Need some help wth a log file please

[jungledeaf]

I am working out the bugs in a friends windows 2000 box. When I got the machine it had about 200 spyware progs running and Avast came up with 75 viruses on start up scan and periodically comes up with other viruses.

*** In the task manageri386.exe was running but I quit it so it didnt' show up in the log.
Also a thorough scan with Avast showed that a file KYSVCXD.exe was found but could not be scanned.

Not sure if it will make a difference to restart and repost the log. Let me know please!

Logfile of HijackThis v1.99.1
Scan saved at 9:13:46 PM, on 6/8/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\cfmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\spoolsvc.exe
C:\WINNT\system32\rmvhprv.exe
C:\WINNT\system32\secsvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjtt\HijackThis.exe

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINNT\system32\spoolsvc.exe
O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\System32\explorer.exe
O4 - HKLM\..\Run: [Virus Removal Tool] C:\WINNT\system32\rmvhprv.exe
O4 - HKLM\..\Run: [System Event Manager] secsvc.exe
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] i386.exe
O4 - HKLM\..\Run: [checkrun] c:\winnt\system32\elitegsx32.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [System Event Manager] secsvc.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] i386.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] i386.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Sound Sservice Driver (Sound Service) - Unknown owner - C:\WINNT\System32\cfmon.exe
O23 - Service: ssms - Unknown owner - C:\WINNT\ssms.exe

Thanks!

[Gecko]

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Please download
Unzip it to the desktop but please do NOT run it yet.

Reboot into Safe Mode:
After you see the BIOS screen and before Windowes starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Press Ctrl/Alt/Del and"End Task"or"End Process"on each of the following:
(They may or may not be there)
cfmon
spoolsvc
rmvhprv
secsvc
ssms
i386

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINNT\system32\spoolsvc.exe
O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\System32\explorer.exe
O4 - HKLM\..\Run: [Virus Removal Tool] C:\WINNT\system32\rmvhprv.exe
O4 - HKLM\..\Run: [System Event Manager] secsvc.exe
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] i386.exe
O4 - HKLM\..\Run: [checkrun] c:\winnt\system32\elitegsx32.exe
O4 - HKLM\..\RunServices: [System Event Manager] secsvc.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] i386.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] i386.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sound Sservice Driver (Sound Service) - Unknown owner - C:\WINNT\System32\cfmon.exe
O23 - Service: ssms - Unknown owner - C:\WINNT\ssms.exe

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Do a search of your system for i386.exe write down it's location to be deleted later
Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

Run KillBox and paste the below into the text box:
C:\WINNT\system32\spoolsvc.exe
Now put a check next to 'Standard file kill' and 'End explorer Shell while killing file' next click on the red X

Now do the same for each of the following files:
C:\WINNT\System32\explorer.exe
C:\WINNT\system32\rmvhprv.exe
C:\WINNT\System32\cfmon.exe
C:\WINNT\system32\secsvc.exe
C:\WINNT\ssms.exe

Also the i386.exe file you searched for

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

[jungledeaf]

Logfile of HijackThis v1.99.1
Scan saved at 6:16:45 PM, on 6/9/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\hjtt\HijackThis.exe

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Sound Sservice Driver (Sound Service) - Unknown owner - C:\WINNT\System32\cfmon.exe (file missing)

[Gecko]

You log looks clean,
Now that your system is clean, this is a good time to set up protection against further attacks.

1) Watch what you download!
Read all security warnings, license agreements, and privacy statements associated with any software you download.
Only download programs from Web sites you trust. If you're not sure whether to trust a program you are considering downloading,
enter the name of the program into your favorite search engine to see if anyone else has reported that it contains spyware.
Never click "agree" or "OK" to close a window. Instead, click the red "x" in the corner of the window
or press the Alt + F4 buttons on your keyboard to close a window.

2) Keep Windows up to date!
Go to IE > Tools > Windows Update > Product Updates, and install ALL Security
Updates listed. If you're running Windows XP, that of course includes the Service Pack 2!
Don't forget to check for updates every week or so.

3) Internet Explorer security settings!
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned
ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

4.) Anti-Virus program!
Make sure you have an Anti-Virus program installed, updated and running.

5.) Use a Firewall!
If you do not have a hardware firewall like a router, then you need to use a software firewall like Zone Alarm or Windows XP’s built in one.

6.) Real time protection!
Real time protection for spyware refers to the same protection a virus scan gives you with for viruses.
It is constantly monitoring files coming into and leaving from your computer for potential dangers.
Here are two free programs that offer this type of protection: