Jump to content


Photo

infected with CWS..."CWS.Boot conf"?..help remove?


  • Please log in to reply
1 reply to this topic

#1 frisky_rabbit

frisky_rabbit

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 30 July 2004 - 12:47 PM

ok...i've run spy bot search and destroy, pest patrol,adware and NAV.All up to date of course.

CWShredder picked up a "CWS.Boot conf" version and it is DEFINITELY CWS.

HijackThis manual suggested that a feature in SBS&D could interfere with an accurate HJT log.So since i didn't know how to turn the feature off i just deleted SBS&D for now.

Here is the HijackThis log:

Logfile of HijackThis v1.98.0
Scan saved at 1:36:53 PM, on 7/30/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\eXpress\NS Client\AeXNSClient.exe
C:\Program Files\Altiris\eXpress\NS Client\AeXNSClientTransport.exe
C:\PROGRA~1\NavNT\DefWatch.exe
C:\DMI\bin\dmisrv.exe
C:\WINNT\System32\svchost.exe
C:\DMI\bin\delldmi.exe
C:\PROGRA~1\NavNT\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Dantz\Client\Remotsvc.exe
C:\Program Files\Dantz\Client\retroclient.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
c:\program files\timbuktu pro\tb2launch.exe
C:\DMI\bin\win32sl.exe
C:\WINNT\system32\svchost.exe
C:\DMI\bin\nic.exe
C:\DMI\bin\coo.exe
C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
c:\program files\timbuktu pro\tb2pro.exe
c:\program files\timbuktu pro\TNOTIFY.EXE
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\Program Files\ViewMail\LFfaxtomail\lfsndmng.exe
C:\program files\timbuktu pro\tb2logon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Program Files\Altiris\eXpress\NS Client\AeXSWDUsr.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\internat.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\WINNT\msagent\AgentSvr.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://business.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com...B_PVER}&ar=home
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.peiwmdxbs...i6_lMDlmJC.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = www.searchant.com/r=6&s=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = www.searchant.com/r=6&s=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [lfsndmngav] C:\Program Files\ViewMail\LFfaxtomail\lfsndmng.exe
O4 - HKLM\..\Run: [TLogonPath] "c:\program files\timbuktu pro\tb2logon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AeXSWDUsr] C:\Program Files\Altiris\eXpress\NS Client\AeXSWDUsr.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [MORE ACE] C:\PROGRA~1\FLAPAT~1\funk grid.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [828djk30.exe] C:\WINNT\828djk30.exe /dk
O4 - HKLM\..\Run: [hnli0k0e.exe] C:\WINNT\hnli0k0e.exe /dk
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: stamp.dat
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: Domain = rand.org
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: NameServer = 130.154.6.173,130.154.11.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{D955B77A-0AA0-44B1-8039-776B42AF903B}: Domain = rand.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = rand.org
O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: Domain = rand.org
O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: NameServer = 130.154.6.173,130.154.11.152
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = rand.org
O17 - HKLM\System\CS2\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: Domain = rand.org
O17 - HKLM\System\CS2\Services\Tcpip\..\{4A1C4D56-6D93-431B-8A84-2D6D95F5B0B3}: NameServer = 130.154.6.173,130.154.11.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = rand.org

#2 frisky_rabbit

frisky_rabbit

    Member

  • Full Member
  • Pip
  • 7 posts

Posted 30 July 2004 - 12:49 PM

Sorry i should probably mention that Timbuktu Pro and Altiris are legit as this is a work PC




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button