TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Chukesgirl on January 31, 2005, 11:50:57 PM

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on January 31, 2005, 11:50:57 PM

I have been cleaning up viruses and trojans on my Windows 98 SE machine for over a month and I managed to get rid of almost everything using the latest versions of Spybot and Ad-aware. I am currently running AVG as the Virus Protection , but the trojan horse Dropper.Agent.2.R keeps popping up. I connect to the Internet through cable. Is there a way to eliminate this trojan completely?   I downloaded Hijackthis 1.99 and below is the Hijack this log.  Thanks in advance for any help.

Logfile of HijackThis v1.99.0
Scan saved at 8:51:01 PM, on 1/31/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\EZAUDIO.EXE
C:\SMC\SMC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\COREL\WORDPERFECT OFFICE 2000\PROGRAMS\ALARM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com (http://\"http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com\")
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZSERV.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EzAudioTray] C:\WINDOWS\EZAUDIO.EXE TRAYAPP
O4 - HKLM\..\Run: [SMC] C:\SMC\SMC.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [xhqbrc] C:\WINDOWS\SYSTEM\xhqbrc.exe
O4 - HKLM\..\Run: [zqdfqc] C:\WINDOWS\SYSTEM\zqdfqc.exe
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: CD Xpress.lnk = C:\Program Files\BTC\CDXpress\CdExp.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - User Startup: PowerReg Scheduler V3.exe
O4 - User Startup: CD Xpress.lnk = C:\Program Files\BTC\CDXpress\CdExp.exe
O4 - User Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr...en/nsmp2inf.cab (http://\"http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab\")
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 (http://\"http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326\")
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab (http://\"http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/PopSwatterFWBInitialSetup1.0.0.8-2.cab\")

Title: Dropper.Agent.2.r removal
Post by: guestolo on February 01, 2005, 12:55:21 AM

Check for Updates With AVG>>there was a recent one, don't run a scan yet

Access your Add/Remove programs via Control Panel and uninstall if found
VBOUNCER
CSBB

RESTART your computer if anything found and uninstalled

Set Windows to show hidden files

* Open My Computer.
    * Select the View menu and click Folder Options.
    * Select the View Tab.
    * In the Hidden files section select Show all files.
    * Click OK.

Print the rest of this out or save to a Notepad file on the desktop

RESTART your computer into
SAFE MODE (http://\"http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001060608000039?OpenDocument&ExpandSection=2#_Section2\")

Find and delete these files or folders in bold if they exist

C:\WINDOWS\ZSERV.DLL <--file
C:\WINDOWS\SYSTEM\winupdtl.exe <--file
C:\WINDOWS\SYSTEM\xhqbrc.exe
C:\WINDOWS\SYSTEM\zqdfqc.exe
C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE

C:\PROGRAM FILES\VBOUNCER <--folder
C:\PROGRAM FILES\CSBB <--folder

Stay in safe mode
Do another scan with Hijackthis and put a check next to these entries:
I'm going to ask you to remove an the entry containing red.clientapps
Seems harmless, actually related too RedSheriff spyware

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com (http://\"http://red.clientapps.yahoo.com/customize/...//www.yahoo.com\")
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZSERV.DLL
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [xhqbrc] C:\WINDOWS\SYSTEM\xhqbrc.exe
O4 - HKLM\..\Run: [zqdfqc] C:\WINDOWS\SYSTEM\zqdfqc.exe
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe

O4 - Startup: PowerReg Scheduler V3.exe
O4 - User Startup: PowerReg Scheduler V3.exe

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab (http://\"http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab\")


After you have ticked the above entries, close All other open windows, including this one
Leave Hijackthis open and click FIX CHECKED
YES and exit Hijackthis

Stay in Safe mode and run a full system scan with AVG

Restart back to Normal Mode

Don't open a browser yet, instead access Internet Options via Control Panel
Under the Programs tab "Reset Web Settings"
Under the General tab---Delete files + offline content---Also Reset home page

Post back with a fresh hijackthis afterwards

Could you also
Download and save to Desktop
VX2.Finder.exe (http://\"http://downloads.subratam.org/VX2Finder9x(126).exe\")
Open the program and click the
"Click to Find VX2.BetterInternet" button
Let it finish scanning>>This won't take long
Make a log and post it also

EDIT>>Not sure if you seen my above edit, I included updating and running AVG
in Safe mode
Just wanted to make sure you saw it
If AVG finds anything in safe mode it can't remove, let me know where it's found, thanks

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on February 01, 2005, 09:08:45 PM

Thanks for the quick response. I got an autoupdate for AVG as soon as I started up.  I never saw VBouncer or CSBB in Add/Remove programs, but I deleted everything else.  AVG found no viruses in safe mode.  The Hijack this log is below, but I don't know if VX2,Finder worked.  I ran the scan and the only thing that came up was:
[color=\"purple\"]Files Found---


User Agent String---
iebar [/color]
and when I clicked on Make Log, nothing happened.  I am assuming it didn't find anything.


Logfile of HijackThis v1.99.0
Scan saved at 5:58:01 PM, on 2/1/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\EZAUDIO.EXE
C:\SMC\SMC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COREL\WORDPERFECT OFFICE 2000\PROGRAMS\ALARM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.msn.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EzAudioTray] C:\WINDOWS\EZAUDIO.EXE TRAYAPP
O4 - HKLM\..\Run: [SMC] C:\SMC\SMC.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: CD Xpress.lnk = C:\Program Files\BTC\CDXpress\CdExp.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - User Startup: CD Xpress.lnk = C:\Program Files\BTC\CDXpress\CdExp.exe
O4 - User Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr...en/nsmp2inf.cab (http://\"http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab\")
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 (http://\"http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326\")

Again, thanks for the help.

Title: Dropper.Agent.2.r removal
Post by: guestolo on February 01, 2005, 09:41:16 PM

Looks good

You should set up protection against future attacks

SpywareBlaster by JavaCool---will block bad ActiveX and malevolent cookies
Install---Check for Updates---Enable all protection
http://www.javacoolsoftware.com/spywareblaster.html (http://\"http://www.javacoolsoftware.com/spywareblaster.html\")

IE-Spyad---IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Here is a tutorial and download link
TUTORIAL==Link to Tutorial (http://\"http://www.bleepingcomputer.com/forums/index.php?showtutorial=53\")
Download link==Download link (http://\"https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD\")
Scroll down and click on IE-SPYAD.EXE Free!

With both, Check for updates every couple of weeks
Keep the link to IE-Spyad bookmarked so you can check for updates
SpywareBlaster, after every update just simply enable all protection

Clean those Temp folders, you should regularly(At least once every couple weeks)
If you would like to try this free utility to do it for you
Download and Install this small program
to help clean your temp folders,cookies,prefeth folder, etc...
Windows Cleanup (http://\"http://www.antispyware.nextdesigns.net/installs/cleanup.php?type=exe\")
Open Windows CleanUp,
Click the CleanUp button, let it finish scanning for files and then Restart your computer

Can you do me a favor
the useragentstring in VX2 Finder
Do you have anything installed or had installed
relating to IEBar
Possibly a download manager

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on February 02, 2005, 08:39:40 PM

Yes,  iebar is in the top window of the VX2 Finder.  Do I delete that?

Title: Dropper.Agent.2.r removal
Post by: guestolo on February 03, 2005, 01:48:27 AM

No, everything looks fine
How's everything running?

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on February 03, 2005, 09:19:32 PM

Hi There!

All is great as far as no viruses or trojans popping up, but I am now getting a windows username/password login box when I turn the computer on.   /huh.gif\' class=\'bbc_emoticon\' alt=\':huh:\' />
Thanks again for your patience and help.

Title: Dropper.Agent.2.r removal
Post by: guestolo on February 03, 2005, 10:36:38 PM

Go to START>>SETTINGS>>CONTROL PANEL
Double click on the Network Icon
Under the Primary Network Logon
Change it to Windows logon

OK it and restart your computer

Let me know if that helps

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on February 04, 2005, 11:01:43 AM

Hi Again

I figured out how to get rid of the login box, but now I have no Internet on that machine.  I have this machine networked with another and the main machine is fine. I have some time today to play around with it so I'll keep you posted /rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />

Title: Dropper.Agent.2.r removal
Post by: Chukesgirl on February 07, 2005, 08:35:07 PM

Turned out to be a bad nic card.  All is well now.  Thanks again for your help.

Title: Dropper.Agent.2.r removal
Post by: guestolo on February 07, 2005, 08:40:06 PM

Thanks for posting back Chukesgirl
Glad to hear you got that part figured out  /biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />

I'll lock this topic up now that everything is fine

Anyone with similiar problems, please start your own topic