More spyware problems

Printable View

January 9th, 2006, 01:45 AM
Professor Teile

More spyware problems

Ok here is my problem some how when my brother was on my computer it got a ton of spyware on it. And maybe a few virus's now i have run my anti virus in safe mode as well as ad aware, mircosoft anti spyware and spybot. After doing this i couldnt connect to the internet open a browser or much else for that matter i got a error on boot up saying something about winnet.exe not being found. I ran the windows repair which fixed that problem now most of the spyware and what not is gone but now my computer is lacking in performance considering how it ran before all this. Ive ran my spyware stuff and found nothing. My IE keeps locking up on some pages but not other. I have taken a hijackthis log. Is there anything yall can tell me that might help?

Logfile of HijackThis v1.99.1
Scan saved at 6:40:25 PM, on 1/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\FIREWALL\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\sachostx.exe
C:\WINDOWS\System32\sachostc.exe
C:\WINDOWS\System32\sachosts.exe
C:\Program Files\ABC\abc.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Zippy\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.ev1.net/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe
O4 - HKLM\..\Run: [WinHound] C:\Program Files\WinHound\WinHound.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [dmpit.exe] C:\WINDOWS\System32\dmpit.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/Activ...veLauncher.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1129620561045
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
January 9th, 2006, 02:10 AM
hesperus

This thing is still a mess. Any chance on a full format ? If not, here are a bunch to start with. Most are trojan related.

C:\WINDOWS\sachostx.exe

C:\WINDOWS\System32\sachostc.exe

O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll

O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe

O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s

O4 - HKLM\..\Run: [HostSrv] C:\WINDOWS\sachostx.exe

O4 - HKLM\..\Run: [WinHound] C:\Program Files\WinHound\WinHound.exe

O4 - HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe

O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll (file missing

Not sure :

O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/Acti...iveLauncher.cab

O4 - HKLM\..\Run: [dmpit.exe] C:\WINDOWS\System32\dmpit.exe
January 9th, 2006, 02:14 AM
mandraketux

oh man you those pron sites ur bro looks at are killing you;)
yea a reformat sounds good at this point unless hesperus helped you out a bit.
January 9th, 2006, 02:18 AM
nihil

Hmmm,

winnet.exe :rolleyes: please read this:

http://www.auditmypc.com/process/winnet.asp

You might also boot into safe mode and defragment your drive. I would also get Firefox, and use that rather than IE where possible. Get the script blocking and adblocking plug ins for it while you are at it.

Also get these and run them in safe mode:

http://www.emsisoft.com/en/software/free/
http://www.ewido.net/en/

:)
January 9th, 2006, 01:50 PM
dalek

Also...and some may disagree.....but when you have it all cleaned up, I strongly urge you to get the SP2 and security patches that have come out since SP2 was rolled out.(Aug 2004).

Then read How Did I get Infected ;)

You can remove wildtangent through the Add/Remove function.

With some patience this can be cleaned up without doing a complete re-install, and while your doing it, you can better understand some of what you are playing around with.... ;)

Highjack This Log Tutorial
January 9th, 2006, 02:07 PM
nihil

And give your brother a limited user account that does not permit installing software etc. Then if he gets hijacked, the malware will have relatively few authorities.

;) :D
January 9th, 2006, 03:38 PM
ByTeWrangler

Greeting's

Somthing that seems to be missed out is the Windows (SP1) and Internet Explorer version (6.00.2800.1106) which is old. You must FIRST update your windows apply all patches.

Then use malware removing software in the safe mode. Also you might want to chang few settings in Internet explorer.

Go to Control Panel
Network and Internet connections
Internet Options
General
Temporary internet files
Settings
Set to: Every visit to page
Days to keep pages in history
Set to: 0
Security
Internet
Custom level
Reset to: High
Reset (yes)
Scroll down to "File download"
Set to: Enable
Local intranet
Sites
Make sure nothing is selected
Trusted sites
Sites (for using update and certain other feature's please add folowing site's
add: *.microsoft.com
Make sure "require server verification is not selected
Move the tab to "Medium"
Privacy
Advanced
Override automatic cookie handling
First party cookies: Block
Third-party cookies: Block
Enable: Always allow session cookies
Content
Autocomplete
Disable all
Clear forms (yes)
Clear passwords (yes)
Programs
Disable: Internet Explorer should check whether it is the default web browser
Also now go to advance options and then
UNCHECK : install on demand (others)
UNCHECK : enable third party broweser extention's

You might consider using firefox as a browser. But remember you system will never be secure TILL YOU DO NOT UPDATE YOUR OS (Windows)
January 9th, 2006, 08:22 PM
J. Smoker

Spyware

Quote:

Originally posted here by nihil
Hmmm,

Also get these and run them in safe mode:

http://www.emsisoft.com/en/software/free/
http://www.ewido.net/en/

:)

Hey, Nihil. Thanks for the links to these tools. I was able to clean some major Spyware and malware from my personal computer and my 2003 server at work.
January 9th, 2006, 09:33 PM
morganlefay

Quote:

and my 2003 server at work.

Servers should not be used to browse the internet.....or pickup mail........so there really should be no spyware on the server.....or malware for that fact.
:eek:

Unless of course it is not patched and firewalled.....

If your server had malware\spyware on it...I would seriously think about reinstalling....never know what you missed....or what has been left behind....

MLF
January 9th, 2006, 09:36 PM
foxyloxley

Quote:

I was able to clean some major Spyware and malware from my personal computer and my 2003 server at work.

WTF :confused:
HOW did you get a server infected

[edit]MLF types faster :)
January 10th, 2006, 02:37 AM
J. Smoker

Spyware

Quote:

Originally posted here by foxyloxley
WTF :confused:
HOW did you get a server infected

[edit]MLF types faster :)

Let me get off the subject for a second. I provide imaging solutions for schools. Using symantec ghost and was doing some research for customizing drivers and had picked up some spyware and malware.

Should have been using my personal computer to do the research instead of the server
January 10th, 2006, 02:45 AM
J. Smoker

Quote:

Originally posted here by morganlefay
Servers should not be used to browse the internet.....or pickup mail........so there really should be no spyware on the server.....or malware for that fact.
:eek:

Unless of course it is not patched and firewalled.....

If your server had malware\spyware on it...I would seriously think about reinstalling....never know what you missed....or what has been left behind....

MLF

I have seriously considered this. I'm currently looking for my CD's to reinstall but not able to find them. So I have taken off the network until I can fully correct the issues. It was patched but not firewalled :eek: .

Lesson learned.
January 10th, 2006, 03:06 PM
morganlefay

J. Smoker

You can always contact MS to get replacement CDs....as long as you have a valid license.

Have had to do this many times...from many different vendors.

Its amazing what disappears out of my office while on vacation :rolleyes:

HTHS

MLF
January 10th, 2006, 04:11 PM
J. Smoker

Spyware

morganlefay,

I was not aware I could do that (Get a replacement Cd). I will keep that in mind.
Fortunatley, I will not have to as my Boss found the CD's. He had taken them home.

Thanks for the heads up.
January 10th, 2006, 04:24 PM
Leap Frog

Quote:

It was patched but not firewalled . :eek:

You are lucky that your server wasn't pwned and turned into a warez holder.

i would recommened that when you get it back online that you invest some time into securing it properly so as not have to start from scratch in a few months time, suffering from similar problems.

LF
January 10th, 2006, 04:33 PM
J. Smoker

Quote:

Originally posted here by Leap Frog
You are lucky that your server wasn't pwned and turned into a warez holder.
iLF

I'm definitly going to do so this time. Could you explain what you mean by warez holder? :confused:

Thanks, Smoker
January 10th, 2006, 06:28 PM
foxyloxley

slang term to define where the 'bad' boyz will store / dump their [possibly] illegal stash of tools and apps.
they then post out your details so that any other 'bad' boyz can come and play.
in short order, you don't have a server, you've become the proud owner of a 'bad' boyz take away ;)
January 10th, 2006, 07:43 PM
J. Smoker

slang term to define where the 'bad' boyz will store / dump their [possibly] illegal stash of tools and apps

Gotcha FL, cool and not so cool. I will be better prepared the next time.
January 11th, 2006, 04:41 PM
politroyx

Re: More spyware problems

The best way to remove the virus and spywares is to reformat your server and
apply the security posted here.