This thread's last reply is from January 12, 2006, 9:17 AM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm]
"Device"="\\\\.\\Rasdule"
"DriverPath"="C:\\WINDOWS\\System32\\drivers\\fsvpci.sys"
"DriverName"="USBisvc"
"UninstallerParams"=""
"PageFiltering"=dword:00000001
"AutoUpdater"="C:\\WINDOWS\\System32\\ied71deu.exe"
"Version"="2.0.131"
@="\\ziBLO5TUUTUUVUy3L6NE7TUUTjWU:pukv:zUzRLM7FaZU6KBO7KLU8LOI5BVLRL"
"CrMnTmt"=dword:0036ee80
"NxRestTm"="2005:11:20-07:25:25:265"
"LastAURestoreMsgTS"="2005:11:20-06:25:25:265"
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm\AU2]
"AP"="/DVNM=\"\\\\.\\Rasdule\" /INSC=\"AU\""
"SU"="http://au.contextplus.net/services/AUServer"
"NPT"="2005:12:30-11:10:56:703"
"TO"=dword:01499700
"LastCLRestoreMsgTS"="2005:12:14-13:20:50:578"
@="2005:12:30-05:10:56:703"
"LCT"="2005:12:25-22:22:43:484"
"NxRestTm"="2005:12:14-14:20:50:578"
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm\AU2\RGR]
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm\AU2\RGR\Messages]
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm\AU2\RGR\Properties]
"CP.cv"=hex:43,50,2e,63,76,00,32,2e,30,2e,31,33,31,00,31,36,30,31,3a,30,31,3a,\
30,31,2d,30,30,3a,30,30,3a,30,30,3a,30,30,30,00,00
"CP.id"=hex:43,50,2e,69,64,00,7b,48,62,35,62,31,36,38,62,2d,32,65,36,31,2d,35,\
33,65,39,2d,38,32,38,63,2d,62,61,31,66,35,34,33,66,36,62,37,39,7d,00,31,36,\
30,31,3a,30,31,3a,30,31,2d,30,30,3a,30,30,3a,30,30,3a,30,30,30,00,00
"CP.pc"=hex:43,50,2e,70,63,00,57,42,2e,4f,4c,44,00,31,36,30,31,3a,30,31,3a,30,\
31,2d,30,30,3a,30,30,3a,30,30,3a,30,30,30,00,00
"CP.st"=hex:43,50,2e,73,74,00,49,00,31,36,30,31,3a,30,31,3a,30,31,2d,30,30,3a,\
30,30,3a,30,30,3a,30,30,30,00,00
"CP.is"=hex:43,50,2e,69,73,00,41,55,00,31,36,30,31,3a,30,31,3a,30,31,2d,30,30,\
3a,30,30,3a,30,30,3a,30,30,30,00,00
"CP.it"=hex:43,50,2e,69,74,00,32,30,30,35,31,31,32,36,31,34,30,30,33,38,00,31,\
36,30,31,3a,30,31,3a,30,31,2d,30,30,3a,30,30,3a,30,30,3a,30,30,30,00,00
"CP.os"=hex:43,50,2e,6f,73,00,5b,32,5d,20,35,2e,31,2e,32,36,30,30,20,22,53,65,\
72,76,69,63,65,20,50,61,63,6b,20,31,22,00,31,36,30,31,3a,30,31,3a,30,31,2d,\
30,30,3a,30,30,3a,30,30,3a,30,30,30,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\CyiiFAGFaUEm\AU2\TDH]
Im not sure if it worked bc when the black screen popped up it said there was some error. but here is the log:
Yes, it's ok - I look if the service is still present and when it's gone it gives an error message. It's normal. No hidden folder, strange, maybe only visible after reboot. Perform this part again please. Just run in Normal Mode.
Copy/paste the following text into a new Notepad document.
cd C:\Program Files\
Searching for hidden directory... > %systemdrive%\fixme.txt
echo. >> %systemdrive%\fixme.txt
dir /ad >> %systemdrive%\fixme.txt
echo. >> %systemdrive%\fixme.txt
dir /s /ad cache >> %systemdrive%\fixme.txt
echo. >> %systemdrive%\fixme.txt
dir /s ace.dll >> %systemdrive%\fixme.txt
echo. >> %systemdrive%\fixme.txt
dir /s wingenerics.dll >> %systemdrive%\fixme.txt
echo. >> %systemdrive%\fixme.txt
dir /s data.bin >> %systemdrive%\fixme.txt
Notepad %systemdrive%\fixme.txt
Save it to your desktop as
cleanme.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: cleanme.bat
Double click
cleanme.bat. A DOS box should open and close quickly, this is normal.
______________________________
Let's see what is left over ....
Delete the c:\program files\DNS folder !
You will need to update Ewido to the latest definition files.
- On the left-hand side of the main screen click the Update Button.
- Click on Start.
The update will start and a progress bar will show the updates being installed.
Once finished updating, start a scan.
If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates. Make sure to close Ewido before installing the update.
Close
ALL open Windows / Programs / Folders. Please start
Ewido Security Suite, and run a full scan.
- Click on Scanner
- Click on Settings
- Under How to scan all boxes should be checked
- Under Unwanted Software all boxes should be checked
- Under What to scan select Scan every file
- Click on Ok
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says
Perform action on all infections, then choose clean and click Ok.
Once the scan has completed, there will be a button located on the bottom of the screen named
Save Report.
- Click Save Report button
- Save the report to your Desktop
Close Ewido
______________________________
Please do an online scan with
Kaspersky Online Scanner
Click on
Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click
Yes.
- The program will launch and then start to download the latest definition files.
- Once the scanner is installed and the definitions downloaded, click Next.
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (If available otherwise Standard)
- Scan Options:
- Scan Archives
- Scan Mail Bases
- Click OK
- Now under select a target to scan select My Computer
- The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
- Save the file to your desktop.
- Copy and paste that information in your next post.
______________________________
Please post Ewido log and Kaspersky log
Kim
Logfile of HijackThis v1.99.1
Scan saved at 9:32:21 PM, on 1/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\hjt\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.uchicago.edu/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AOL Instant Messanger] aim.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://tdserver.bitstream.com/tdserver.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - http://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) -
http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
I see that you still run Bearshare. This is my last attempt to clean up these files. As long as Bearshare is installed, we will probably be unable to clean up your system further than this stage. They keep coming back and Bearshare is the culprit. Keeping cleaning them up while the source of the problem is still used, is a waste of time for both of us. If you want to use Bearshare, you will have to live with this spyware on your computer, there's no way to separate them.
At least you have a firewall running now, very pleased to see that.
Copy/paste the following text into a new Notepad document. Make sure that you have one blank line at the end of the document as shown in the quoted text.
REGEDIT4
[-HKEY_LOCAL_MACHINE\software\system\sysold]
[-HKEY_CLASSES_ROOT\CLSID\{16B238D5-80DE-47CE-8F17-B3ECE2C2248D}]
[-HKEY_CLASSES_ROOT\CLSID\{197B8CA4-E215-46DD-8F33-E0544A80E5C4}]
[-HKEY_CLASSES_ROOT\CLSID\{71D1708F-973D-4600-AF01-AD86688403AE}]
[-HKEY_CLASSES_ROOT\CLSID\{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}]
[-HKEY_CLASSES_ROOT\Interface\{0A0CB91F-304B-44AD-9460-9C55465163A4}]
[-HKEY_CLASSES_ROOT\Interface\{2AB7A3C6-9D09-428C-AA65-07BD49FB7065}]
[-HKEY_CLASSES_ROOT\Interface\{32A9D21F-F510-44DC-9EA6-0456EDA04668}]
[-HKEY_CLASSES_ROOT\Interface\{4562B6F3-DAF8-464E-87B7-5464575F0D6A}]
[-HKEY_CLASSES_ROOT\Interface\{57CB9B97-9FF9-4C87-88A4-56A867FFC95E}]
[-HKEY_CLASSES_ROOT\Interface\{DA4B919F-B757-4E32-8D79-DEC5C2704C4B}]
[-HKEY_CLASSES_ROOT\Interface\{F1AD96E6-E575-44D9-9BBF-F3FDCF06C454}]
[-HKEY_CLASSES_ROOT\TypeLib\{00DC9FF2-EA77-49C7-8DEF-722FD81CAB59}]
[-HKEY_CLASSES_ROOT\TypeLib\{227D1E33-EAD4-4ACE-BE32-4ACFAAD072DD}]
[-HKEY_CLASSES_ROOT\TypeLib\{33ADD70F-53AB-4F97-B4B6-997881820F6D}]
[-HKEY_CLASSES_ROOT\TypeLib\{34A35BBB-8C19-4482-864C-290BD8DD6A5D}]
[-HKEY_CLASSES_ROOT\Var3.RsyncHlpr.1]
[-HKEY_CLASSES_ROOT\VBRun.VBRunDLL]
[-HKEY_CLASSES_ROOT\VBRun.VBRunDLL.1]
[-HKEY_CLASSES_ROOT\LowSol.RichEditor]
[-HKEY_CLASSES_ROOT\LowSol.RichEditor.1]
[-HKEY_CLASSES_ROOT\Pool.LANBridge]
[-HKEY_CLASSES_ROOT\Pool.LANBridge.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Netsync]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RsyncMon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\regsync]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vbrundll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richedtr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\lanbrd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\lanbrup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16B238D5-80DE-47CE-8F17-B3ECE2C2248D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{197B8CA4-E215-46DD-8F33-E0544A80E5C4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71D1708F-973D-4600-AF01-AD86688403AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\RSyncMon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VBRun]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Lanbridge]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RSyncMon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VBRunDLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichEditor]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LANBridge]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SafeSurfing]
[-HKEY_LOCAL_MACHINE\SOFTWARE\RichEd]
Save it to your desktop as
Fixme.reg. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: Fixme.reg
Locate
Fixme.reg on your desktop and double-click it. When asked if you want to merge with the registry, click
YES. Wait for the
merged successfully prompt.
______________________________
Close all browsers and programs.
Run HijackThis, click on
Open the Misc Tools Section and finally click on the ADS Spy button. Press the Scan button and the program will start to scan your Windows folder for any files that are Alternate Data Streams. If it finds any, it will display them. Place a checkmark next to its entry and click on the Remove selected button. This will remove the ADS file from your computer. When you are done, press the Back button next to the Remove selected until you are at the main HijackThis screen.
______________________________
Double-click
Killbox.exe to run it.
Next, you will be entering items into Pocket KillBox. Please select the “Delete on Rebootâ€
