Malware Removal Forums

re ask, seek, knock

8 min read

arworthington

September 20, 2005, 10:08 PM UTC

Winfixer, winantispyware, vipfares and morwillsearch - what a mess I'm in! Tried spybot, ad-aware and MS antispyware; but now need a more effective solution to these pests. Thanks.

Hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 23:05:50, on 20/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
C:\Program Files\Capture Express\capexp.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\All Users\Documents\Downloaded files\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = supanet Internet Explorer
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {139FAF5F-7400-4DA9-8193-878A0BA82EED} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {13A38792-3CB4-406F-888A-636D33100DD5} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {18F073F2-4E64-4A54-9A3C-D4E97D545596} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {365C62AE-2803-4429-A5D0-BA99A8A54B57} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {4B54C1A8-11DB-4181-BFC3-E4C5B6E81CD7} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {5414AB0D-5330-4E6B-83D5-977D6EEF10C9} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {7D188E4E-C1C7-44A3-9BF8-7AA727B4D880} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {806B3C0A-A803-4322-807F-C4753BC4B9D1} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {811FBBAB-D02F-4955-946B-53C5312A0982} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {A53F9753-CEFB-4EB3-BE0A-F25462AE09D8} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {B6851CE7-326F-428F-9862-6C931C19EA9B} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {BB70E9B9-8BAE-4982-A44E-A9ABA29744B2} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {C3043CEC-B93A-4D22-BBE8-E3FA1C2DF5B1} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {CB0D4E9A-23CF-4DC5-8C82-C93E95FF3A2F} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {CFF1CAAD-CFF0-44CF-8B97-BFEA77934426} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {D4BC90BE-E69F-4C49-B712-6FB9F2D4673F} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {E4E7AFBD-0439-4EF8-A2F6-F9E0DC70356C} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: MSEvents Object - {F1F0CABC-8644-4D74-99BF-ABF6DD646859} - C:\WINDOWS\system\COLOR\unjava.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {F78C8770-B052-434C-AE4E-C7B1C6EB22B2} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {FB14B437-35CD-4624-974E-BF1CBC2D463C} - C:\WINDOWS\system32\siqwadeq.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: Capture Express.lnk = C:\Program Files\Capture Express\capexp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.supanet.com/
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126973647335
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
O20 - Winlogon Notify: avw2 - c:\windows\system32\avw2.dll
O20 - Winlogon Notify: unjava - C:\WINDOWS\system\COLOR\unjava.dll
O23 - Service: CWShredder Service - Unknown owner - C:\unzipped\CWShredder\CWShredder.exe (file missing)
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

NikkJ MRU Honors Grad Emeritus

September 21, 2005, 10:44 AM UTC

Hi arworthington

There are some items in your HJT log that need attention

Note: don't run them yet! There is an order we need to follow

Download CCleaner and install, but do not run it yet.
Please download, install and update Ewido trojan scanner:
- When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
- When you run Ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
- From the main Ewido screen, click on update in the left menu, then click the Start update button.
- After the update finishes (the status bar at the bottom will display "Update successful") close Ewido. You will run it later during the cleanup process.

Please set your system to show all files
Click Start.
Open My Computer
SelectTools menu
Click Folder Options.
Select the View Tab.
Select Show hidden files and foldersin the Hidden files and folders section.
Uncheck Hide protected operating system files (recommended) option.
Uncheck the Hide file extensions for known file types option.
Click Yes.
Click OK.

Run HiJackThis and do a Scan Only. Put a check in box on each of these lines:

F3 - REG:win.ini: run=
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {139FAF5F-7400-4DA9-8193-878A0BA82EED} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {13A38792-3CB4-406F-888A-636D33100DD5} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {18F073F2-4E64-4A54-9A3C-D4E97D545596} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {365C62AE-2803-4429-A5D0-BA99A8A54B57} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {4B54C1A8-11DB-4181-BFC3-E4C5B6E81CD7} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {5414AB0D-5330-4E6B-83D5-977D6EEF10C9} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {7D188E4E-C1C7-44A3-9BF8-7AA727B4D880} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {806B3C0A-A803-4322-807F-C4753BC4B9D1} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {811FBBAB-D02F-4955-946B-53C5312A0982} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {A53F9753-CEFB-4EB3-BE0A-F25462AE09D8} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {B6851CE7-326F-428F-9862-6C931C19EA9B} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {BB70E9B9-8BAE-4982-A44E-A9ABA29744B2} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {C3043CEC-B93A-4D22-BBE8-E3FA1C2DF5B1} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {CB0D4E9A-23CF-4DC5-8C82-C93E95FF3A2F} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {CFF1CAAD-CFF0-44CF-8B97-BFEA77934426} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {D4BC90BE-E69F-4C49-B712-6FB9F2D4673F} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {E4E7AFBD-0439-4EF8-A2F6-F9E0DC70356C} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: MSEvents Object - {F1F0CABC-8644-4D74-99BF-ABF6DD646859} - C:\WINDOWS\system\COLOR\unjava.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {F78C8770-B052-434C-AE4E-C7B1C6EB22B2} - C:\WINDOWS\system32\siqwadeq.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {FB14B437-35CD-4624-974E-BF1CBC2D463C} - C:\WINDOWS\system32\siqwadeq.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.supanet.com/
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com

Close all other open windows and Click on Fix Checked and then exit HijackThis.
Reboot into Safe Mode
- To start Windows XP in Safe mode
- Restart the computer.
- Some computers have a progress bar that refers to the word BIOS. Others may not let you know what is happening.
- As soon as the BIOS loads, begin tapping the F8 key on your keyboard. Do so until the Windows Advanced Options menu appears.
- If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. If this happens, restart the computer and try again.
- Using the arrow keys on the keyboard, select Safe mode and hit enter.
Using Windows Explorer, locate the following files/folders, and delete them:

C:\WINDOWS\system32\siqwadeq.dll
C:\WINDOWS\system32\qedawqis.dll
C:\WINDOWS\system\COLOR\unjava.dll

Exit Explorer
Please run Ewido, and run a full scan. Save the logfile from the scan
Post the results back here

Now, run CCleaner.

Uncheck "Cookies" under "Internet Explorer".
Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Post back a fresh HijackThis log and the ewido log so that we can take look at them.

Nick

arworthington

September 26, 2005, 10:11 PM UTC

Thanks for your help.

Completed tasks you identified and posted logs below. Files
C:\WINDOWS\system32\qedawqis.dll
C:\WINDOWS\system\COLOR\unjava.dll
did not exist.

'Winantispyware' web page appeared when logging onto this site.

Roger

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 20:19:38, 26/09/2005
+ Report-Checksum: 34942B1C

+ Scan result:

C:\_RESTORE\ARCHIVE\FS2633.CAB/A0317053.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS2634.CAB/W0460529.CPY -> TrojanDownloader.FunWeb.a : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS2890.CAB/A0340761.CPY -> Spyware.WildTangent : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3078.CAB/W0524929.CPY -> TrojanDownloader.FunWeb.a : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3077.CAB/A0391239.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3077.CAB/A0391244.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3077.CAB/A0391245.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3077.CAB/A0391249.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3786.CAB/A0466951.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3786.CAB/A0466959.CPY -> Spyware.MyWebSearch : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3913.CAB/A0476520.CPY -> Spyware.180Solutions : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3913.CAB/A0476526.CPY -> Spyware.180Solutions : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3913.CAB/A0476529.CPY -> Spyware.180Solutions : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3913.CAB/A0476530.CPY -> Spyware.180Solutions : Cleaned with backup
C:\_RESTORE\ARCHIVE\FS3913.CAB/A0476534.CPY -> Spyware.180Solutions : Cleaned with backup
C:\FOUND.004\FILE0090.CHK -> Spyware.Wesbar : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\[redacted][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\[redacted][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\[redacted][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP97\A0020006.dll -> TrojanDownloader.ConHook.c : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP99\A0021536.exe -> Spyware.Trymedia : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP99\A0021538.exe -> Spyware.Trymedia : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP99\A0021539.exe -> Spyware.Trymedia : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP99\A0021540.exe -> Spyware.Trymedia : Cleaned with backup
C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP99\A0021541.exe -> Spyware.Trymedia : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 20:24:14, on 26/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
C:\Program Files\Capture Express\capexp.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\All Users\Documents\Downloaded files\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = supanet Internet Explorer
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {3C8BFD71-E671-4832-96E9-E2FC4DEF1B40} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {67390338-B147-43BC-B529-8BE551015FC3} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {6DD8E0F1-7C5F-4E00-8160-878C0FE0808A} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {6E084711-A63B-405B-A271-0F4D5CE3F438} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {A9DA22D4-9359-43AC-BB61-7CCC162B8BE5} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {B868E8A3-9A95-4B86-B0CF-BE785017C206} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {B905C195-CD1A-4AE9-9842-52270EF0703C} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {B9E7B923-702E-4F63-AE41-DEAC1FA543DC} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {BFF136AB-3278-438E-AC62-112981216887} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {C008C2A8-A869-4851-9C1F-36F251DB25A9} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {C965DB4B-3722-491D-8C5F-1E9AA456C338} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {DC12ECC3-B8EE-4359-96F5-A49C6C770E20} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {ECBF8C17-09CA-46AC-912E-2B567D5C9D2D} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {EEA366CB-497D-41DF-8567-D2E8BC4F0AD9} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O2 - BHO: MSEvents Object - {F1F0CABC-8644-4D74-99BF-ABF6DD646859} - C:\WINDOWS\system\COLOR\unjava.dll
O2 - BHO: C:\WINDOWS\system32\siqwadeq.dll - {F258DEFC-07A5-4149-AC97-C2493682DDC4} - C:\WINDOWS\system32\siqwadeq.dll (file missing)
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: Capture Express.lnk = C:\Program Files\Capture Express\capexp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126973647335
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
O20 - Winlogon Notify: avw2 - c:\windows\system32\avw2.dll
O20 - Winlogon Notify: unjava - C:\WINDOWS\system\COLOR\unjava.dll
O23 - Service: CWShredder Service - Unknown owner - C:\unzipped\CWShredder\CWShredder.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

NikkJ MRU Honors Grad Emeritus

September 27, 2005, 11:09 AM UTC

So far so good. :thumbright:

We need to disable Microsoft AntiSpyware Real-time Protection during this process

Open Microsoft AntiSpyware.
Click Tools
Click Settings.
Click Real-time Protection.
Uncheck Enable the Microsoft AntiSpyware Security Agents on startup recommended).
Uncheck Enable real-time spyware threat protection (recommended).
Click Save
Close Microsoft AntiSpyware.
Right click the Microsoft AntiSpyware icon on the taskbar
Shutdown Microsoft AntiSpyware.

Don't forget to re-start Microsoft AntiSpyware when your machine is clean and undo the changes above.

Please print these instructions out for use in Safe Mode.
Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to extract the files
This will create a VundoFix folder on your desktop.
After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
You will first be presented with a warning and a list of forums to seek help at.
it should look like this

[color=blue]VundoFix V2.1 by Atri
By using VundoFix you agree that you are doing so at your own risk
This list of forums is provided as an example of where to go to obtain help!!
http://www.atribune.org/forums
http://www.247fixes.com/forums
http://www.geekstogo.com/forum
http://forums.net-integration.net
http://castlecops.com/forums.html
http://www.besttechie.net/forums
Press enter to continue....
At this point press enter one time.
Next you will see:

Type in the filepath as instructed by the forum staff
Then Press Enter, Then F6, Then Enter Again to continue with the fix.
At this point please type the following file path (make sure to enter it exactly as below!):
Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
Next you will see:

Please type in the second filepath as instructed by the forum staff
Then Press Enter, Then F6, Then Enter Again to continue with the fix.
At this point please type the following file path (make sure to enter it exactly as below!):
Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
The fix will run then HijackThis will open.
In HiJackThis, please place a check next to the following items and click FIX CHECKED:
After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
Once your machine reboots please continue with the instructions below.
Use Explore to find and delete:
c:\windows\system32\avw2.dll

Download and install CleanUp!
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files
Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Then, please run this online virus scan: ActiveScan

Don't forget to re-start Microsoft AntiSpyware .

arworthington

September 27, 2005, 9:48 PM UTC

Nick,

Completed second task list. Panda online scan reported nothing.
Anything else?

Roger

NikkJ MRU Honors Grad Emeritus

September 28, 2005, 6:36 AM UTC

Glad to hear that everything went OK.
Are still having any problems with the popups/rogue screens ?

Please post a new HiJackThis log for me to check and also the vundofix.txt file from the vundofix folder, I forgot to ask for them :oops:

Nick

arworthington

September 28, 2005, 10:17 PM UTC

Nick,

Seems to have stopped pop ups. Log files from Hijack this and .txt file from Vindufix (hope I got this bit right). I've also included a pccillin report and Ewido report in case these are of help.

Thanks again,

Roger

Real-time Scan Trend Micro PC-cillin Internet Security has detected a virus, spyware application, or other Internet threat, and performed the action specified.

Infected file: C:\System Volume Information\_restore{5BD03CB0-CD91-42AE-8A56-088E78F544B4}\RP105\A0022265.exe
Virus name: ADW_LOP.AE
User name: [redacted]
Scan action result: Denied Access.
Note: If Search for and clean Trojans is enabled and is executed after scanning, you can click Next to view final scan result information.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 23:09:03, 28/09/2005
+ Report-Checksum: B9916E7E

+ Scan result:

C:\Documents and Settings\Roger\Cookies\roger@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Roger\Cookies\roger@thomascook.122.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 22:09:13, on 28/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\All Users\Documents\Downloaded files\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = supanet Internet Explorer
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: MSEvents Object - {F1F0CABC-8644-4D74-99BF-ABF6DD646859} - C:\WINDOWS\system\COLOR\unjava.dll (file missing)
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126973647335
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
O23 - Service: CWShredder Service - Unknown owner - C:\unzipped\CWShredder\CWShredder.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

VundoFix V2.1
By Atri

http://www.atribune.org

This fix is for 2K and Xp machines only.

For 9x/ME machine please use dos to remove vundo

New version Release date September 1, 2005

2.12 added messaging for the missing process.exe
2.13 removed forum list

NikkJ MRU Honors Grad Emeritus

September 29, 2005, 7:04 AM UTC

Hi It looks like we're almost there!!

Run HijackThis and run a scan only. Place a check against each of the following lines:

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: MSEvents Object - {F1F0CABC-8644-4D74-99BF-ABF6DD646859} - C:\WINDOWS\system\COLOR\unjava.dll (file missing)

Close all other open windows and click on Fix Checked when finished and exit HijackThis.

Uninstall Ewido and CWShredder using Windows "Add or Remove Programs"
Now, run CCleaner.
- Uncheck "Cookies" under "Internet Explorer".
- Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Reboot and Post back a fresh HijackThis log and we will take another look.

Nick

arworthington

September 29, 2005, 8:42 PM UTC

Thanks again.

Logfile of HijackThis v1.99.1
Scan saved at 21:28:35, on 29/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\All Users\Documents\Downloaded files\Hijack this\HijackThis.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = supanet Internet Explorer
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program Files\NETGEAR GA311 Adapter\GA311.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126973647335
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

NikkJ MRU Honors Grad Emeritus

September 29, 2005, 9:16 PM UTC

Hi there arworthington :hello2:

Your log looks clean now .

Here is my standard information in this situation. Please read it and use the parts that apply to you (although I think you have it all covered

) :-

Windows Updates. You can get more information direct from Microsoft about critical updates including SP2.
Use a Firewall. This will allow you restrict connections to and from your computer
- Zone Alarm
- Sygate firewall
Use an AntiVirus Software, and be sure you update it at least once a week.
You must only use one of these since two or more will conflict with each other.
- Avast
- AVG free
Use of Anti-spyware programs. It's highly reccomended to use programs that protect you from spyware infection. Here are some free programs I recommend, you can use all of them together for full protection:
- Spybot
- Microsoft Anti-spyware (beta)
- Adaware SE personal

You can read more this useful article: How I got Infected in the First Place.

Good luck

Nick

NonSuch Administrator

October 13, 2005, 11:32 AM UTC

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.