Trogan cannot be clean -_-

• burret

  9 May 07, 14:25

  My log file
  My comp is infected with generic.dx trojan but I am not able to clean it
  any one can help
  
  Logfile of HijackThis v1.99.1
  Scan saved at 14:22, on 2007-05-09
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Encentuate\AccessUpdate.exe
  C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\WINDOWS\system32\ccsrvc.exe
  C:\Program Files\Altiris\Carbon Copy\shellker.exe
  C:\Program Files\Sygate\LogClient.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\SYSTEM32\WISPTIS.EXE
  C:\Program Files\Sygate\SPA\smc.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\System32\tabbtnu.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Encentuate\SOCIService.exe
  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
  C:\WINDOWS\system32\WuxService.exe
  C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
  C:\PROGRA~1\Altiris\CARBON~1\client.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\WINDOWS\system32\rundll32.exe
  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
  C:\Acer\Soft Button\tabletpc.exe
  C:\Program Files\Protector Suite QL\menusw.exe
  C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
  C:\Program Files\Sygate\SPA\smcgui.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
  C:\Program Files\Encentuate\AATray.exe
  C:\WINDOWS\wnl.exe
  C:\Program Files\Ahead\InCD\InCD.exe
  C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Encentuate\Sync.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\RPlatinum\pltsvc.exe
  C:\Program Files\RPlatinum\toumok.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
  C:\WINDOWS\system32\igfxsrvc.exe
  C:\Documents and Settings\ta\Desktop\Hijackit\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: Encentuate AccessAgent component - {54E49085-CD17-464A-A7A3-5B108D6A5E41} - C:\Program Files\Encentuate\WebObserver2.dll
  O2 - BHO: NetCtrl Class - {68FACDB7-76C2-481F-BED0-5176BFC06F40} - C:\WINDOWS\system32\jng.dll
  O2 - BHO: Platinum Class - {6F100783-3B02-4A0F-8995-CF4450A1AE99} - C:\Program Files\RPlatinum\platinum.dll
  O2 - BHO: asetapp Class - {73289162-036F-467D-921C-8DDC081693A5} - C:\WINDOWS\system32\appset.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: SRead.Set - {766617CE-5CA7-42ED-ACE2-DE56B387547B} - C:\WINDOWS\system32\SysRead.dll
  O2 - BHO: upg Class - {AD4A14F9-1BA1-49EC-B721-E1D79AD768F6} - C:\WINDOWS\system32\upl.dll
  O2 - BHO: (no name) - {C449AB75-308B-4428-A710-C68B8E87E0D5} - C:\WINDOWS\system32\pket.dll
  O2 - BHO: (no name) - {D2A0394A-64E0-461B-A038-A52B41C03F75} - C:\WINDOWS\system32\beans.dll
  O2 - BHO: (no name) - {FECCE700-8269-47FC-A0FA-98D658FEA055} - C:\WINDOWS\system32\gmgr.dll
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
  O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
  O4 - HKLM\..\Run: [AcerSoftButton] C:\Acer\Soft Button\tabletpc.exe
  O4 - HKLM\..\Run: [Biomenu] "C:\Program Files\Protector Suite QL\menusw.exe"
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
  O4 - HKLM\..\Run: [AeXAgentLogon] "C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" /logon
  O4 - HKLM\..\Run: [NClean] C:\Program Files\NClean\NCleanMain.exe
  O4 - HKLM\..\Run: [AAAgent] "C:\Program Files\Encentuate\AATray.exe"
  O4 - HKLM\..\Run: [WNL Pro] C:\WINDOWS\wnl.exe
  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
  O4 - HKLM\..\Run: [OpenApizs] C:\WINDOWS\zrscbm.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [Platinum] C:\Program Files\RPlatinum\pltup.exe
  O4 - HKLM\..\Run: [wpu] C:\WINDOWS\system32\upstu.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [vacpro] C:\Program Files\vacpro\vaccineprogram.exe 1
