Preserved Topic: New Computer Problems (Virus/Spyware/Something malicious) (Page 1 of 1)

So, our familys computer has gotten bogged down with something malicious once again (after you guys so nicely helped me fix it last time). I was doing the usual Ad-Aware-ing and SpyBot-ing to try to see what happened and the internet just died. I have no idea if it was just a coincidence that I happened to be deleting the files that those two programs turned up around the time the internet died or not. Anyway, I suppose I could post my HiJackThis log if you guys want to go that route again. Seeing as it seemed to work well, last time.

Also I was considering a clean install. Since this is a computer that's only a few months old, it wouldn't take long to back up the data on it and do a clean install. I've never done this before though, and I wonder if you guys think it would be a good thing to do. My main theory on doing this is that I could install a proper firewall, virus scan, and ad-aware before the problems started showing up, and perhaps then it would be more effective.

Any thoughts on the matter? Thanks so much for helping a poor guy like me. :-)


-Chesta

[Edit: just did my sig twice without thinking. I just had my wisdom teeth out, so don't know if I'm completely undrugged yet :-) ]

(Edited by Chesta on 07-22-2004 16:17)

I recently got hit with a backdoor. Careful as some of them attempt to steal very intimate information you log (passwords, CCs), creates a .dat file in %WINDDIR%/system32/ and send this unencrypted file to a designated URL...

Once when fixing my computer I had a similar problem after quarantining all of the files that Ad-Aware found. I could no longer get online using IE. However, I could still use AIM. Because I could still get on AIM, i figured that something was fishy. I installed a copy of the latest version of Mozilla that i burned onto a cd on a different computer. Mozilla now works fine. IE still doesn't work. Not sure which file removal caused the problem, but as far as I'm concerned I'm better off using Mozilla anyway. Not sure if its the same problem you're having, but worth a try. Hope that helps.

FWIW, Every time I run spybot It effects my firewall setting in Norton for IE specifically. The rule description never changes for it but If I go change it from automatic to something else then put it back to auto all works until the next time I run spybot. I have yet to actually dig in and figure out why this happens but if you run Norton FW its worth a shot

Well one thing I know is that lop.com is a piece of adware, which if removed wrong, can ruin your internet access, and there is a fix for this. But I have also heard of things happening like what Sharma said, where only IE doesn't work, so it would help to know what browser you were using. Also if you don't have a firewall that can create very large problems, because one piece of adware can turn into 20 if it can get access to the internet. I had a trojan once, and every 30 seconds some program was trying to access the internet, about 15 different ones all together I've never heard of, and I'm sure if I didn't have a firewall they would have just installed more crapware. So first try doing on online virus scan, theres a few free ones that are good, http://housecall.trendmicro.com/ and http://www.pandasoftware.com/activescan/com/activescan_principal.htm and lastly http://www.bitdefender.com/scan/licence.php . Once you have tried these, if you still have no success, try running a trojan remover, I've used a2 and it did the trick, you can get that http://www.download.com/a-squared-a-Personal/3000-2239-10299342.html at that website. If after all this your still having problems, it would probably be easier to go ahead and reinstall a fresh copy. But once you reinstall, make SURE you get the necessary stuff to protect your computer, a anti-virus that updates their database often, AVAST is the best free one I've ever seen, also AVG is good. A good firewall, ZoneLabs makes the best free one I know of, and also make sure you use a different browser than IE, always get the latest windows updates if you use windows, and scan for spyware and adware regularly. And make sure all of your security programs have the latest definitions, including spybot and adaware. Sorry this was so long, good luck with everything and I hope this helped

Yeah, unfortunately I use Firebird anyway, but the rest of my family uses IE. In any case, neither seem to work.

I wouldn't mind doing those online virus scans, except I can't figure out how to get the computer to connect to the internet....

