My computer is broken. Spyware coming out of its ears

MarcLister · 17 Mar 2007 at 19:45

You could post your HijackThis log in here. http://www.hijackthis.de/en/ Then that should tell you what it thinks is dodgy and what isn't.

Richdog · 17 Mar 2007 at 19:48

MarcLister said:
You could post your HijackThis log in here. http://www.hijackthis.de/en/ Then that should tell you what it thinks is dodgy and what isn't.

If he has no idea about using Hijackthis it's best he doesn't use that or rely 100% on its results. It's not always accurate and if he removes anything he shouldn't he could get himself in trouble.

MarcLister · 17 Mar 2007 at 19:53

Richdog said:
If he has no idea about using Hijackthis it's best he doesn't use that or rely 100% on its results. It's not always accurate and if he removes anything he shouldn't he could get himself in trouble.

Yeah I agree. Course he could email the log file to someone to put into that site themselves so they can see what it says. Or he could try it himself and post a screeny of what it says so we can advise him on what we think it got right and what it got wrong.

Richdog · 17 Mar 2007 at 20:17

He doesn't need to post the hijackthis.de results, just a normal and fresh HJT log will be enough for me to work on.

Zip · 18 Mar 2007 at 02:55

Richdog said:
Ok Zip, go into safe mode, delete your favourites directly form the My Documents folder, re-boot into normal windows and then try re-running hijackthis and post it.

Ok, I went in there and couldnt find anything, I went into My Documents but i couldnt find a favorites Folder.
I then clicked on the favorites tab on the Tool bar(the spyware in favorites comes up in the regular explorer Folders and are in the favorites tab.)

Ill post the HJT log anyway though

Logfile of HijackThis v1.99.1
Scan saved at 1:23:43 PM, on 18/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Opera\Opera.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Documents and Settings\Family\Desktop\Zip\Folding@home\FAH504-Console.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Family\Desktop\Zip\Folding@home\FahCore_78.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Family\Desktop\Security\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\Run: [EPSON Stylus CX3900 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEP.EXE /FU "C:\WINDOWS\TEMP\E_S87.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "c:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "c:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Bits Show] C:\DOCUME~1\Family\APPLIC~1\CDROMB~1\hidedumbanti.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: FAH@C:+Documents and Settings+Family+Desktop+Zip+Folding@home+FAH504-Console.exe - Stanford University - C:\Documents and Settings\Family\Desktop\Zip\Folding@home\FAH504-Console.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Richdog · 18 Mar 2007 at 11:20

Ok fix the following:

R3 - Default URLSearchHook is missing

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKCU\..\Run: [Bits Show] C:\DOCUME~1\Family\APPLIC~1\CDROMB~1\hidedumbanti. exe

You do have a lot of unecessary junk on there in the way of BHO's, Toolbars etc but nearly all are legitimate. I think one of the entries above that I llisted to fix is a nasty though, hidedumbanti. exe

Make sure SpywareBlaster is fully updated and enabled too...

Zip · 18 Mar 2007 at 12:51

Richdog said:
Make sure SpywareBlaster is fully updated and enabled too...

Ok every thing is updated and selected on Spyblaster.

How do i enable it though or is it already enabled?

BTW i use opera

The favorites are still there

Richdog · 18 Mar 2007 at 12:56

Zip said:
Ok every thing is updated and selected on Spyblaster.

How do i enable it though or is it already enabled?

BTW i use opera

The favorites are still there

Dude... click the "Enable all protection" option on the front page of the program...

if you're having so many problems then reformat and start a-fresh.

MarcLister · 18 Mar 2007 at 13:02

The re-format advice is good. You've had a lot of problems with the stubborn spyware and it isn't looking good. SpywareBlaster may not support Opera as such from what I can find out but it'll help with IE when you do WindowsUpdates.

Zip · 18 Mar 2007 at 13:05

Richdog said:
Dude... click the "Enable all protection" option on the front page of the program...

if you're having so many problems then reformat and start a-fresh.

Cool, I did it right then

Looks like its a format then

Zip · 18 Mar 2007 at 17:53

I KILLED IT!!!!!

I used RegSeeker and attaked every Start up Entry other then Kaspersky and Spybot and the ones Windows needs to run

It must have been something in the start up entry that was doing it.
I did find one that did look like the one you pointed out richdog

Now hopefully i can game in peace and my computer will speed up now thats not active anymore

Richdog · 18 Mar 2007 at 18:12

Zip said:
I did find one that did look like the one you pointed out richdog

yeah I was sure it was that one, well done bud.

Zip · 19 Mar 2007 at 08:42

Now that ive disablerd that XoftSpy has managed to detect a trojan called Torpig :eek:

A Trojan is a program that enables an attacker to get nearly complete control over an infected PC. Frequently used tool by malicious hackers. When this program executes, the program performs a specific set of actions. This usually works toward the goal of allowing the trojan to survive on a system and open up a backdoor.
Attempts to log open window titles to text files, keystrokes, and steal passwords.
Periodically sends information to a remote user.
Closes security warning messages displayed by some anti-virus and security applications.
Downloads and executes additional files.

Whats the chances my passwords have been flogged?

Ive tryed to trace it with the RegEdit thing but i cant fnd the entrys in there.

This is where they are:

Zip · 19 Mar 2007 at 18:35

Richdog? Help please

Sorry for bugging you all the time

MarcLister · 19 Mar 2007 at 18:43

Zip said:
Richdog? Help please

Sorry for bugging you all the time

I'm not Richdog but its possible the trojan has gotten your passwords. I really would consider doing a proper format and re-installing Windows. I wouldn't be happy "fixing" this trojan and carrying on with the current install.

Zip · 20 Mar 2007 at 04:38

MarcLister said:
I'm not Richdog but its possible the trojan has gotten your passwords. I really would consider doing a proper format and re-installing Windows. I wouldn't be happy "fixing" this trojan and carrying on with the current install.

Thanks Ill reinstall today or tomorrow

Fr0dders · 20 Mar 2007 at 10:44

this is why i allways prefer to format with this type of thing

i get friends/families comming to me with PCs like these that have never seen windows update in their life, let alone an antivirus or spyware program.

My advice would be to once formatted make sure your copy of windows is fully up to date (SP2 + all current updates on windows update) and install a decent free antivirus program like AVG.

I also find IE7 better at blocking spyware as well, so update to that too.

Zip · 20 Mar 2007 at 11:04

MrLOL said:
this is why i allways prefer to format with this type of thing

i get friends/families comming to me with PCs like these that have never seen windows update in their life, let alone an antivirus or spyware program.

My advice would be to once formatted make sure your copy of windows is fully up to date (SP2 + all current updates on windows update) and install a decent free antivirus program like AVG.

I also find IE7 better at blocking spyware as well, so update to that too.

Just to point out i have my computer right upto date with the latest updates and Kaspersky as my AV.
I also have a long list of Programs for spyware

Fr0dders · 20 Mar 2007 at 11:15

strange

the spyware infected PCs i encounter are usually without any sort of protection. I encounter hardly any spyware problems at all so allways put people with spyware on the PC down as not having had the proper updates.

:confused:

lord knows how you've managed to get all that.

Richdog · 20 Mar 2007 at 11:23

I reckon he's inadvertantly installed something manually which has caused all this. Kaspersky is the best of the best, it rarely misses stuff like this, especially trojans which are almost two years old.