Jump to content


Photo

Casino Palazzo just won't go away!


  • Please log in to reply
7 replies to this topic

#1 Zybon

Zybon

    Member

  • New Member
  • Pip
  • 4 posts

Posted 09 July 2004 - 09:12 PM

I've spent a couple days searching for a solution to get rid of the spyware that causes Casino Palazzo to pop up randomly when using Internet Explorer. It also places a Casino icon on my desktop and a number of websites to the favorites list. Also, Windows file protection sometimes gives a warning that it has detected spyware, one warning mentions the spyware "WurldMedia", "Gator", "GoHip/Browserenh", and "Httper", and the other warning mentions "Subsearch", "MoneyTree", "Aornum", "Win32/Aspam.Trojan". I've tried running Cwshredder as well as adaware and various other spyware removers and they have found things but nothing has stopped the problem.
Heres my Hijackthis log, hopefully someone can help.


Logfile of HijackThis v1.97.7
Scan saved at 9:11:46 PM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgn.exe
D:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\System32\winnet.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\flashget\jccatch.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\flashget\fgiebar.dll
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - D:\flashget\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\flashget\jc_link.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.micr...0367/wmavax.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macrom...tor/cabs/sw.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan....r/axscanner.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_42.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...8134.5374421296
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft....ayx_vp6_aac.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

Edited by Zybon, 09 July 2004 - 09:38 PM.


#2 LOW MOLE

LOW MOLE

    Member

  • Full Member
  • Pip
  • 18 posts

Posted 09 July 2004 - 10:05 PM

1. Open Task Manager and kill the following processes: (not all of them may be running)
a. msmk.dll
mess.exe
taskngr.exe or taskmgn.exe (not taskmgr.exe which is normal)
telnetxp.exe
reinstall.exe
2. Next go to Start -> Run and open a command prompt.
a. At the command prompt type in: regsvr32 msmk.dll /u
3. Now you’ll need to browse to C:\windows\system32 and delete the following files
a. mess.exe
taskngr.exe or taskmgn.exe (not taskmgr.exe which is normal)
telnetxp.exe
reinstall.exe
b. You won’t be able to delete the msmk.dll file yet.
4. Now browse to C:\Windows\Prefetch and delete any files that start with the same names as above.
a. Ex: telnetxp.exe-00000000.pf
5. Now you’ll need to reboot
6. After the reboot browse to C:\windows\system32 and delete the msmk.dll file.
7.Now open internet explorer and then Tools -> Internet options
a. Go to the “Programs” tab and click the “Reset web settings…” button.
b. This will clear out all the setting the msmk.dll file overwrote.

Edited by LOW MOLE, 09 July 2004 - 10:08 PM.


#3 Zybon

Zybon

    Member

  • New Member
  • Pip
  • 4 posts

Posted 10 July 2004 - 03:29 AM

Thanks for the speedy response!
I followed your instructions as much as I could, but the msmk.dll file was no where on my system. I also received the message "The specified module could not be found' when trying the regsrv32 command.
All I could do was delete taskmgn.exe and telnetxp.exe from my system32 directory, there was also no evidence of these files in the prefetch directory.

Hopefully it was enough to get rid of this malware... I'll report back in a day at most to confirm whether it worked or not.

Edited by Zybon, 10 July 2004 - 03:55 AM.


#4 LOW MOLE

LOW MOLE

    Member

  • Full Member
  • Pip
  • 18 posts

Posted 10 July 2004 - 10:00 AM

More than likely, you will only find a couple of the specified files but not to worry. This may have solved your problems. Please post and let me know if this did correct your problem.

#5 Zybon

Zybon

    Member

  • New Member
  • Pip
  • 4 posts

Posted 10 July 2004 - 01:47 PM

Well the problem is still here. After the popup (and links were added to favorites), taskmgn.exe appeared again in Task Manager and the system32 directory.
Need to find whatever is bringing it back...

Edited by Zybon, 10 July 2004 - 03:21 PM.


#6 LOW MOLE

LOW MOLE

    Member

  • Full Member
  • Pip
  • 18 posts

Posted 10 July 2004 - 08:24 PM

I'm sorry to hear the suggestion I posted did not fix your problems. I had the same exact problems and followed the steps I posted for you and it worked like a charm.

I hope one of the experts will respond to your post with another strategy. You can always try to find information or additional assistance from this site:

http://www.computerc...ostp226121.html

OR


http://www.definitiv...om/bhodemon.htm

Good luck!

Edited by LOW MOLE, 10 July 2004 - 08:28 PM.


#7 Zybon

Zybon

    Member

  • New Member
  • Pip
  • 4 posts

Posted 12 July 2004 - 03:10 AM

I went to the first link you posted and found someone who had the *exact* same problem as me. He used BHO demon and deleted winnet.dll, and the same thing worked for me. Thank you for the help.

#8 LOW MOLE

LOW MOLE

    Member

  • Full Member
  • Pip
  • 18 posts

Posted 12 July 2004 - 04:19 AM

Great! I'm glad to hear you got your problem sorted.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button