Spyware/Adware Infection Precaution Advisory

• pervertboi

  21 Apr 07, 00:17

  Originally posted by ndmmxiaomayi:

  Might be unstable connections... which ISP are you using?
  
  Mine is Singnet... and it's been on and off these few days.

  starhub.... oh so there's nothing wrong with my com?
• ndmmxiaomayi

  21 Apr 07, 00:19

  Originally posted by pervertboi:

  starhub.... oh so there's nothing wrong with my com?

  As far as I can see, no problems.
• pervertboi

  21 Apr 07, 00:20

  ok thanks mayi...
• ndmmxiaomayi

  26 May 07, 02:14

  Originally posted by ong88:

  so back to this Spyware/Adware Infection Precaution Advisory thing, it's very easy to check if your pc is infected with unwanted programs.
  
  just simply goto the "Task Manager --> Processes" as indicated in the earlier post with screenshot.
  
  those programs (processes) which shows contant change in the CPU usage, and also well-known for the "iexplore.exe" which appears in multiples are a source of potential adwares/spyware on your pc.

  Most malwares no longer use processes for you to end, to kill and remove it. They are now more sophisticated.
  
  And iexplore.exe can have multiple instances. It isn't uncommon.
• ndmmxiaomayi

  26 May 07, 23:35

  I guess you don't know how malwares work today... as I've said, they are more sophisticated these days... they even remove Safe Mode...
• Lost_Drift

  4 Jun 07, 22:58

  I kena one
  Virus places the "C:\windows\system32\.exe" and then dont let u use the Hijackthis unless u rename it. Any method to clear it?
• ndmmxiaomayi

  4 Jun 07, 23:15

  Originally posted by Lost_Drift:

  I kena one
  Virus places the "C:\windows\system32\.exe" and then dont let u use the Hijackthis unless u rename it. Any method to clear it?

  Rename HijackThis and post a log.
• Lost_Drift

  4 Jun 07, 23:35

  http://us.f13.yahoofs.com/bc/443b4747_14c14/bc/My+Documents/hijackthis.log?bf3VDZGBjZ6yuSPm
  
  there
• ndmmxiaomayi

  4 Jun 07, 23:43

  http://www.microsoft.com/windowsxp/downloads/updates/sp1/expresso.mspx
  
  Download and install XP SP1.
  
  Click on the Go button to download (it's at the extreme right hand side)
  
  Also, did you install Winpcap on purpose?
• Lost_Drift

  4 Jun 07, 23:51

  After that, run AVG/other anti-spyware material?
  Yea i install winpcap on purpose
• ndmmxiaomayi

  5 Jun 07, 00:06

  Originally posted by Lost_Drift:

  After that, run AVG/other anti-spyware material?
  Yea i install winpcap on purpose

  Yes. It looks clean.
  
  One thing I'm curious though, did you mess with msconfig? Your startup items looks little when compared with others.
  
  If yes, some malware are probably hidden there.
• Lost_Drift

  5 Jun 07, 18:22

  I not sure myself either
  lol..i now quite panick coz i think i kena the virus liao..got one internet gateway thing appear in my network connection and it creates another internet connection in my tray(last time i also kena b4 but cant remove it ) then my com hangs easily and internet cant run well.It keeps hanging
• ndmmxiaomayi

  5 Jun 07, 18:44

  Originally posted by Lost_Drift:

  I not sure myself either
  lol..i now quite panick coz i think i kena the virus liao..got one internet gateway thing appear in my network connection and it creates another internet connection in my tray(last time i also kena b4 but cant remove it ) then my com hangs easily and internet cant run well.It keeps hanging

  Hmm...
  
  Can you please do this:
  
  Copy and paste the bold parts into Notepad.
  
  ipconfig /all > results.txt
  start notepad results.txt
  
  Click on File > Save As...
  
  In the file name, type in ipconfig.bat
  In the Save As Type field, select All files from the drop-down list.
  
  Click on Save.
  
  Double click on ipconfig.bat to run it. Notepad will open.
  
  Post the contents of results.txt
• Lost_Drift

  5 Jun 07, 21:41

  only got
  1>results.txt. Nothing else
  
  I just now also remove lots of stuff like one named "winsntp.exe" and "C:\windows\system32\.exe"
• ndmmxiaomayi

  5 Jun 07, 22:25

  Originally posted by Lost_Drift:

  only got
  1>results.txt. Nothing else
  
  I just now also remove lots of stuff like one named "winsntp.exe" and "C:\windows\system32\.exe"

  Hmm...
  
  Type ipconfig /all directly into Command Prompt.
  
  Then copy and paste the results here.
  
  As for your other stuffs, I don't see them in the log.
  
  Please download Combofix from Tech Support Forum or Bleeping Computer and save it to your desktop.
  
  Double click on combofix.exe to run it.
  
  It will generate a report once it's done.
  
  Note: Do not mouse click on Combofix while it's running. It may cause it to hang.
• Lost_Drift

  5 Jun 07, 23:17

  i dunno how to copy and paste so i just did a scrrenshot
  http://i85.photobucket.com/albums/k43/Lost_drift/asd.jpg
  the combo fix thingy
  http://us.f13.yahoofs.com/bc/443b4747_14c14/bc/My+Documents/ComboFix.txt?bfiIYZGBAISEz0ru
  
  If i disconnect/close the "new" internet connection thing before i log into msn, the DNS could not be detected. Whereas for internet explorer, if i disconnect it, the page could not load at all machiam no internet.
• ndmmxiaomayi

  5 Jun 07, 23:39

  There's nothing wrong with Internet as far as I can see.
  
  However, one file caught my attention and I have to warn you about it.
  
  This file, taken from Combofix log: C:\WINDOWS\PSEXESVC.EXE
  
  It allows remote access to a PC and can do a lot of things to your PC.
  
  Here's my warning when such files are found:
  
  Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.
  
  You are strongly advised to do the following:
  
  

  [*]Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  [*]Back up all your important data except programs. The programs can be reinstalled back from the orignal disc or from the Net.
  [*]Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  [*]From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

  Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.
  
  Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.
  
  To help you understand more, please take some time to read the follwing articles:
  
  What are Remote Access Trojans and why are they dangerous
  How do I respond to a possible identity theft and how do I prevent it
  When should do a reformat and reinstallation of my OS
  Where to backup your files
  How to backup your files in Windows XP
  Restoring your backups
  
  If you want to reformat your PC, that will be the best solution. If you don't want to, let me know.
• Lost_Drift

  6 Jun 07, 15:58

  I dont think i want to reformat my com now..I've already gotten this thrice. Wish to know a way to remove this type of trojan in future as well
• ndmmxiaomayi

  6 Jun 07, 17:32

  Thrice.
  
  You better check the way you download files and the type of files you download.
• Lost_Drift

  6 Jun 07, 18:18

  I dont think is the file download problem.
  If u cant solve it then sua liao
• ndmmxiaomayi

  6 Jun 07, 18:19

  Originally posted by Lost_Drift:

  I dont think is the file download problem.
  If u cant solve it then sua liao

  Can solve... but to kena 3 times...
  
  There are quite a few files to delete anyway.
• Lost_Drift

  6 Jun 07, 18:22

  aiya..anyway the 3 times is 2 times before i reformat my com plus now ma..
  then it keeps comin also sian
• Mospeada

  7 Jun 07, 18:00

  mayi...is this a virus site?
  
  http://blockoo.com/en
• ndmmxiaomayi

  7 Jun 07, 18:04

  More like a spam website.
• Erwin_Rommel

  13 Jun 07, 01:49

  Hi Mayi, mind helping me take a look?
  
  My HijackThis logfile (beta) is as follows:
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\CameraAssistant.exe
  C:\WINDOWS\system32\ElkCtrl.exe
  C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
  C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
  C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
  C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
  C:\WINDOWS\system32\CTsvcCDA.exe
  C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  D:\Installers\Essential Computer Security\HiJackThis_v2.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/divx/divx6/new/en?rcv=1&dist=divxdotcom
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
  O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
  O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [EPSON Stylus CX3900 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEP.EXE /FU "C:\WINDOWS\TEMP\E_S19B.tmp" /EF "HKLM"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
  O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
  O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
  O4 - HKLM\..\Run: [SBRegRebootCleaner] C:\Program Files\Sunbelt Software\CounterSpy\SBRC.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: BlueSoleil.lnk = ?
  O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181145898671
  O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
  O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
  O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
  O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
  O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
  O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
  
  Me just switched to Kaspersky Internet Security 7.0 after getting 2 trojans while using Mcafee a few months ago. Would like to know how effective KIS7.0 is.
  
  Thanks