*Shrug*

-Chesta

WARNING

Yeah Chesta, my advice is kind of useless if you can't get the the internet at ALL Best bet would be finding another computer, a friends computer or something, downloading a2 and AVAST installation files, burning them to a CD and tranfering them to your computer.

http://www.spywareinfo.com/~merijn/downloads.html

download the file called hijackthis
1) Hit the scan button
2) Don't Hit Fixed Checked - i.e. Don't fix anything (not yet anyway)
3) Hit Save Log
4) Open the log file with notepad
5) Cut and paste the log here

6) Hit Config (other stuff)
7) Misc Tools Tab
8) Generate Log file for startup items
9) Cut and paste the log here

if your AV is uptodate, you have run adaware and spybot S&D, then this is the final check.
Hijack this will look for browser and other hijacks.
the startup list will tell you what kind of garbage is running on startup (sort of like msconfig)

edit: sorry, didn't notice you had hijack this already. so just post the log.
p.s. don't take your hardware for granted. could be a cabling, modem, phone line, whatever type of problem.
i recently bought a video capture card (analog and digital) brand spanking new and it didn't work. one of the two connectors was defective. i screwed around for 2 hours before realizing 1 worked and the other didn't.

One final thought, open MSconfig (assuming you are not using win 2000) and go to services tab. check the hide microsoft services box and see what's left.

(Edited by Shooting_Star on 07-24-2004 22:14)

All right, appreciate the help. Here's the update.

I'm pretty sure the modem itself is working as we've had the cable people here lately and they said it was a computer issue. Also, I'm using the old computer on the same modem that used to work on the new computer. Just plugged it in and it's fine.

I noticed an article in PC Magazine that seems to detail my problem exactly. I'll go ahead and look at the suggestions, although after skimming the article it looked like it wasn't too far from what I'd already tried. Kinda cool to have a timely article like that.

Here's what HiJackThis returned.

quote:

---

StartupList report, 6/26/2004, 1:06:49 PM
StartupList version: 1.52
Started from : C:\Documents and Settings\Dana\Desktop\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Documents and Settings\Dana\Desktop\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Digital Line Detect.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
DVDSentry = C:\WINDOWS\System32\DSentry.exe
PCMService = "C:\Program Files\Dell\Media Experience\PCMService.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Sonic RecordNow! =
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\WINDOWS\system32\dla\tfswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Update Check (CHESTER-Carolyn).job
McAfee.com Update Check (CHESTER-Cathy).job
McAfee.com Update Check (CHESTER-Dana).job
McAfee.com Update Check (CHESTER-Family).job
McAfee.com Update Check (CHESTER-Mark).job
McAfee.com Update Check (DB2C1R41-Owner).job

--------------------------------------------------

Enumerating Download Program Files:

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\FLASH.OCX
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 5,501 bytes
Report generated in 0.031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

---

quote:

---

Logfile of HijackThis v1.97.7
Scan saved at 1:04:54 PM, on 6/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Documents and Settings\Dana\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

---

Thanks for looking at that. I really appreciate you guys willing to look over those things.

-Chesta

Don't recognize all the items but I have to admit you have tons of stuff loading and hogging ram and possibly causing conflicts. In comparison, i have 2 items on loadup only - norton and zonealarm - even though I have a full gig of system ram.

The poster has demanded we remove all his contributions, less he takes legal action.
We have done so.
Now Tyberius Prime expects him to start complaining that we removed his 'free speech' since this message will replace all of his posts, past and future.
Don't follow his example - seek real life help first.

I did not recognize these but they all turned out to be legit

Running processes:
C:\WINDOWS\System32\hkcmd.exe : Intel hotkey commonds (do you need this shit?)
C:\WINDOWS\system32\dla\tfswctrl.exe : related to your CD burner (do you need this shit?)
C:\WINDOWS\System32\DSentry.exe : Dell software - I removed this from my Dell

I am making an assumption that stuff like this:
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
is really related to your antivirus and not a trojan installation

will keep digging

p.s. if you want feedback as to what crap, and most of it is crap, can be removed and how to remove it just holler. example:
C:\Program Files\QuickTime\qttask.exe


I strongly suggest you look at the list as well, you know which apps are installed on your machine.
i have no idea, for example, if C:\Program Files\Digital Line Detect\DLG.exe is a valid app for your modem or spyware. same with the "viewpoint manager". you recognize these?

so far i don't see any spyware or trojans.

Ok, I'm not a pro with these things, but I know a little bit. After I looked it over I noticed 3 problems, two small ones and one that seems like a big one.

C:\Program Files\Dell\Media Experience\PCMService.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

http://www.2-spyware.com/file-pcmservice-exe.html

That website claims that that file is spyware. Also you have viewpoint media, which is spyware related too.

Now that those are out of the way, the one big problem I see is

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

Now maybe there is a legitimate support.exe but the one I'm finding information on his a trojan virus

quote:

---

Description: Added to the system as a result of the W32.Akosw@mm virus. This virus is an email worm that spreads using its own SMTP engine. W32/Israz-A also targets the KaZaA file sharing utility. Upon execution, the worm creates copies of itself in the Windows system folder with the filenames vShell.exe and Win32.exe. The worm also creates copies of itself in the Windows temp folder using the filenames Fun.exe, FAQ.exe, Q322593.exe, Support.exe, ToolBar.exe, and Wizard.exe.

---

.... http://www.liutilities.com/products/wintaskspro/processlibrary/support/


More information at http://securityresponse.symantec.com/avcenter/venc/data/w32.israz@mm.html

(Edited by xcFeRiNiZeDcc on 07-26-2004 23:57)

K
I don't see anything out of the ordinary other than the benefits to be gained from removing 90% of the crap that you have running at bootup - this includes but is not limited to:

IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
DVDSentry = C:\WINDOWS\System32\DSentry.exe
PCMService = "C:\Program Files\Dell\Media Experience\PCMService.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

and even these 2? does anyone run Mcafee? are these both required?
VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe

finally: i would investigate that digital line detector - could it be causing the problem by not detecting your connection properly??? can it be disable or configured? is anyone familiar with this app??

sorry i can't help more than that.

quote:

---

xcFeRiNiZeDcc said:

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common
Files\Dell\EUSW\Support.exe

---

good points but how the hell would the spyware know he runs a Dell?
there are a few references to dell, i would delete all of them, I have 3 Dells but I reformat and reinstall on receipt of a new PC to remove all their crap so I can't tell if these apps are legit or not.

the thought of spyware creating Dell folders is too much for me to believe...sorry
dell may have 40% market share..but it don't make sense. as for Dell doing the spying. that's possible.

but the takehome here is this. it's in the interest of spyware to make sure the INTERNET WORKS..if not it can't spy...so that rules out spyware.

(Edited by Shooting_Star on 07-27-2004 00:12)

All right, I took the easy way out and decided to reformat and reinstall XP. I'm sorry guys, I really do appreciate you guys trying to help.

Anyway, so when I reinstalled XP (which is a new experience to me as well), I basically put the cd in, and followed the steps. Unfortunately I seemed to have missed the step where I ditch all the old information on the computer (reformat right?). Now I have a clean OS, but the 11 gigs of crap that I thought would be gone is still there. It isn't actually showing any more, but if I search for the right keywords I still seem to be able to find most of it. I was told there was an option in the reinstallation to let you reformat it, but I did it twice and I couldn't seem to find anything. Perhaps I'm blind.

So my question is, does anyone have a good description of how I can completely clean my hard drive? Or another method to do it? I really have googled the heck out of this one, but I couldn't find a place that layed it out very basically for poor ol' me. Thanks so much again for all you guys have done.


-Chesta
(Who really is decent at coding things, just doesn't care much for other aspects of computers :-) )

format c:

http://www.microsoft.com/windowsxp/using/setup/expert/honeycutt_02october07.mspx


http://support.microsoft.com/default.aspx?scid=kb;%5bLN%5d;Q255867

When you boot from the CD, delete the partitions when it gives you the option, then follow the instructions for creating/formatting a new one before it installs. The options are right there when you boot to the CD...