xp - cleaned with spybot & ad-aware- I SEE some.. need h

[CanadianTek]

hello again..
Hey folks,

I have done all the cleaining from all the temp folders, all the temp internet folder for ALL users in documents and settings, i've shut off all unnecessary msconfigs, i've emptied the trash basket and run spybot, ad-aware, avg and bazooka, (all but ms media player guid cleared up)

system had EliteBar, dyfuca and SexList spies, also had LowZonesA, and Power Scan and Trojan IRC Backdoor all cleaned according to the above programs, however when i ran HJT.. i can see a couple of the more obvious stragglers..

like

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll

and

O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe (which is not ATI related)

and

O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [blah service] internet.exe



a few others im curious about.. like this AVPG, and Win32usb.exe

could not find anything good or bad in google search for this one "wvyvyedhivh.exe"

soo... let me know if my suspicions were right.. and which ones i missed, or should take out.. thank you.. muchly

Logfile of HijackThis v1.98.2
Scan saved at 9:25:02 AM, on 20/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\TEKS2G~1\AVGANT~1\avgserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\win32usb.exe
C:\WINDOWS\System32\AvpG.exe
C:\WINDOWS\System32\issEnc32.exe
C:\WINDOWS\System32\lssrv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\wuauclt.exe
C:\TEKS2G~1\AVGANT~1\AVGCC32.EXE
C:\Teks2Go Utilities\HijackThisv1-98-2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Teks2Go Utilities\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [issEnc32Svr] issEnc32.exe
O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe
O4 - HKLM\..\Run: [USB Device] win32usb.exe
O4 - HKLM\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\Run: [AVG_CC] C:\TEKS2G~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\RunServices: [Windows Network Service] winvc32.exe
O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe
O4 - HKLM\..\RunServices: [USB Device] win32usb.exe
O4 - HKLM\..\RunServices: [Start Upping] qtask.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] syscfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [blah service] internet.exe
O4 - HKLM\..\RunServices: [System Sp2 Patch] wvyvyedhivh.exe
O4 - HKLM\..\RunServices: [issEnc32Svr] issEnc32.exe
O4 - HKLM\..\RunServices: [MSN Start] msnmsgr7.exe
O4 - HKLM\..\RunServices: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe
O4 - HKLM\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

[Cactus]

Hey CanadianTek ...
I need you to goto and run an Online Scan...

After running the scan...run HJT again and post back with a fresh logfile.


Cactus

[CanadianTek]

but if i put this system back on line.. do i not risk re-infecting again?

undoing all that the ad-aware/spybot and avg have cleaned up?

i will if you insist..

would it be prudent to install zone alarm first? and block all but trend?

[Cactus]

I don't see any probs in you going online and going to TrendMicro...run the scan,disconnect from the Internet then run HJT and post the logfile.
You'll be ok.

Cactus

[CanadianTek]

I did install Zone Alarm...

and the first 4 things.. front and center demanding net access were...

lssrv.exe
issenc32.exe
avpg.exe

and

win32usb.exe

not sure if any of them really neeeeded to get there.. but i said ALWAYS deny
(will change that later should we determine they are needed)

THEN RAN TrendMicro's House Call as per your request..

it found 2 files.. lssrv.exe - RBOT.LT trojan
and
.........................winvc32.exe under the RBOT.RY trojan

i said delete.. it said.. yes to winvc32 and "cant" to lssrv - as it was already in use

so

i ctrl+shift+esc .. went to processes.. terminated the lssrv.exe process
went back into housecalls, told it to delete again..

it did (good call cactus ;) - surprised. .. avg didnt catch it.. sorry for my hesitation)

here is the scan you requested..

Logfile of HijackThis v1.98.2
Scan saved at 3:50:25 PM, on 20/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\TEKS2G~1\AVGANT~1\avgserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\win32usb.exe
C:\WINDOWS\System32\AvpG.exe
C:\WINDOWS\System32\issEnc32.exe
C:\TEKS2G~1\AVGANT~1\avgcc32.exe
C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\wuauclt.exe
C:\Teks2Go Utilities\HijackThisv1-98-2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Teks2Go Utilities\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [issEnc32Svr] issEnc32.exe
O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe
O4 - HKLM\..\Run: [USB Device] win32usb.exe
O4 - HKLM\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\Run: [AVG_CC] C:\TEKS2G~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Windows Network Service] winvc32.exe
O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe
O4 - HKLM\..\RunServices: [USB Device] win32usb.exe
O4 - HKLM\..\RunServices: [Start Upping] qtask.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] syscfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [blah service] internet.exe
O4 - HKLM\..\RunServices: [System Sp2 Patch] wvyvyedhivh.exe
O4 - HKLM\..\RunServices: [issEnc32Svr] issEnc32.exe
O4 - HKLM\..\RunServices: [MSN Start] msnmsgr7.exe
O4 - HKLM\..\RunServices: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe
O4 - HKLM\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab

[brad]

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

lssrv.exe
win32usb.exe
AvpG.exe
atiphexx.exe
internet.exe
wvyvyedhivh.exe
issEnc32.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe
O4 - HKLM\..\Run: [USB Device] win32usb.exe
O4 - HKLM\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\RunServices: [Windows Network Service] winvc32.exe
O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe
O4 - HKLM\..\RunServices: [USB Device] win32usb.exe
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [blah service] internet.exe
O4 - HKLM\..\RunServices: [System Sp2 Patch] wvyvyedhivh.exe
O4 - HKLM\..\RunServices: [issEnc32Svr] issEnc32.exe
O4 - HKLM\..\RunServices: [Win32 Usb Driver] AvpG.exe
O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe
O4 - HKLM\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\Run: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [Win32 Usb Driver] AvpG.exe
O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe

Now search for and delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

lssrv.exe
win32usb.exe
AvpG.exe
atiphexx.exe
internet.exe
wvyvyedhivh.exe
issEnc32.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad

[Cactus]

Have HJT fix this keys as well...

O4 - HKLM\..\RunServices: [Start Upping] qtask.exe

O4 - HKLM\..\RunServices: [MSN Start] msnmsgr7.exe


Then do a search and find the offending exe and delete it.

msnmsgr7.exe

Cactus

[CanadianTek]

Ok removed the lines both Brad and Cactus had suggested...

also found

syscfg32.exe in c:\windows\system32 that both may have missed in the original, and according to google search, it is part of the w32ForBot-R ??

so i thougth i would pass that along so you folks could catch it elsewhere if other people make submissions..

it was found in hklm..... run Services as [win32usb2Driver] ... slightly different then the win32usb that i was having problems with (but now all gone)

let me know if you see anything else here.. looks pretty clean..

Logfile of HijackThis v1.98.2
Scan saved at 1:44:24 PM, on 22/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\TEKS2G~1\AVGANT~1\avgserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\TEKS2G~1\AVGANT~1\avgcc32.exe
C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\wuauclt.exe
C:\Teks2Go Utilities\HijackThisv1-98-2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Teks2Go Utilities\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [AVG_CC] C:\TEKS2G~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab


and thnx again for your help, patience, expertise, etc..

[Cactus]

Looks clean coz it is ...

Cactus