service (NetBackup INET Daemon) - Unknown owner - C:\VERITAS\NetBackup\bin\bpinetd.exe
O23 - Service: NetBackup Volume Manager - Unknown owner - C:\VERITAS\Volmgr\bin\bevmd.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - d:\Program Files\No-IP\DUC20.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScan Master Service (ofcservice) - Trend Micro Inc. - d:\Program Files\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINNT\system32\rpcnet.exe
O23 - Service: ScanMail_MailAction - Trend Micro Inc. - C:\Program Files\Trend\Smex\SMEXMA.exe
O23 - Service: ScanMail_Monitor - Trend Micro Inc. - C:\Program Files\Trend\Smex\InstMon.exe
O23 - Service: ScanMail_RealTimeScan - Trend Micro Inc. - C:\Program Files\Trend\Smex\InstRTS.exe
O23 - Service: ScanMail_Web - Trend Micro Inc. - C:\Program Files\Trend\Smex\WebRoot\InstWeb.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - d:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Post #7
Very Nice work. Looks much much better. :thumbup:

Lets get one more scan just to be sure.




_________________________________
Please do an online scan with Kaspersky Online Scanner
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:

Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer

The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

Save the file to your desktop.

Copy and paste that information in your next post.
Post #8
Thanks, Bob. Here it is: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Thursday, December 14, 2006 3:07:20 PM Operating System: Microsoft Windows 2000, Service Pack 4 (Build 2195) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 14/12/2006 Kaspersky Anti-Virus database records: 250844 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - Folders: C:\ Scan Statistics: Total number of scanned objects: 36496 Number of viruses found: 1 Number of infected objects: 0 / 0 Number of suspicious objects: 1 Duration of the scan process: 01:06:13 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Application Data\Microsoft\Outlook\MS Exchange Settings 3.NICK Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Outlook\outcmd.dat Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012006121420061215\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\MMC1C63.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\MMCB.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\SOF9.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\SOFA.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\~DF3492.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\~DF9ADB.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\4\~DF9C8E.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Shared Fax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Shared Fax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\Default User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Program Files\Exchsrvr\ExchangeServer_MASTER1\ExchangeServer_MASTER1.edb Object is locked skipped C:\Program Files\Exchsrvr\ExchangeServer_MASTER1\GatherLogs\priv1A55A879.65.gthr Object is locked skipped C:\Program Files\Exchsrvr\ExchangeServer_MASTER1\MSS.log Object is locked skipped C:\Program Files\Exchsrvr\ExchangeServer_MASTER1\tmp.edb Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\E00.log Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\E00tmp.log Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\priv1.edb Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\priv1.stm Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\pub1.edb Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\pub1.stm Object is locked skipped C:\Program Files\Exchsrvr\MDBDATA\tmp.edb Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\AP0.LOG Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\BF0.LOG Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000003.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000005.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000008.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000009.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000A.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000B.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000C.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000D.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000E.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00000F.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000010.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000011.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000012.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000013.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000014.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000015.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000016.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000017.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000018.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000019.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001A.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001B.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001C.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001D.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001E.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB00001F.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000021.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000022.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DB000027.DAT Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\DBREFS Object is locked skipped C:\Program Files\Exchsrvr\MTADATA\EV0.LOG Object is locked skipped C:\Program Files\Microsoft ISA Server\GKDB.ldb Object is locked skipped C:\Program Files\Microsoft ISA Server\GKDB.MDB Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\msdbdata.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\msdblog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\northwnd.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\northwnd.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\pubs.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\pubs_log.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\resource_Data.MDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\resource_Log.LDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\sp3_la_new_orleans_072604_Data.MDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\sp3_la_new_orleans_072604_Log.LDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\VIALINK_Data.MDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\VIALINK_Log.LDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\VIALINK_Tables_Data.MDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\Data\VIALINK_Tables_Log.LDF Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL\LOG\ERRORLOG Object is locked skipped C:\Program Files\OLAP Services\Bin\msmdqlog.ldb Object is locked skipped C:\Program Files\OLAP Services\Bin\msmdqlog.mdb Object is locked skipped C:\Program Files\Trend\Smex\QM\SMEX_QM_DB.ldb Object is locked skipped C:\Program Files\Trend\Smex\QM\SMEX_QM_DB.mdb Object is locked skipped C:\Program Files\Trend Micro\OfficeScan Client\Temp\VSSALPE7.760 Suspicious: Type_Win32 skipped C:\WINNT\Debug\ipsecpa.log Object is locked skipped C:\WINNT\Debug\Netlogon.log Object is locked skipped C:\WINNT\Debug\NtFrs_0005.log Object is locked skipped C:\WINNT\Debug\oakley.log Object is locked skipped C:\WINNT\Debug\PASSWD.LOG Object is locked skipped C:\WINNT\NETLOGON.CHG Object is locked skipped C:\WINNT\NTDS\edb.log Object is locked skipped C:\WINNT\NTDS\ntds.dit Object is locked skipped C:\WINNT\NTDS\temp.edb Object is locked skipped C:\WINNT\ntfrs\jet\log\edb.log Object is locked skipped C:\WINNT\ntfrs\jet\ntfrs.jdb Object is locked skipped C:\WINNT\ntfrs\jet\temp\tmp.edb Object is locked skipped C:\WINNT\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.crmlog Object is locked skipped C:\WINNT\SchedLgU.Txt Object is locked skipped C:\WINNT\SoftwareDistribution\EventCache\{3DCDD1AD-DD86-482A-9730-4BA17B687A35}.bin Object is locked skipped C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINNT\Sti_Trace.log Object is locked skipped C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped C:\WINNT\system32\config\default Object is locked skipped C:\WINNT\system32\config\default.LOG Object is locked skipped C:\WINNT\system32\config\DnsEvent.Evt Object is locked skipped C:\WINNT\system32\config\NTDS.Evt Object is locked skipped C:\WINNT\system32\config\NtFrs.Evt Object is locked skipped C:\WINNT\system32\config\SAM Object is locked skipped C:\WINNT\system32\config\SAM.LOG Object is locked skipped C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped C:\WINNT\system32\config\SECURITY Object is locked skipped C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped C:\WINNT\system32\config\software Object is locked skipped C:\WINNT\system32\config\software.LOG Object is locked skipped C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped C:\WINNT\system32\config\system Object is locked skipped C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped C:\WINNT\system32\dns\dns.log Object is locked skipped C:\WINNT\system32\DTCLog\MSDTC.LOG Object is locked skipped C:\WINNT\system32\hmdebug.log Object is locked skipped C:\WINNT\system32\ias\dnary.ldb Object is locked skipped C:\WINNT\system32\ias\ias.ldb Object is locked skipped C:\WINNT\system32\ias\ias.mdb Object is locked skipped C:\WINNT\system32\LogFiles\W3SVC1\ex061214.log Object is locked skipped C:\WINNT\system32\LogFiles\W3SVC3\ex061214.log Object is locked skipped C:\WINNT\system32\msmq\STORAGE\l0000228.mq Object is locked skipped C:\WINNT\system32\msmq\STORAGE\QMLog Object is locked skipped C:\WINNT\system32\wbem\Logs\NTEVT.log Object is locked skipped C:\WINNT\system32\wbem\Logs\WBEMSNMP.log Object is locked skipped C:\WINNT\system32\wbem\Repository\CIM.REP Object is locked skipped C:\WINNT\system32\wins\j50.log Object is locked skipped C:\WINNT\system32\wins\wins.mdb Object is locked skipped C:\WINNT\system32\wins\winstmp.mdb Object is locked skipped C:\WINNT\Temp\gthrsvc\Ntf1.tmp Object is locked skipped C:\WINNT\Temp\gthrsvc\Ntf4.tmp Object is locked skipped C:\WINNT\Temp\JET206F.tmp Object is locked skipped C:\WINNT\Temp\JET35DB.tmp Object is locked skipped C:\WINNT\Temp\JET66AA.tmp Object is locked skipped C:\WINNT\Temp\JETA1DE.tmp Object is locked skipped C:\WINNT\Temp\JETB651.tmp Object is locked skipped C:\WINNT\WindowsUpdate.log Object is locked skipped Scan process completed.
Post #9
Ok that all looks good.




Great news ! [external image: Posted Image]

Your log now appears to be clean.

Lets do a few things to tidy up.
Please do these in the order I suggest!




This program functions much like ATF cleaner..You may try this if you like or just use AFT cleaner instead.
This one has a few more options is all.
___________________________________
Download and install CCleaner from here.
If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.


Now open the program and click on Run Cleaner
( Do not use the Issues block to clean anything with this program. It is for experts only and it is risky).

You may opt out of cleaning cookies. If you clean them alls you will have to do is retype names and passwords for places you visit on the net 1 time.
If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla
I clean all my cookies out from time to time. It's not that big a deal if you remember passwords.



___________________________________
A few things to help with possible threats
SpywareBlaster

Install SpywareBlaster

SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.


______________________________
SiteHound

http://www.firetrust.com/firetrustsitehound.html

This tool bar will help protect you from.

Over 4,000 fake bank and credit sites.
Tens of thousands of pornographic
and adult sites.
The never ending fake phishing sites.
Malicious sites, which can infect you
with spyware and adware if you visit
them.
Sites to download software which
may infect your computer with
spyware, a virus or adware


___________________________________
Download and keep these updated and run weekly if you don't already have them.

Adaware
Tutorial

spybot seach & destroy
Tutorial




___________________________________
Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.


___________________________________
Make your Internet Explorer more secure
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

6. Next press the Apply button and then the OK to exit the Internet Properties page. Safe and Happy Surfing. :)
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI