Trouble with files and processes that wont delete

[tancsaries]

Hi there,
I'm having a heap of trouble trying to get rid of these few files that wont dissappear, i cant put them into notepad and change them cause they wont let me save them as something else and i cant delete them. I ran spytrooper but luckily i read some posts and realised they were bad, but they did show me all the registery files i needed to delete. Problem is they keep reappearing as soon as i delete them too.
Theres just 2 processes i cant seem to get rid of, they are named
intmon.exe and shnlog.exe
they are both in the windows/system32 folder. They come with a few other files that wont delete either, hkk.dll, though i managed to change that in notepad (didn't seem to achieve much) and oleext.dll, which i cant change or delete.
in the registery, i've found these, and they're all connected, except none of them will stay deleted.
- hkey_local_machine/SOFTWARE/classes/clsid/VMhomepage
- hkey_local_machine/SOFTWARE/classes/clsid/VMhomepage.1
- hkey_local_machine/SOFTWARE/classes/clsid/{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}
- hkey_local_machine/SOFTWARE/classes/interface/{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}
- hkey_local_machine/SOFTWARE/classes/typelib/{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}
- hkey_local_machine/SOFTWARE/Microsoft/windows/currentversion/explorer/browser helper objecta
- hkey_local_machine/SOFTWARE/Microsoft/windows/currentversion/explorer/browser helper objects
-hkey_local_machine/SOFTWARE/Microsoft/windows/currentversion/policies
under the policies the processes are evident, /explorer/run:keys
- name=paint.exe, Data=shnlog.exe
- name=notepad2.exe, Data=intmon.exe

i dont know what else to give you, i may have missed some things but im really just sick of this, any help would be greatly appreciated, i have assignments due... here is the log

Logfile of HijackThis v1.99.1
Scan saved at 1:04:18 AM, on 18/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\shnlog.exe } "bad, cant delete these 2, tried everything, including deleting

C:\WINDOWS\system32\intmon.exe } "bad, registeries, but they just come back as soon as i delete them

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://messenger.msn.com/flash/?mkt=en- ... n=7,0,19,0
F2 - REG:system.ini: Shell=

O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp8C2A.tmp } "Also bad, tried to fix this using the program, comes back
everytime.

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing)
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpyTrooper] C:\Program Files\SpyTrooper\SpyTrooper.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Maya 6.5 Documentation Server (maya65docserver) - Unknown owner - C:\Program Files\Alias\Maya6.5\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya6.5\docs\Wrapper.conf (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

thanks again sincerely

[John McKenna]

Hi and welcome to MWR

SpyTrooper is part of your problem (see here). I seriously hope you haven't purchased a license for it.

You basically have what's known as a Smitfraud infection which as you'll be aware hijacks your desktop with a warning of impending spyware doom.

Spytrooper is the program of choice that the desktop warning will suggest fixes the problem.

We're going to remove that program as part of the fix.


Step 1

Configure Windows to Show all hidden files & folders and ensure you're familiar with rebooting into Safe Mode.

Download SmitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Download the trial version of Ewido Security Suite from here.

• When installing Ewido, under "Additonal Options" uncheck "Install Background Guard" and "Install Scan Via Context Menu".
• Launch Ewido by double-clicking the desktop icon and click 'OK' at the "Database could not be found!" warning.
• Click "Update" on the left side of the main screen to update the definitions file.
• Then click "Start Update".
• When you receive the "Update successful" prompt, close Ewido Security Suite.
• Note: If you have any problems with the updater, you can update Ewido manually

If you have not already installed Ad-Aware SE 1.06, follow the download and setup instructions here.
Otherwise, check for updates and download any new reference files before closing the program. We'll use it in Safe Mode later.


Step 2

Next, please reboot your computer in Safe Mode - Very Important !!

Run HJT again and checkmark the boxes next to the following:-

F2 - REG:system.ini: Shell=

O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp8C2A.tmp
O4 - HKCU\..\Run: [SpyTrooper] C:\Program Files\SpyTrooper\SpyTrooper.exe
O20 - Winlogon Notify: style32 - C:\WINDOWS\

Close ALL OPEN WINDOWS/BROWSERS and click Fix Checked


Step 3

Open the SmitRem folder and double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named Smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Step 4

If this folder still exists, please delete it: C:\Program Files\SpyTrooper\

Then open Ad-aware and do a full system scan. Remove all it finds.


Step 5

Open Ewido and scan your machine.

• Click on Scanner
• Click on Complete System Scan and the scan will begin.
• Warning: Do NOT open any other windows or your Control Panel while scanning as it may prevent scan completion!!
• When prompted to clean the first infection, select "Remove" and checkmark the box beside "Perform action on all infections" in the left corner.
• Upon scan completion, click the Save report button and save the report.txt to your desktop.
• Then close Ewido Security Suite.

Step 6

Next go to your Control Panel and click Display | Desktop | Customise Desktop | Website | Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut.

• Once on the Panda site click the Scan your PC button and then the Check Now button on the nex screen.
• Enter your Country.
• Enter your State/Province.
• Enter your E-mail address and click Send.
• Select either Home User or Company.
• Click the big Scan Now button.
• Allow the Active X component to install and download the necessary files. (Note: It may take a couple of minutes)
• When the download is complete, click on Local Disks to start the scan.
• Upon scan completion, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of Smitfiles.txt and the Ewido Log in your next reply to THIS thread please.

Let us know if any problems persist.


Keeping Track of Your Topic

• Please enable email notification for replies to this thread.
• Click on the Profile link in the main forum options at the top of the page.
• Under the Preferences section, select 'Yes' for 'Always notify me of replies'
• Keep ALL future replies in this thread please.

[NonSuch]

Whilst we appreciate that you may be busy, it has been 14 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.