Spyware problem, need help please... :(

Post by **o'dium** » Mon May 29, 2006 4:40 pm

Right, I clicked a link in firefox the other night, and some how it installed something called SpyFix or something like that, it gave me a search bar and all sorts of shit... Uninstalled that, removed the files, and ran both Adaware and SpyBot S&D, thought i got rid of everything...

Well it turns out, i never...

Every so often when i click a link in either FireFox or I.E., instead of me going straight to the page, i go to one of those website hosting sites or a search site... For example, fast-loans.org...?

Now both Spybot and adaware are not picking up and fixing this problem. Its pissing me off no end...

Any ideas on a better program to help me find out whats causing this? Heres my hijack this log if anybody can take a peak?

Code: Select all

Logfile of HijackThis v1.99.1
Scan saved at 17:39:49, on 29/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Logitech\SetPoint\LBTWiz.exe
C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\downloads\Applications And Software\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.quake2evolved.com/blurforum/
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO:   - {eb5259b3-60be-4e1f-a4cd-41facc1745a9} - C:\WINDOWS\system32\mmosnl.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech BT Wizard] LBTWiz.exe -silent
O4 - HKLM\..\Run: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --ports
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FD3C24E-71E8-4EE2-9B09-A7F6E544EA96}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{64ACC05F-A91C-44AC-941E-6D86D6A2A5EC}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{A54FE3A1-FBA2-43E4-A782-3F273E100C8F}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF41EC67-6220-4EC1-9A93-32EC6BEC8F6E}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CS1\Services\Tcpip\..\{2FD3C24E-71E8-4EE2-9B09-A7F6E544EA96}: NameServer = 85.255.115.157,85.255.112.97
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Thanks!

Post by **+JuggerNaut+** » Mon May 29, 2006 5:08 pm

have you done a full system scan with your antivirus? i don't see anything peculiar in the above log.

also, there are bogus hijackthis.exe's floating around the net. make sure you get it from here.

Post by **o'dium** » Mon May 29, 2006 9:54 pm

Yeah i have...

This is what i have:

http://www.lurhq.com/ppc-hijack.html

Post by **Oeloe** » Mon May 29, 2006 11:35 pm

O17 - HKLM\System\CCS\Services\Tcpip\..\{2FD3C24E-71E8-4EE2-9B09-A7F6E544EA96}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{64ACC05F-A91C-44AC-941E-6D86D6A2A5EC}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{A54FE3A1-FBA2-43E4-A782-3F273E100C8F}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF41EC67-6220-4EC1-9A93-32EC6BEC8F6E}: NameServer = 85.255.115.157,85.255.112.97
O17 - HKLM\System\CS1\Services\Tcpip\..\{2FD3C24E-71E8-4EE2-9B09-A7F6E544EA96}: NameServer = 85.255.115.157,85.255.112.97

Delete that crap with HJT...

If you're not sure if any spyware is running, Process Explorer is a good tool. Look for processes that look totally unfamiliar/suspicious. It gives a lot more information than the HJT scan.

Post by **Tormentius** » Wed May 31, 2006 12:37 am

Windows Defender :icon10:

Post by **Oeloe** » Wed May 31, 2006 1:06 am

MS Antispyware didn't find those regkeys at my system (i had similar keys).

Post by **Tormentius** » Wed May 31, 2006 1:24 am

Defender (formerly MS Antispyware) uses signature definitions like most AV companies do...so what it didn't detect before it might very well detect now.

Post by **corpse** » Wed May 31, 2006 5:48 am

Tormentius wrote:Windows Defender :icon10:

This link was provided above and I am wondering about some of these programs.

http://www.spywareinfo.com/~merijn/downloads.html

Tormentius, you seem to know a great deal about most things [no offense to anyone else] and I wuld appreciate your thoughts on some of these programs if you have time. Such as are they necessary, any good , etc.

Post by **AmIdYfReAk** » Wed May 31, 2006 6:24 am

OoooooOOooo, it looks like tor has a fan now!

( *psst* i am allmost rid of all of my "Fans" w00t w00t! " )

Btw, what happened to the days of Adaware and Spybot?

And am i the only one that is not running AV and Spyware App's on my computer?

Post by **+JuggerNaut+** » Wed May 31, 2006 11:28 am

AmIdYfReAk wrote:OoooooOOooo, it looks like tor has a fan now!

( *psst* i am allmost rid of all of my "Fans" w00t w00t! " )

Btw, what happened to the days of Adaware and Spybot?

And am i the only one that is not running AV and Spyware App's on my computer?

you're not running anything? lol?

Post by **SOAPboy** » Wed May 31, 2006 11:45 am

AmIdYfReAk wrote:OoooooOOooo, it looks like tor has a fan now!

( *psst* i am allmost rid of all of my "Fans" w00t w00t! " )

Btw, what happened to the days of Adaware and Spybot?

And am i the only one that is not running AV and Spyware App's on my computer?

I dont run AV.. spyware apps i run once a week or so..

If i worry about viruses i hit some online scans and kill em the old fassion way via command prompt..

Post by **Tormentius** » Wed May 31, 2006 8:03 pm

Not running any AV software isn't very security-concious IMO but each to their own.

As for corpse's question, I think that a current AV app and Windows Defender are enough for the average user. If you want the extra protection install Adaware or Spybot S&D and schedule them to run scans once a week rather than stay resident.

Post by **corpse** » Wed May 31, 2006 11:58 pm

Thanks.

Currently, I have Norton Antivirus 2006, Adaware and Spywareblaster.

I have the professional edition of Adaware and with it's running Ad watch [or whatever its called] my scans never find anything.