It is currently Wed Oct 21, 2026 12:12 am


Annoying spyware

All versions of Windows 7, 2008 and Vista including 32 bit and 64 bit

Moderator: icecube

Post a reply

Annoying spyware

Postby Daninku » Tue Sep 28, 2004 9:13 am

I am scanning with 3 different scanners, including; scan spyware, ad-aware and webroot spysweeper. I check for updates everyday, and scan my PC every morning. From the ad-aware statistics the most spywares I'm having are these: VX2, 180Solutions & LOP. So, if you notice I'm really trying to remove them. The problem is that about 5 mintues after scanning, on the desktop I will find 6 icons (Website Hosting, CasinoOnline, internet, Poker, Printer Cartridges, Travel). Apart from that, IE and Nestscape Navigator will be attacked too. The homepage, which is normally set to google, will become something like this - http://www.enivxcmgowumfbkwgzsnwzqf.com ... HJcBAo.htm (which does not exist). Netscape settings are all messed up, and several bookmarks, about 15. I am removing these every morning, but the following day they will be back on my desktop again. Here's a HijackThis logfile:

Logfile of HijackThis v1.98.2
Scan saved at 10:11:53 AM, on 9/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows SyncroAd\WinSync.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\cidaemon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.touioedxfyrarjpjytcehou.com/ ... JcBAo.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nrhabkuykgzqczzwqyibhu.com/i ... IswGqz.htm
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.enivxcmgowumfbkwgzsnwzqf.com/irxpRUzj1iJqfXwDOS1r9fS_YvXZTwhg8BbUtHJcBAo.htm"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\Aimwin.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64HEAR~1\Waitstop.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Bore Bias.exe
O4 - HKLM\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

Thankx in advance mates :wink: Now I'm gonna remove these manually, damn :mad:
Daninku
Senior Geek
Senior Geek
 
Posts: 258
Joined: Tue Aug 17, 2004 1:00 am
Location: MALTA, Dingli

Thanks given:0
Thanks received:0
Top

Postby brad » Tue Sep 28, 2004 10:48 am

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

Aimwin.exe
Bore Bias.exe
Waitstop.exe
SyncroAd.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.touioedxfyrarjpjytcehou.com/ ... JcBAo.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nrhabkuykgzqczzwqyibhu.com/i ... IswGqz.htm
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.enivxcmgowumfbkwgzsnwzqf.com/irxpRUzj1iJqfXwDOS1r9fS_YvXZTwhg8BbUtHJcBAo.htm"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\Aimwin.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Bore Bias.exe
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64HEAR~1\Waitstop.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe

Go to Control Panel / Add/Remove Programs and remove the following if they are there:

Windows SyncroAd

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

C:\PROGRA~1\DOWNLO~1\Aimwin.exe
C:\Documents and Settings\All Users\Application Data\store the acid find
C:\PROGRA~1\64HEAR~1\Waitstop.exe
C:\Program Files\Windows SyncroAd

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

I'd also Install and Run

brad
brad
Geek Alumni
 
Posts: 2079
Joined: Sat Jul 19, 2003 1:00 am
Location: Charlotte, NC

Thanks given:0
Thanks received:0
Top

Postby Daninku » Tue Sep 28, 2004 12:34 pm

Turn off System Restore. <<<

How can I turn off the system restore?
Daninku
Senior Geek
Senior Geek
 
Posts: 258
Joined: Tue Aug 17, 2004 1:00 am
Location: MALTA, Dingli

Thanks given:0
Thanks received:0
Top

Postby Geekgirl » Tue Sep 28, 2004 1:14 pm

Hey Daninku

Read
Geekgirl
Geek Alumni
 
Posts: 1214
Joined: Mon Apr 12, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby Daninku » Tue Sep 28, 2004 1:43 pm

Ok done:

C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\My Software\SpywareGuard\sgmain.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\SpywareGuard\sgbhp.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt/"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\My Software\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\My Software\SpywareGuard\sgmain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

I can notice the difference, my PC ir running faster without those crap. I hope they will not come out again :mrgreen:
Daninku
Senior Geek
Senior Geek
 
Posts: 258
Joined: Tue Aug 17, 2004 1:00 am
Location: MALTA, Dingli

Thanks given:0
Thanks received:0
Top

Postby Geekgirl » Tue Sep 28, 2004 2:06 pm

Hi Daninku

It seems you haven't posted your entire logfile. Please re-post
Geekgirl
Geek Alumni
 
Posts: 1214
Joined: Mon Apr 12, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby Daninku » Tue Sep 28, 2004 2:10 pm

OOPS :oops: sry :mrgreen:

Logfile of HijackThis v1.98.2
Scan saved at 3:08:53 PM, on 9/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\My Software\SpywareGuard\sgmain.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\SpywareGuard\sgbhp.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt/"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\My Software\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\My Software\SpywareGuard\sgmain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
Daninku
Senior Geek
Senior Geek
 
Posts: 258
Joined: Tue Aug 17, 2004 1:00 am
Location: MALTA, Dingli

Thanks given:0
Thanks received:0
Top
Post a reply

Return to Windows 7, 2008 and Vista

Who is online

Users browsing this forum: No registered users and 1 guest

cron