  O4 - HKLM\..\Run: [vaccinefree Plus] C:\Program Files\vaccinefreeplus\vaccinefreeplus_starter.exe
  O4 - HKLM\..\Run: [ns70] C:\WINDOWS\system32\ns70.exe
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [o9] C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\n9\o9.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [lsasvc] C:\WINDOWS\system32\lsasvc.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
  O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: PASPortal.lnk = ?
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: 敲贰萍逞 - {971FB3AF-DE69-489d-BDF2-2F7476AC78A6} - C:\Program Files\RPlatinum\platinum.dll
  O9 - Extra 'Tools' menuitem: 敲贰萍逞 - {971FB3AF-DE69-489d-BDF2-2F7476AC78A6} - C:\Program Files\RPlatinum\platinum.dll
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
  O16 - DPF: {243C3672-9526-40AA-BE22-988F92CFA591} - http://nclean.co.kr/install/nclean.cab
  O16 - DPF: {517A520F-84B1-4EC5-A0CF-6A034BA17038} (DWUpdate Control) - http://dn.dreamwiz.com/hompy/DWUpdate/DWUpdate_2005_05_06.cab
  O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20051026/SVPorsche.cab
  O16 - DPF: {84F7A3A9-B92A-41F4-890F-83F2DC0ADB7E} (ToolBarInstall Control) - http://toolbar.imbc.com/toolbar/MBCToolBar.cab
  O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
  O16 - DPF: {AF60D574-F249-4243-8040-5521AAA5BB5E} (PandoraTVSet Class) - http://imgcdn.pandora.tv/pan_img/p3player/package/pdrtvset.cab
  O16 - DPF: {B104A4D5-3D64-4D7A-A4F9-3E6B4A2D4E00} (SBSToolBar Control) - http://toolbar.sbs.co.kr/toolbar/SBSToolBar.cab
  O16 - DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} (Daum ActiveX manager Class) - http://cafeimg.hanmail.net/cto/xman.cab?ver=1,2,3,1
  O16 - DPF: {BCA935CA-7E41-4F73-BA9C-FAB4393DBAC0} (MADanalCtrl Control) - http://www.csafer.net/ActiveX/MAStreamCtrl.cab
  O16 - DPF: {CEE326E8-7571-4086-B347-3C0ACA9A9DE8} (PcubeSet Class) - http://casx.musiccity.co.kr/empas/dll/p3empasset.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: loginkey - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll
  O20 - Winlogon Notify: psfus - C:\WINDOWS\SYSTEM32\fusstub.dll
  O20 - Winlogon Notify: TabBtnWL - C:\WINDOWS\SYSTEM32\TabBtnWL.dll
  O20 - Winlogon Notify: tpgwlnotify - C:\WINDOWS\SYSTEM32\tpgwlnot.dll
  O23 - Service: AccessUpdate - Encentuate Pte Ltd - C:\Program Files\Encentuate\AccessUpdate.exe
  O23 - Service: Altiris Agent - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
  O23 - Service: Extended Upgrade Check Starter (AuService) - Unknown owner - C:\WINDOWS\system32\AuService.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: Altiris Carbon Copy (CarbonCopy32) - Altiris - C:\WINDOWS\system32\ccsrvc.exe
  O23 - Service: Debug Log (dbglg) - Unknown owner - C:\WINDOWS\system32\dbglg.exe
  O23 - Service: Error Event Log (ereventlog) - Unknown owner - C:\WINDOWS\system32\drivers\erelog.exe
  O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
  O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: lmab_device - Lexmark International, Inc. - C:\WINDOWS\system32\LMabcoms.exe
  O23 - Service: Sygate Anti-Spyware Log Report Client (LogClient) - Unknown owner - C:\Program Files\Sygate\LogClient.exe
  O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Protection Agent 5.0 (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPA\smc.exe
  O23 - Service: SOCIService - Encentuate Pte Ltd - C:\Program Files\Encentuate\SOCIService.exe
  O23 - Service: Typer Interface Service (typemgr2) - Unknown owner - C:\WINDOWS\system32\hddmgri.exe
  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
  O23 - Service: Windows File Update Auto Check Program (WuxService) - Unknown owner - C:\WINDOWS\system32\WuxService.exe
  
  
• stellazio

  9 May 07, 14:28

  u need achilles to kill the trojans!
• Darkness_hacker99

  9 May 07, 16:07

  http://forums.techguy.org/security/568777-solved-i-need-help-remove.html
  
  This is what I have found, but I am not sure issit helpful anot.
• ndmmxiaomayi

  9 May 07, 16:54

  Can you tell me if you know these programs?
  
  Encentuate
  RPlatinum
  vaccinefreeplus
  
  Also, do you visit Korean websites or downloaded any Korean shows/movies/songs, etc?
  
  Please download SmitFraudFix.exe by S!Ri and save it to the desktop.
  
  

  [*]Double click on SmitfraudFix.exe.
  [*]Press 1 then hit the Enter key.
  [*]It will create a report named rapport.txt, usually at C drive.
• kawasaki2

  9 May 07, 16:54

  Are you using your computer in a corporate environment?
  You seem to have some programs like Encentuate, Altiris Agent.
  
  Just curious.
• kawasaki2

  9 May 07, 16:57

  Originally posted by ndmmxiaomayi:
  Can you tell me if you know these programs?
  
  Encentuate
  RPlatinum
  vaccinefreeplus
  
  Also, do you visit Korean websites or downloaded any Korean shows/movies/songs, etc?
  
  Please download SmitFraudFix.exe by S!Ri and save it to the desktop.
  
  

  [*]Double click on [b]SmitfraudFix.exe.
  [*]Press 1 then hit the Enter key.
  [*]It will create a report named rapport.txt, usually at C drive.

  [/b]

  mayi, the computers in my school have Encentuate on them as well, Altiris Agent and Mcafee Virusscan Enterprise 8.0i.
  
  You may find this video about Encentuate interesting:
  http://www.youtube.com/watch?v=fgemig6qYE0
  
• kawasaki2

  9 May 07, 16:58

  Originally posted by kawasaki2:

  mayi, the computers in my school have Encentuate on them as well, Altiris Agent and Mcafee Virusscan Enterprise 8.0i.
  
  You may find this video about Encentuate interesting:
  http://www.youtube.com/watch?v=fgemig6qYE0
  

  [/url]
• burret

  9 May 07, 18:21

  Encentuate i know but Rplatinum and vaccinefreeplus not very sure wht. This PC is used in corp environment. The Smitfraudfix I download but the mcafee prompt virus found
  
  My internet explorer also cannot start. It will crash and have a error. user32.dll. Cannot use/start internet explorer. What should I do
  
  

  Originally posted by ndmmxiaomayi:
  Can you tell me if you know these programs?
  
  Encentuate
  RPlatinum
  vaccinefreeplus
  
  Also, do you visit Korean websites or downloaded any Korean shows/movies/songs, etc?
  
  Please download SmitFraudFix.exe by S!Ri and save it to the desktop.
  
  

  [*]Double click on [b]SmitfraudFix.exe.
  [*]Press 1 then hit the Enter key.
  [*]It will create a report named rapport.txt, usually at C drive.

  [/b]

• burret

  9 May 07, 18:30

  Kawasaki
  
  You are right
  
  

  Originally posted by kawasaki2:

  mayi, the computers in my school have Encentuate on them as well, Altiris Agent and Mcafee Virusscan Enterprise 8.0i.
  
  You may find this video about Encentuate interesting:
  http://www.youtube.com/watch?v=fgemig6qYE0
  

• ndmmxiaomayi

  9 May 07, 19:04

  Then I'm afraid that I can't help. The tools used to fix are not meant for corporate users, because it messes with the registry and group policies.
  
  This might be against companies policies. Ask your company if it's possible to help.