Vicious little piece of spy/adware

[gkajmowi]

I've been working on a copmuter for about 4 hours trying to remove a piece of adware which is causing great pains. It continually recreates a file v3.exe in the root directory and running it, as well as pointing a new browser window to planet.nana.co.il
Another part (another piece?) keeps creating files called Gamma.html, x.bat and registry files to change security permissions.

I'd download all of the updates, but for some reason I cannot get to either download.microsoft.com or windowsupdate.microsoft.com. I don't know if it's due to the spyware or not. I downloaded all of the hotfixes I could on my home machine and burned them to CD and installed them, but I don't know if I got everything.

Anyways, here is my hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 5:55:11 PM, on 10/13/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINNT\System32\hphmon05.exe
C:\WINNT\system32\regscan32.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINNT\System32\HPZipm12.exe
C:\WINNT\system32\cmd.exe
C:\v3.exe
C:\WINNT\system32\??rvices.exe
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\U8LY9VRI\HijackThis[1].exe

O2 - BHO: (no name) - {33AE6B2C-EE42-59CD-D452-64550DF1294B} - C:\WINNT\System32\gxa.dll
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINNT\System32\hphmon05.exe
O4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exe
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED0922DA-6AF4-4D18-AEB9-19F5F17FD473}: NameServer = 216.211.26.10 216.211.26.11

Thanks for the help.
- Garrett

[Cactus]

Before running the newer HJT,goto Housecalls...link is below my post in my Signature...do the Scan let it fix everything it finds.


I noticed you D/L an earlier version of HJT.
Could you please download Hijackthis Version 1.98.2
I also noticed you D/L it to a TEMP FOLDER...
---Important---Create a permanent folder
EG---- Open MyDocuments----Right click an empty spot and select NEW---Folder----Name the new folder HJT ---this is where you will want to save Hijackthis too, also, backups will be stored there.
Download from here
http://aumha.org/downloads/hijackthis.exe

Do a SCAN----Scan will change to SAVE LOG----copy and paste the WHOLE contents of the log
here... Don't try and fix anything yet----most entries are harmless and needed.

Cactus

[Geekgirl]

Hello gkajmowi

Scan your computer with this free online scanner before posting the newer version of HJT. You may be infected with a Trojan. Eliminating it before you post your HJT logfile will help the moderators in giving you your instructions.

[gkajmowi]

[Geekgirl]

Well if it has Norton Anti-Virus installed that's more reason to use the online scanner

So you haven't used either as suggested by Cactus?

We normally wont suggest you visit a certain site unless we see something in your logfile. We both suggested it so Norton is not picking it up.

We can only offer suggestions to help you.