What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] worm.win32.netsky & smitfraud-c.msvps with warning

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Last week i downloaded a player and ended up with security pop-ups saying I had worm.win32.netsky virus and spybot has found Mitfraud-c.msvps.

I get the black pop up box, the gray boxes telling me I have this worm and have to download security software, my explorer, my explorer goes to a website I don't want popping up rather than my home page.

My IT dept at my office wants to reimage my laptop but from what I'm reading it doesn't seem like it needs to be that drastic.

I've read the other posts and went so far as to try to download SmitfraudFix but get to the point of it being copied and I a get an error message saying: Cannot copy SmitfraudFix[1]: Access is denied.
Make sure the disk is not full or write-protected and that the file is not currently in use.

I have continuous pop-ups and now after the last rebook my wallpaper has changed to this scary red with a white banner saying download security software now.

Ive never had a virus or anything like this before not on any computer i've owned. I'm so lost… I'm not sure what to do - I'm not secure enough to do attempt fixing this on my own and don't want to screw this up any further and lose all my data.

i'm really hoping someone can help me.
I have run a hijack log and pasted it below.

Any help would be so greatly appreciated.

Thank you!!!
Kathy



Logfile of HijackThis v1.99.1
Scan saved at 11:47:16 AM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Cisco Systems\CSAgent\bin\CSAControl.exe
C:\Program Files\Cisco Systems\CSAgent\bin\leventmgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\cisvc.exe
C:\Program Files\EMC VPN\VPN Client\cvpnd.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\stsystra.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\EMCSoftware\EMCSIUser.exe
C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
C:\Program Files\eRoom 7\ERClient7.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://oa.corp.emc.com/emcweb
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: MSVPS System - {E75B284A-D5D0-4F5D-9BD3-59637A85F5D0} - C:\WINNT\werbetlsp.dll
O3 - Toolbar: The hdtip - {872F66C1-E394-4545-8843-EDE16648058A} - C:\WINNT\hdtip.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NVHotkey] "rundll32.exe" nvHotkey.dll,Start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Monitor My eRooms (V7).lnk = C:\Program Files\eRoom 7\ERClient7.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Security Agent.lnk = ?
O4 - Global Startup: EMCSI.lnk = C:\EMCSoftware\EMCSIUser.exe
O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://itcentral.corp.emc.com
O15 - Trusted Zone: http://itonline.isus.emc.com
O15 - Trusted Zone: http://itportal.corp.emc.com
O15 - Trusted Zone: http://itcentral.corp.emc.com (HKLM)
O15 - Trusted Zone: http://itonline.isus.emc.com (HKLM)
O15 - Trusted Zone: http://itportal.corp.emc.com (HKLM)
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.emc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O20 - AppInit_DLLs: csauser.dll
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: gormet - {A52F9770-163F-4D69-A5E1-877A624DD173} - C:\WINNT\gormet.dll
O21 - SSODL: pmkret - {D1327984-B1E1-41C1-A23D-E762FE56148A} - C:\WINNT\pmkret.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Security Agent (CSAgent) - Unknown owner - C:\Program Files\Cisco Systems\CSAgent\bin\CSAControl.exe" -t c (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\EMC VPN\VPN Client\cvpnd.exe
O23 - Service: EMC Software Install Manager (EMCSI) - EMC - C:\EMCSoftware\EMCSI.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Post #2
Only for Windows XP and Windows 2000

Hello and welcome to the Forums.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Double Click SmitfraudFix.exe on your Desktop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________
Next:

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:
  • Click the Update icon at the top and under Manual Update click the Start update button.
  • The program will either update or inform you that no update was available.
  • It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).
Please set up the program as follows:
  • Click the Shield icon at the top and under Resident shield is… click active. This should now
    change to inactive.
  • Click the Update icon and untick the automatic update option.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
  • Under How to act? - make sure that Quarantine is selected.
  • Under How to scan? - All checkboxes should be ticked.
  • Under Possibly unwanted software - All checkboxes should be ticked.
  • Under Reports - Select Do not automatically generate reports.
  • Under What to scan? - Select Scan every file.
Close all open windows.
Do not run a scan yet.

______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt


IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt
Post #3
Thank you very much for your help I'm not able to get SmitfraudFix to finish. It downloads in seconds but when It gets to the point of copying, I get an error message: Cannot copy SmitfraudFix[1]: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use.
Post #4
Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #5
OMG - I can download combofix and I can see the .exe file on my desk top but when I double click it - I get this error message: Combofix.exe is not a valid win32 appplication. Any thoughts???
Post #6
Lets try uninstalling it and downloading it again
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]
  • If shown the disclaimer, Select "2"

After the above:


Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #7
I got another error message: Windows cannot find 'ComboFix'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click search. I'm not the most technical person but I can download a file and I can see when it shows up on my desk top. When I try downloading it again I get a message saying the file already exists and asks if I want to replace it. That leads me to believe that I have downloaded it but the uninstall can't find it.
Post #8
You might have a infection that is blocking the install / running of these programs.

Lets try this:

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
  • If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    [external image: Posted Image]
    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
Post #9
Finally a little bit of sucess - it took several hours but I was able to run Dr Web and this is the log: Thank you very much for your help!!! inst.exe;C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3;Probably BACKDOOR.Trojan;Moved.; ADCFreeInstaller[1].exe;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\Content.IE5\GH2J6DEH;Trojan.Winfixer;Deleted.; 06-19-07 OSI 61833742S.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; 07-26-07 ROCKWELL AUTOMATION INC M61131606S12.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; 07-27-07 ADIC C323007.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; 12-04-06 ROCKWELL AUTOMATION 61805319S0.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; 12-17-06 ROCKWELL AUTOMATION INC Q60458203.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; NOV 08 Regal-Beloit Corporation M60874293S36 (2).xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; NOV 08 Regal-Beloit Corporation M60874293S36.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; NOV 08- KIMBERLY CLARK CORPORATION M61550241S5A (2).xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; NOV 08- KIMBERLY CLARK CORPORATION M61550241S5A.xls;C:\Documents and Settings\bonik\Local Settings\Temporary Internet Files\OLK1D;XM.Fatum;Cured.; Monr.xls;C:\Documents and Settings\bonik\My Documents\Monroe Clinic;XM.Fatum;Cured.; A0000014.DLL;C:\System Volume Information\_restore{A2287FFC-3121-4EA2-9036-CA6D1797D84A}\RP1;Adware.Msearch;Moved.; A0000015.DLL;C:\System Volume Information\_restore{A2287FFC-3121-4EA2-9036-CA6D1797D84A}\RP1;Adware.Msearch;Moved.; A0000017.DLL;C:\System Volume Information\_restore{A2287FFC-3121-4EA2-9036-CA6D1797D84A}\RP1;Adware.Msearch;Moved.; A0000018.DLL;C:\System Volume Information\_restore{A2287FFC-3121-4EA2-9036-CA6D1797D84A}\RP1;Adware.Msearch;Moved.; A0000080.dll;C:\System Volume Information\_restore{A2287FFC-3121-4EA2-9036-CA6D1797D84A}\RP1;Adware.Msearch;Moved.; admin3.vbe;C:\WINNT;Probably SCRIPT.Virus;Moved.; admin3_i.vbe;C:\WINNT;Probably SCRIPT.Virus;Moved.;
Post #11
Can you check the file size of combofix.exe please? Right Click on combofix.exe > Properties> General That should show the size. Post the size.
Post #12
Ok, here we go:

combofix.exe: 1.52 MB (1,596,372 bytes)

ComboFix log:

ComboFix 07-12-08.1 - bonik 2007-12-08 10:06:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1487 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\bonik\Desktop\Error Cleaner.url
C:\Documents and Settings\bonik\Desktop\Privacy Protector.url
C:\Documents and Settings\bonik\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\bonik\Favorites\Error Cleaner.url
C:\Documents and Settings\bonik\Favorites\Privacy Protector.url
C:\Documents and Settings\bonik\Favorites\Spyware&Malware Protection.url
C:\WINNT\dat.txt
C:\WINNT\hdtip.dll
C:\WINNT\privacy_danger
C:\WINNT\privacy_danger\images\capt.gif
C:\WINNT\privacy_danger\images\danger.jpg
C:\WINNT\privacy_danger\images\down.gif
C:\WINNT\privacy_danger\images\spacer.gif
C:\WINNT\privacy_danger\index.htm
C:\WINNT\rs.txt
C:\WINNT\search_res.txt

.
((((((((((((((((((((((((( Files Created from 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))
.

2007-12-07 18:58 . 2007-12-07 18:58 d——– C:\Documents and Settings\bonik\DoctorWeb
2007-12-03 14:20 . 2007-12-03 14:20 d——– C:\unzipped
2007-11-30 23:06 . 2007-11-30 23:06 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-27 16:47 . 2007-11-27 16:47 164 –a—— C:\install.dat
2007-11-27 11:56 . 2005-09-23 08:29 626,688 –a—— C:\WINNT\system32\msvcr80.dll
2007-11-26 16:02 . 2007-12-06 20:50 d——– C:\Documents and Settings\bonik\Application Data\Lavasoft
2007-11-26 16:01 . 2007-12-01 10:32 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-26 08:41 . 2007-11-26 06:22 229,376 –a—— C:\WINNT\gormet.dll
2007-11-26 08:41 . 2007-11-26 06:22 204,800 –a—— C:\WINNT\pmkret.dll
2007-11-26 08:41 . 2007-11-26 06:22 81,920 –a—— C:\WINNT\monhop.exe
2007-11-26 08:30 . 2007-11-26 09:01 d——– C:\Program Files\RichVideoCodec
2007-11-17 19:22 . 2007-11-17 19:22 d——– C:\Documents and Settings\bonik\Application Data\LinkedIn
2007-11-17 12:20 . 2007-11-17 12:20 d——– C:\Documents and Settings\bonik\Application Data\PlayFirst
2007-11-17 12:20 . 2007-11-17 12:20 d——– C:\Documents and Settings\All Users\Application Data\PlayFirst
2007-11-16 19:20 . 2007-11-16 19:20 d——– C:\Documents and Settings\bonik\Application Data\Download Manager
2007-11-16 19:19 . 2007-11-16 19:19 d——– C:\Program Files\Akamai
2007-11-15 10:29 . 2007-11-15 10:29 d——– C:\WINNT\system32\Dell

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 23:05 ——— d—–w C:\Program Files\Norton Security Scan
2007-11-26 14:51 ——— d—–w C:\Program Files\Google
2007-11-26 14:00 ——— d—–w C:\Program Files\Common Files\Oberon Media
2007-11-26 14:00 ——— d—–w C:\Program Files\Comcast Play Games
2007-11-19 14:39 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-19 04:13 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-01 17:44 51,304 —-a-w C:\WINNT\system32\drivers\atnt40k.sys
2007-10-30 23:30 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-30 23:30 ——— d—–w C:\Program Files\Cisco Systems
2007-10-30 20:01 ——— d—–w C:\Program Files\iTunes
2007-10-30 20:00 ——— d—–w C:\Program Files\iPod
2007-10-23 23:43 ——— d—–w C:\Program Files\Brio
2007-10-13 22:56 ——— d—–w C:\Program Files\Java
2007-10-13 22:54 ——— d—–w C:\Program Files\Common Files\Java
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872F66C1-E394-4545-8843-EDE16648058A}"= C:\WINNT\hdtip.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{872f66c1-e394-4545-8843-ede16648058a}]
[HKEY_CLASSES_ROOT\hdtip.ToolBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{20675C1B-8407-4F3B-AFC2-D30C3EF0E5F4}]
[HKEY_CLASSES_ROOT\hdtip.ToolBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 21:49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 11:33]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 07:00 C:\WINNT\system32\rundll32.exe]
"NVHotkey"="rundll32.exe" [2004-08-04 07:00 C:\WINNT\system32\rundll32.exe]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 22:00 C:\WINNT\stsystra.exe]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 03:06]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]

C:\Documents and Settings\bonik\Start Menu\Programs\Startup\
Monitor My eRooms (V7).lnk - C:\Program Files\eRoom 7\ERClient7.exe [2007-01-05 15:36:07]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Cisco Security Agent.lnk - C:\Program Files\Cisco Systems\CSAgent\bin\okclient.exe [2007-10-30 18:30:39]
EMCSI.lnk - C:\EMCSoftware\EMCSIUser.exe [2001-06-29 08:17:56]
MediaChecker.lnk - C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe [2007-02-13 21:38:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"= 1 (0x1)
"HideLogonScripts"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= file:///C:\WINNT\privacy_danger\index.htm
FriendlyName= Privacy Protection

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"= shdocvw.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gormet"= {A52F9770-163F-4D69-A5E1-877A624DD173} - C:\WINNT\gormet.dll [2007-11-26 06:22 229376]
"pmkret"= {D1327984-B1E1-41C1-A23D-E762FE56148A} - C:\WINNT\pmkret.dll [2007-11-26 06:22 204800]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=csauser.dll

Paused2 EMCSI;EMC Software Install Manager;C:\EMCSoftware\EMCSI.exe
R0 a320raid;a320raid;C:\WINNT\system32\DRIVERS\a320raid.sys
R0 csacenter;Cisco Security Agent Rule Engine;C:\WINNT\system32\drivers\csacentr.sys
R0 csafile;Cisco Security Agent File Access Controller;C:\WINNT\system32\drivers\csafile.sys
R0 csanet;Cisco Security Agent Packet Verifier;C:\WINNT\system32\drivers\csanet.sys
R0 csareg;Cisco Security Agent Registry Access Controller;C:\WINNT\system32\drivers\csareg.sys
R0 PzWDM;PzWDM;C:\WINNT\system32\Drivers\PzWDM.sys
R1 csatdi;Cisco Security Agent Network Access Controller;C:\WINNT\system32\drivers\csatdi.sys
R1 NaiAvTdi1;NaiAvTdi1;C:\WINNT\system32\drivers\mvstdi5x.sys
R2 CcmExec;SMS Agent Host;C:\WINNT\system32\CCM\CcmExec.exe
R2 CSAgent;Cisco Security Agent;"C:\Program Files\Cisco Systems\CSAgent\bin\CSAControl.exe" -t c
R2 Wuser32;SMS Remote Control Agent;C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
R3 idisw2km;idisw2km;C:\WINNT\system32\DRIVERS\idisw2km.sys
R3 kbstuff;SMS Virtual Keyboard;C:\WINNT\system32\DRIVERS\kbstuff5.sys
R3 prepdrvr;SMS Process Event Driver;\??\C:\WINNT\system32\CCM\prepdrv.sys
R3 USBCCID;USB Smart Card reader;C:\WINNT\system32\DRIVERS\usbccid.sys
S0 black;black;C:\WINNT\system32\drivers\BlackDrv.sys
S3 RapFile;RapFile;\??\C:\WINNT\system32\drivers\RapFile.sys
S3 RapNet;RapNet;\??\C:\WINNT\system32\drivers\RapNet.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-12-04 20:43:03 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 17:02:50 C:\WINNT\Tasks\Daily Backup INC.job"
- C:\WINNT\system32\ntbackup.exeEbackup
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINNT\Explorer.EXE [6.00.2900.2180]
-> C:\WINNT\gormet.dll
-> C:\DOCUME~1\bonik\LOCALS~1\Temp\krbnjexqKL1C.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 10:44:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-08 10:45:12 - machine was rebooted
.
— E O F —

