PCTech Forums

I am scanning with 3 different scanners, including; scan spyware, ad-aware and webroot spysweeper. I check for updates everyday, and scan my PC every morning. From the ad-aware statistics the most spywares I'm having are these: VX2, 180Solutions & LOP. So, if you notice I'm really trying to remove them. The problem is that about 5 mintues after scanning, on the desktop I will find 6 icons (Website Hosting, CasinoOnline, internet, Poker, Printer Cartridges, Travel). Apart from that, IE and Nestscape Navigator will be attacked too. The homepage, which is normally set to google, will become something like this - http://www.enivxcmgowumfbkwgzsnwzqf.com ... HJcBAo.htm (which does not exist). Netscape settings are all messed up, and several bookmarks, about 15. I am removing these every morning, but the following day they will be back on my desktop again. Here's a HijackThis logfile:

Logfile of HijackThis v1.98.2
Scan saved at 10:11:53 AM, on 9/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows SyncroAd\WinSync.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\cidaemon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.touioedxfyrarjpjytcehou.com/ ... JcBAo.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nrhabkuykgzqczzwqyibhu.com/i ... IswGqz.htm
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.enivxcmgowumfbkwgzsnwzqf.com/irxpRUzj1iJqfXwDOS1r9fS_YvXZTwhg8BbUtHJcBAo.htm"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\Aimwin.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64HEAR~1\Waitstop.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Bore Bias.exe
O4 - HKLM\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

Thankx in advance mates Now I'm gonna remove these manually, damn

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

Aimwin.exe
Bore Bias.exe
Waitstop.exe
SyncroAd.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.touioedxfyrarjpjytcehou.com/ ... JcBAo.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nrhabkuykgzqczzwqyibhu.com/i ... IswGqz.htm
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.enivxcmgowumfbkwgzsnwzqf.com/irxpRUzj1iJqfXwDOS1r9fS_YvXZTwhg8BbUtHJcBAo.htm"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\Aimwin.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Bore Bias.exe
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64HEAR~1\Waitstop.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe

Go to Control Panel / Add/Remove Programs and remove the following if they are there:

Windows SyncroAd

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

C:\PROGRA~1\DOWNLO~1\Aimwin.exe
C:\Documents and Settings\All Users\Application Data\store the acid find
C:\PROGRA~1\64HEAR~1\Waitstop.exe
C:\Program Files\Windows SyncroAd

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

I'd also Install and Run

brad

Turn off System Restore. <<<

How can I turn off the system restore?

Hey Daninku

Read

Ok done:

C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\My Software\SpywareGuard\sgmain.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\SpywareGuard\sgbhp.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt/"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\My Software\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\My Software\SpywareGuard\sgmain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

I can notice the difference, my PC ir running faster without those crap. I hope they will not come out again

Hi Daninku

It seems you haven't posted your entire logfile. Please re-post

OOPS sry

Logfile of HijackThis v1.98.2
Scan saved at 3:08:53 PM, on 9/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\My Software\SpywareGuard\sgmain.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\SpywareGuard\sgbhp.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt/"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\My Software\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\My Software\SpywareGuard\sgmain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab