PCTech Forums

by **msiler** » Mon May 31, 2004 3:18 am

I am running Windows 2000pro and I use Opera instead of IE6.

I religiously run Spyware S&D, Adaware, CW Shredder and HijackThis. After using them all looks good on my little 'puter...for a while and then two things start to happen:

1) When I re-boot (only a few times each week) some of the spy/malware programs seem to re-install themselves.

Is this actually happening, and if so, is there a way of getting around these insidious programs that are "self installing" after they are deleted and I reboot?

2) I use Opera as my web browser instead of IE6. Every once in awhile I come back to my computer, sit down and there are 3 or 4 open IE windows that have popped up and are either blank or have ads on them...is there a way to prevent this from happening? I have a feeling my 2 questions are related and are putting me in a kind of "catch 22" situation

Your help appreciated.

-Matt S-

by **brad** » Mon May 31, 2004 4:46 am

Please post your HiJackThis Log File.
brad

by **msiler** » Mon May 31, 2004 12:29 pm

Logfile of HijackThis v1.97.7
Scan saved at 7:26:42 AM, on 5/31/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\Program Files\Executive Software\DiskeeperLite\DKService.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\gearsec.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\PROGRA~1\NORTON~1\NORTON~3\navapsvc.exe
D:\PROGRA~1\NORTON~1\NORTON~3\npssvc.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\Program Files\Norton SystemWorks\Norton Speed Disk\nopdb.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\TSIRCSRV.EXE
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINNT\system32\inetsrv\inetinfo.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\Explorer.EXE
D:\PROGRA~1\NORTON~1\NORTON~3\alertsvc.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
D:\Program Files\Sony Handheld\HOTSYNC.EXE
D:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
D:\WINNT\system32\hpoipm07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\Program Files\iambic Software\Agendus for Windows Professional Edition\AgendusPro.exe
D:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
D:\Program Files\Opera75\opera.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Executive Software\DiskeeperLite\ShowHtml.exe
D:\Download\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [REGSHAVE] D:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - Startup: HotSync Manager.lnk = D:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Help (HKCU)
O9 - Extra button: Support (HKCU)
O9 - Extra button: ComcastHSI (HKCU)
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... t/opuc.cab
O16 - DPF: {41F31718-2B9D-4F76-85E2-DD11BBA99F8D} - http://install.spywarelabs.com/DistID/2 ... 031120.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mci ... insctl.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 3861805556
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab

Thanks Brad (and others) for all the help you provide to this community!
-Matt S-

by **brad** » Mon May 31, 2004 1:08 pm

Your Log looks clean.
Do you know you're running TSIRCSRV.EXE? It is:
There's a chance that it is causing problems.

When you get "re-infected" are you turning "System Restore" off before fixing the problems?
Do you have Windows Messenger disabled?

brad

by **msiler** » Mon May 31, 2004 1:16 pm

Hi Brad,
Yes - I use laplink occasionally to synch my laptop

How do I disable "Windows Messenger"

I am using windows 2000 and was under the impression there is not a way to turn off system restore (I don't think it exists in windows 2000pro)?

Thanks again.

by **Ranger Bob** » Mon May 31, 2004 2:08 pm

Brad, Windows 2000 does not have System Restore like XP and ME.

I wonder if the messager service needs to be turned off? You can use a program called Shoot the Messager to do this if you like.

http://grc.com/stm/ShootTheMessenger.htm

msiler I did not see you mention that you are using SpywareBlaster so you might want to add this as well as SpywareGuard.

by **brad** » Mon May 31, 2004 2:32 pm

Thanks, RB, you're right.
brad

by **msiler** » Mon May 31, 2004 4:02 pm

Thanks RB and Brad -
1) Windows messaging is now off
2) Spywareblaster is now installed (great stuff, thanks)
3) Deleted all cookies, cache, history, temp files etc. (Norton Incinerator) 4) Ran Spyware S&D, Adaware, CW Shredder and HijackThis and now Spyblaster.

...and they are back again after a re-boot. Is there a way of permanently deleting these insidious programs that are "self installing"?

They are driving me nuts and i am spending way to much time getting rid of them.

Your help appreciated,
-Matt S-

NOTE:
* I am running Windows 2000pro so there is no
System Restore to turn off before re-booting.

* I use Opera 7.50 as my browser instead of IE6

by **msiler** » Thu Jul 01, 2004 6:12 pm

Still having the same problems - anyone have any more ideas on how to stop these insidious pop-ups that open by themselves in MSIE.

I can only wonder as to what other things lurk in my computer unbeknownst to me and what they are watching...and this is all AFTER I religiously run Spyware S&D, Adaware, CW Shredder and HijackThis?!?!?!?

Thanks in advance,
-Matt-

by **brad** » Thu Jul 01, 2004 9:48 pm

by **msiler** » Tue Jul 06, 2004 2:12 am

Logfile of HijackThis v1.97.7
Scan saved at 8:46:02 PM, on 7/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\cisvc.exe
D:\Program Files\Executive Software\DiskeeperLite\DKService.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\gearsec.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\PROGRA~1\NORTON~1\NORTON~3\navapsvc.exe
D:\PROGRA~1\NORTON~1\NORTON~3\npssvc.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\Program Files\Norton SystemWorks\Norton Speed Disk\nopdb.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\TSIRCSRV.EXE
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINNT\system32\inetsrv\inetinfo.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\Explorer.EXE
D:\PROGRA~1\NORTON~1\NORTON~3\alertsvc.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\Program Files\MSGTAG\MSGTAG.exe
D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
D:\Program Files\Sony Handheld\HOTSYNC.EXE
D:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
D:\WINNT\system32\hpoipm07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\WINNT\system32\wuauclt.exe
D:\WINNT\System32\svchost.exe
D:\PROGRA~1\MICROS~2\Office\backappl.exe
D:\Download\Spy and Malware\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.ask.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [REGSHAVE] D:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSGTAG] "D:\Program Files\MSGTAG\MSGTAG.exe" /startup
O4 - Startup: HotSync Manager.lnk = D:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: MailWasherPro.lnk = D:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: AboutTime.lnk = D:\Program Files\AboutTime\AboutTime.exe
O4 - User Startup: HotSync Manager.lnk = D:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - User Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: MailWasherPro.lnk = D:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - User Startup: AboutTime.lnk = D:\Program Files\AboutTime\AboutTime.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Help (HKCU)
O9 - Extra button: Support (HKCU)
O9 - Extra button: ComcastHSI (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9VCM.CAB
O16 - DPF: {41F31718-2B9D-4F76-85E2-DD11BBA99F8D} - http://install.spywarelabs.com/DistID/2 ... 031120.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mci ... insctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab

Here are my three recurring problems: (A,B & C)

(A)
These three files show up in HJT but no where else:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

HJT fixes them but they always seem to show up again within a day or so and ALWAYS after I re-boot. If I cannot remove them permanently then is at least possible to change their HOSTS Addresses so they at least do not bring up a website or run anything malicious on my ‘puter?

How do I change a Hosts address?

(B)
These files show up in Adaware but no where else and never get full y cleaned out.
1) VX2 File Data Miner d:\winnt\system32\apaamon.dll
2) VX2 File Data Miner d:\winnt\system32\azsetupc.dll
3) VX2 File Data Miner d:\winnt\system32\axaamon.dll
4) VX2 File Data Miner d:\winnt\system32\dtmv2clt.dll
5) Virtual Bouncer
6) Also, a bunch of different .dll files of various names come and go…I know they are creating problems but can never seem to totally remove them. They refuse to be removed and always come back upon re-boot even after removing them in Safe Mode.

How do I delete .dll files that Spybot S&D or Adaware find?

(C)
These files show up in Spybot S&D but no where else and never get fully cleaned out.
1) IGETNET

PCTech Forums

Getting rid of pesky malware?

Getting rid of pesky malware?

Who is online