Hijack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 10:50, on 2007-12-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Cisco Systems\CSAgent\bin\CSAControl.exe
C:\Program Files\Cisco Systems\CSAgent\bin\leventmgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\EMC VPN\VPN Client\cvpnd.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\stsystra.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\EMCSoftware\EMCSIUser.exe
C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
C:\Program Files\eRoom 7\ERClient7.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://oa.corp.emc.com/emcweb
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: The hdtip - {872F66C1-E394-4545-8843-EDE16648058A} - C:\WINNT\hdtip.dll (file missing)
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NVHotkey] "rundll32.exe" nvHotkey.dll,Start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Monitor My eRooms (V7).lnk = C:\Program Files\eRoom 7\ERClient7.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Security Agent.lnk = ?
O4 - Global Startup: EMCSI.lnk = C:\EMCSoftware\EMCSIUser.exe
O4 - Global Startup: MediaChecker.lnk = C:\Program Files\HOTALBUMMyBOX\MediaChecker.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://itcentral.corp.emc.com
O15 - Trusted Zone: http://itonline.isus.emc.com
O15 - Trusted Zone: http://itportal.corp.emc.com
O15 - Trusted Zone: http://itcentral.corp.emc.com (HKLM)
O15 - Trusted Zone: http://itonline.isus.emc.com (HKLM)
O15 - Trusted Zone: http://itportal.corp.emc.com (HKLM)
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.emc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.emc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = corp.emc.com,isus.emc.com,lss.emc.com,eng.emc.com,webo.dg.com,documentum.com,emc
.com,legato.com,vmware.com
O20 - AppInit_DLLs: csauser.dll
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O21 - SSODL: gormet - {A52F9770-163F-4D69-A5E1-877A624DD173} - C:\WINNT\gormet.dll
O21 - SSODL: pmkret - {D1327984-B1E1-41C1-A23D-E762FE56148A} - C:\WINNT\pmkret.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Cisco Security Agent (CSAgent) - Unknown owner - C:\Program Files\Cisco Systems\CSAgent\bin\CSAControl.exe" -t c (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\EMC VPN\VPN Client\cvpnd.exe
O23 - Service: EMC Software Install Manager (EMCSI) - EMC - C:\EMCSoftware\EMCSI.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
Post #13
GREAT. :thumbup:
Now lets do the smitfraud fix. You probubly don't need to download it again, just follow the instructions.

Only for Windows XP and Windows 2000

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Double Click SmitfraudFix.exe on your Desktop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________
Next:

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:
  • Click the Update icon at the top and under Manual Update click the Start update button.
  • The program will either update or inform you that no update was available.
  • It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).
Please set up the program as follows:
  • Click the Shield icon at the top and under Resident shield is… click active. This should now
    change to inactive.
  • Click the Update icon and untick the automatic update option.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
  • Under How to act? - make sure that Quarantine is selected.
  • Under How to scan? - All checkboxes should be ticked.
  • Under Possibly unwanted software - All checkboxes should be ticked.
  • Under Reports - Select Do not automatically generate reports.
  • Under What to scan? - Select Scan every file.
Close all open windows.
Do not run a scan yet.

______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt


IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt
Post #14
still getting the same error on the smitfraudfix: it gets to 99% complete and when it tries to copy I get this error:


Starts fine:
Copying
Smitfraudfix[1].exe
from scw3dxcx to desktop

After a minute or so it errors to:

Cannot copy Smitfraudfix[1]: Access is denied
make sure the disk is not full or write protected
and that the file is not currently in use
Post #15
OK. I'll use the Combo scan and give you a fix it a couple minutes.
Hang in there, we'll get it.

By the way, the Dr.Web scan shows a BACKDOOR.Trojan. If I forget to tell you after you're pc is clean, be sure to change all your passwords Not until I tell you you're clean though.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI