• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
    • Budfred

      PLEASE READ - Reversing upgrade   02/23/2017

      We have found that this new upgrade is somewhat of a disaster.  We are finding lots of glitches in being able to post and administer the forum.  Additionally, there are new costs associated with the upgrade that we simply cannot afford.  As a result, we have decided to reverse course and go back to the previous version of our software.  Since this will involve restoring it from a backup, we will lose posts that have been added since January 30 or possibly even some before that.    If you started a topic during that time, we urge you to make backups of your posts and you will need to start the topics over again after the change.  You can simply paste the copies of your posts that you created at that point.    If you joined the forum this month, you will need to re-register since your membership will be lost along with the posts.  Since you have a concealed password, we cannot simply restore your membership for you.   We are going to backup as much as we can so that it will reduce inconvenience for our members.  Unfortunately we cannot back everything up since much will be incompatible with the old version of our software.  We apologize for the confusion and regret the need to do this even though it is not viable to continue with this version of the software.   We plan to begin the process tomorrow evening and, if it goes smoothly, we shouldn't be offline for very long.  However, since we have not done this before, we are not sure how smoothly it will go.  We ask your patience as we proceed.   EDIT: I have asked our hosting service to do the restore at 9 PM Central time and it looks like it will go forward at that time.  Please prepare whatever you need to prepare so that we can restore your topics when the forum is stable again.
Sign in to follow this  
Followers 0
JohnG

Deep buried malware

5 posts in this topic

I have repeatedly run both Ad-aware and Spybot against this system and when I

go to use IE, I get the pop-ups and page hijacks again. I have also seen 3 files that I have deleted from the desktop twice. (Silent.exe, o.bat and o)

 

can anyone help me with this??? :huh:

===========================

here is the log:

 

Logfile of HijackThis v1.97.7

Scan saved at 4:54:42 PM, on 6/30/04

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE

C:\WINDOWS\SYSTEM\HIDSERV.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\USBMMKBD.EXE

C:\WINDOWS\SYSTEM\HPSYSDRV.EXE

C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE

C:\PROGRAM FILES\WUSB11 WLAN MONITOR\WLAN_CFG.EXE

C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE

C:\WINDOWS\SYSTEM\QTTASK.EXE

C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE

C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTTRAYAPP.EXE

C:\PROGRA~1\NETROPA\ONSCRE~1\OSD.EXE

C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE

C:\WINDOWS\RunDLL.exe

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PALM\HOTSYNC.EXE

C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE

C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\AMERICA ONLINE 8.0B\AOLTRAY.EXE

C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE

C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE

C:\TOOLS_95\IMGICON.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE

C:\PROGRAM FILES\BHODEMON\BHODEMON.EXE

C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe

C:\WINDOWS\SYSTEM\YWQLN.EXE

C:\WINDOWS\SYSTEM\YWQLN.EXE

C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FREXT.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

A:\HIJACKTHIS.EXE

 

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.casescases.com/

F1 - win.ini: run=hpfsched

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.111-deleon.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (disabled by BHODemon)

O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000221} - C:\PROGRAM FILES\LYCOS\IEAGENT\CSIE.DLL

O2 - BHO: (no name) - SOFTWARE - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.111-deleon.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [scanRegistry] c:\windows\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [uSBMMKBD] usbmmkbd.exe

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe

O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\WUSB11 WLAN Monitor\WLAN_Cfg.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [GhostStartTrayApp] c:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe

O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

O4 - HKLM\..\Run: [42HNQFX5S@X5SW] C:\WINDOWS\SYSTEM\Ahm9.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [schedulingAgent] mstask.exe

O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run

O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

O4 - HKLM\..\RunServices: [scriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

O4 - HKLM\..\RunServices: [CSINJECT.EXE] c:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE

O4 - HKLM\..\RunServices: [symTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"

O4 - HKLM\..\RunServices: [GhostStartService] C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE

O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe

O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE

O4 - Startup: HP Updates.lnk = C:\Program Files\BackWeb\BackWeb\Program\backweb.exe

O4 - Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe

O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE

O4 - Startup: PowerReg Scheduler.exe

O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE

O4 - Startup: Zip Disk Icons.lnk = C:\Tools_95\IMGICON.EXE

O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe

O4 - Startup: BHODemon.lnk = C:\Program Files\BHODemon\BHODemon.exe

O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmsearch.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmcache.html

O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmsimilar.html

O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmbacklinks.html

O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmtrans.html

O8 - Extra context menu item: SirSearch - file://C:\Program Files\PWRSTRAF\Cache\SelectedContextSearch.htm

O9 - Extra button: Real.com (HKLM)

O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clients/y/at0_x.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...8156.6217824074

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab

Share this post


Link to post
Share on other sites

It took about 6 entries into the restricted list, but that seems to have slowed down the pop-ups. Thanks Surferess.

 

Now if can figure out the entry that feeds this stuff.

Share this post


Link to post
Share on other sites

I am so glad it helped someone. I did later find out that after reboot if sent me to a different site which I also added into the restricted it was c1dcon.d8t.biz

 

It does help if you do not open MSIE the 'usual' way, by clicking on the icon. Instead I Open up Outlook and click on any link inside outlook which bypasses the home page deal. Then you can go in and reset your home page. If the home page setting says about: home, don't believe it. If you click the default home page button you will see that all is not well. There is a redirect on the home page. Instead, type in a URL that you trust as the default url (like your own URL?) and use the http://www before the URL so it cannot redirect you.

 

I am still afraid we cannot use our banking program, paypay, ebay or any other password signon website. It is sad, but true. The news media who have traced the keylogger back to Russia have also mentioned that the server has been taken offline. However, how long till the perpetrators just upload a new html file with a new server and URL? I understand their network includes possibly as many as 80 servers.

 

We have installed Mozilla.org Firefox and have gone away from Microsoft. Heck with them anyway! Although, I have read the source of the original "search for.. page and it lists all the browsers and tries to change every single one to a different number count:

Here is a long and involved html coded page from their server file (this was difficult to get to) Maybe someone who knows javascript can dissect this better than I can.

 

<HTML><HEAD>

<TITLE>Welcome to the System Performance Wizard</TITLE>

<STYLE type=text/css>

BODY

{

FONT-FAMILY: MS Sans Serif, Verdana, Arial;

}

TD

{

FONT-SIZE: 12px;

}

P

{

FONT-SIZE: 12px;

}

DIV

{

FONT-SIZE: 12px;

}

.title

{

FONT-WEIGHT: bold;

FONT-SIZE: 13px;

FONT-FAMILY: Verdana, Arial;

}

.hand

{

CURSOR: hand;

}

</STYLE>

 

<script language=JavaScript>

var sUserAgent;

var agt=navigator.userAgent.toLowerCase();

var bWindows = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) );

var bWindows95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1));

var bWindowsme = ((agt.indexOf("win 9x 4.90")!=-1));

var bWindows2k = ((agt.indexOf("windows nt 5.0")!=-1));

var bWindowsXP = ((agt.indexOf("windows nt 5.1")!=-1));

var bWindows98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1));

var bWindowsnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1));

if (bWindowsXP == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> XP';

else if (bWindows2k == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> 2000';

else if (bWindowsme == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> Me';

else if (bWindowsnt == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> NT';

else if (bWindows95 == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> 95';

else if (bWindows98 == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font> 98';

else sUserAgent = 'Windows<sup><font face="Tahoma" size="1">®</sup></font>';

 

function Trim(inString)

{

var retVal = "";

var start = 0;

while ((start < inString.length) && (inString.charAt(start) == ' '))

{

++start;

}

var end = inString.length;

while ((end > 0) && (inString.charAt(end - 1) == ' ')) {

--end;

}

retVal = inString.substring(start, end);

return retVal;

}

 

function BrowserDetector(ua)

{

this.browser = "Unknown";

this.platform = "Unknown";

this.version = "";

this.majorver = "";

this.minorver = "";

uaLen = ua.length;

var preparens = "";

var parenthesized = "";

i = ua.indexOf("(");

if (i >= 0)

{

preparens = Trim(ua.substring(0,i));

parenthesized = ua.substring(i+1, uaLen);

j = parenthesized.indexOf(")");

if (j >= 0)

{

parenthesized = parenthesized.substring(0, j);

}

}

else

{

preparens = ua;

}

var browVer = preparens;

var tokens = parenthesized.split(";");

var token = "";

for (var i=0; i < tokens.length; i++)

{

token = Trim(tokens);

if (token == "compatible")

{

}

else if (token.indexOf("MSIE") >= 0)

{

browVer = token;

}

else if (token.indexOf("Opera") >= 0)

{

browVer = token;

}

else if ((token.indexOf("X11") >= 0) || (token.indexOf("SunOS") >= 0) || (token.indexOf("Linux") >= 0))

{

this.platform = "Unix";

}

else if (token.indexOf("Win") >= 0)

{

this.platform = token;

}

else if ((token.indexOf("Mac") >= 0) || (token.indexOf("PPC") >= 0))

{

this.platform = token;

}

}

var msieIndex = browVer.indexOf("MSIE");

if (msieIndex >= 0)

{

browVer = browVer.substring(msieIndex, browVer.length);

}

var leftover = "";

if (browVer.substring(0, "Mozilla".length) == "Mozilla")

{

this.browser = "Netscape";

leftover = browVer.substring("Mozilla".length+1, browVer.length);

}

else if (browVer.substring(0, "Lynx".length) == "Lynx")

{

this.browser = "Lynx";

leftover = browVer.substring("Lynx".length+1, browVer.length);

}

else if (browVer.substring(0, "MSIE".length) == "MSIE")

{

this.browser = "IE";

leftover = browVer.substring("MSIE".length+1, browVer.length);

}

else if (browVer.substring(0, "Microsoft Internet Explorer".length) == "Microsoft Internet Explorer")

{

this.browser = "IE";

leftover = browVer.substring("Microsoft Internet Explorer".length+1, browVer.length);

}

else if (browVer.substring(0, "Opera".length) == "Opera")

{

this.browser = "Opera";

leftover = browVer.substring("Opera".length+1, browVer.length);

}

leftover = Trim(leftover);

i = leftover.indexOf(" ");

if (i >= 0)

{

this.version = leftover.substring(0, i);

}

else

{

this.version = leftover;

}

j = this.version.indexOf(".");

if (j >= 0)

{

this.majorver = this.version.substring(0,j);

this.minorver = this.version.substring(j+1, this.version.length);

}

else

{

this.majorver = this.version;

}

}

var bd = new BrowserDetector(navigator.userAgent);

function checksize()

{

window.resizeTo(640,230);

}

checksize();

</SCRIPT></HEAD>

<BODY onselectstart="return false;" ondragstart="return false;" oncontextmenu="return false;" text=#000000 bottomMargin=0 bgColor=#fdfbec leftMargin=0 topMargin=0 rightMargin=0 marginheight="0" marginwidth="0">

<TABLE height="100%" cellSpacing=0 cellPadding=0 width="100%" align=center border=0>

<TR>

<TD vAlign=top>

<TABLE cellSpacing=0 cellPadding=0 width="100%" align=left border=0>

<TBODY>

<TR>

<TD bgColor=#fdfbec height=10>

</TD></TR>

<TR>

<TD bgColor=#fdfbec>

<TABLE cellSpacing=0 cellPadding=0 width=590 align=center

border=0><TBODY>

<TR vAlign=bottom align=left>

<TD width=91 height=30>OS Check:</TD>

<TD width=499 height=27><FONT color=blue><B>

<script

language=javascript>document.write(sUserAgent)</SCRIPT>

</B></FONT>detected   <B><FONT

color=green>Clean</FONT></B></TD></TR>

<TR vAlign=bottom align=left>

<TD width=91 height=30>Browsers Check:</TD>

<TD width=499><FONT color=blue><B>

<script language=JavaScript>document.write(bd.browser+' '+bd.version)</SCRIPT>

</B></FONT>detected    <B><FONT

color=green>Clean</FONT></B></TD></TR>

<TR>

<TD vAlign=top width=91><BR>SpyWare Check:<BR></TD>

<TD vAlign=top width=499><BR><IMG height=32 alt=""

src="popup7/icon.gif"

width=35 align=right border=0>

<P><FONT color=red><B>WARNING!!!</B> Your PC may be infected

with <B>SpyWare</B>. <BR> Click OK below to scan your

system Absolutely FREE for potentially harmful SpyWare

installed on your PC. </FONT></P>

<DIV align=center><INPUT onclick="java script:window.open('http://s13ds.d8t.biz/search.php?index_id=307&ww=spyware+removal', '_blank');self.close();" type=button value=" OK ">

</DIV></TR></TBODY></TABLE></TD></TR>

<TR>

<TD bgColor=#fdfbec height=10></TD></TR>

</TBODY></TABLE></TD></TR></TBODY></TABLE></BODY></HTML>

Edited by Surferess

Share this post


Link to post
Share on other sites

I let the system run all night and this morning. Again I had a screen full of pop-ups. I was busy killing processes when I got a error and a blue screen. The mother loader has to be buried deep in the registry. But I can't find it for the life of me. This is a kid's PC and a lot of the pop-ups are not "family friendly" :techsupport:

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0