6 replies to this topic

[Avak1924]

I read the spyware removal guide and saw that I should do a scan from Panda Active Scan. I did the scan and it came up with some stuff but it didn't delete them. Here are the viruses and directories but I can't find the local service folder either. Can someone help?

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\L7UIEO7V\200_160_i_4[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\L7UIEO7V\199_150_i_5[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\L7UIEO7V\199_150_i_4[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\199_150_i_2[1].abc

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\200_160_i_1[1].abc

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\200_160_i_2[1].abc

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\200_160_i_5[1].abc

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\200_160_i_6[1].abc

Virus:Trj/Downloader.HVS C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0P80YKXS\200_160_i_6[2].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0ZF960YI\199_150_i_1[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0ZF960YI\199_150_i_2[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0ZF960YI\199_150_i_3[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K4UI89R5\199_150_i_1[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K4UI89R5\199_150_i_2[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K4UI89R5\199_150_i_4[1].abc

Virus:Trj/Downloader.GTM C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K4UI89R5\199_150_i_7[1].abc

~Avak1924~

[AndyManchesta]

Hi Avak1924,

With the files being in temp folders running Ccleaner should remove them, If you wanted to check for the folders set Windows to show hidden and system files.

To enable hidden files. Click Start. Goto MyComputer then c:\drive

Select the Tools menu from the top bar and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.
UnCheck the Hide protected operating system files (recommended) option

Click Yes to confirm then OK

Set this back once you have checked for the files by opening the same page and pressing the Restore Defaults button.

If you think there might still be malware on your pc, post a Hijack This log and we can check it over for problems.

Cheers

Andy

[Eldmannen]

Trj/Download means that it is a "Trojan downloader". A software which sneaks into your computer as a trojan, then runs silently in the background and downloads other malware software to install such as spyware, virus, trojans, bots, rootkits, etc.

Open IE, goto "Tools", then "Internet Options...", then click on the "Delete files..." button. So you delete all the cache. And/or use CCleaner to clean the temporary internet files and stuff.

You can also goto 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\' and delete everything in that folder.

You should also get Mozilla Firefox which makes your Internet experience more safer;
* http://www.mozilla.com/firefox/

[Avak1924]

I used CCleaner before doing the Pandascan but the things still popped up. I manually deleted them and did all the necessary scans. Here is my log file. Thanks for all your help so far.

Logfile of HijackThis v1.99.1
Scan saved at 10:54:00 AM, on 4/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Programs\Anti-Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://download.mcafee.com/molbin/Shared/C...22/ComCtl32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130335701765
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127690072281
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: csrsrv - Unknown owner - C:\WINDOWS\system32\csrsrv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

~Avak1924~

[AndyManchesta]

Hi Avak1924

There is afew entries that can be fixed in your log and a trojan service that needs removing.
Can you shut down Spybot's Teatimer before starting as it may interfere with the Hijack This fixes. Right click the TeaTimer icon in the system tray and choose Exit Spybot S&D Resident. It will restart when you reboot the pc.


Next goto Start Menu > Run > type

cmd

Press OK, and type or copy and paste this onto the cmd screen:

sc delete csrsrv

Press Enter, type exit and press Enter again to close the cmd screen, let us know if it succeeds or fails to remove the service.


Run Hijack This and choose Do A System Scan then place a check next to these entries

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
This is a leftover Real Player entry and can be fixed

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
This is Webroot's SpySweeper file, if you have removed SpySweeper from your pc it can be fixed

O23 - Service: csrsrv - Unknown owner - C:\WINDOWS\system32\csrsrv.exe (file missing)
This is a Trojan Service, possibly connected to Trojan.Stealther. Its showing the file is missing but there is a removal tool below that will check for the file, the above cmd steps should of removed this Service but it can be fixed if it shows in the log.

Close all open browser and other windows except for Hijack This and press the Fix Checked button


Download Symantecs FixWinSh.exe file from Here.

Save the file to your desktop,

Double-click the FixWinsh.exe file to start the removal tool. Click Start to begin the process, and then allow the tool to run. When the tool has finished running, you will see a message indicating whether Backdoor.Winshell.50 infected the computer. If it finds anything restart the computer and run the tool again to make sure it then shows clear.


Finally download Blacklight beta from Here

Run the program, accept statement > click next then scan

When its finished scanning exit the program and post back the log if it detects hidden files, The log is called fsbl-<date/time>.log.

Let us know if you have any problems or if Blacklight detects any hidden files.

Cheers

Andy

[Avak1924]

The cmd worked perfectly. Plus both program you suggested to download and run and did not pick up anything. Thank you so much for all your help.

~Avak1924~

[AndyManchesta]

Your Welcome

Happy Surfing