Removing EliteBar

[sohnir]

Hi-
I need help with removing EliteBar. I ran AdAware and SpyBot; but still keeps on coming back.
I followed one of the forums on May-14-2005 opened by wakebrder03 and resolved by "questolo" in Tech Clinic.
I executed the instructions by questolo and ran "LQfix.bat" in SAFE mode and rebooted the system. However, I have not executed the "Elite.reg" as it appeared that it was specific to "wakebrder03"'s hijak log.
Although, it appears that EliteBar seems to be gone, my Windows Media Player got screwed up and some other popus still appear. I am not sure I have the clean system. There might be some residual bad registry entries.
As you had "Elite.reg" specifically for wakebrder03; could you please look at my hijack log.
Can you please help? If needed, I can upload the hijack log.
Thanks in advance.

[guestolo]

Go ahead and post your Hijackthis log here for analysis

[sohnir]

Hi-
Thanks for the quick response. I will post the hijack log as soon as I reach home. It is on my home PC.
thanks again for your help.

[sohnir]

Logfile of HijackThis v1.99.1
Scan saved at 10:04:51 PM, on 6/8/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Linksys\Wireless Network PC Card\NICServ.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\tp4mon.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\System32\Promon.exe
C:\WINNT\System32\RunDll32.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\PDirect.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\WINNT\System32\PRPCUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\System32\RUNDLL32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\vpnrkn.exe
C:\Program files\ThinkPad\Utilities\tponscr.exe
C:\WINNT\System32\WDBtnMgr.exe
C:\WINNT\System32\winupdt.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Linksys\Wireless Network PC Card\WPC11Cfg.exe
C:\WINNT\System32\nsvsvc\nsvsvc.exe
C:\WINNT\System32\picsvr\picsvr.exe
C:\Documents and Settings\meenavips\My Documents\Tools+Software\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINNT\tct101.dll
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\System32\WinNB57.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\System32\WinNB57.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IBMPMSVC] %SystemRoot%\System32\ibmpmsvc.exe -helper
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SoundFusion] RunDll32 cwcprops.cpl,CrystalControlWnd
O4 - HKLM\..\Run: [PDIRECT] C:\PROGRA~1\ThinkPad\UTILIT~1\PDirect.exe
O4 - HKLM\..\Run: [TP98UTIL] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE /s
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINNT\System32\vpnrkn.exe reg_run
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINNT\System32\winupdt.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [empin] C:\WINNT\System32\Cache\e121307.Stub.exe
O4 - HKLM\..\Run: [Nsv] C:\WINNT\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINNT\System32\picsvr\picsvr.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: DSW IPSec Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\Wireless Network PC Card\WPC11Cfg.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC11 - Unknown owner - C:\Program Files\Linksys\Wireless Network PC Card\NICServ.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

[sohnir]

Also, it looks like there are more spyware programs installed. I see a "mirar" bar got installed on my IE. I also saw "IE Optimizer" got installed. I de-installed IE Optimizer from Control Panel -> Remove Programs. However, the IE bar is still there.
Please help.
Thanks.

[sohnir]

Just an FYI; the Windows Media Player, PC Doctor for NT and Think Pad information programs also appears to be affected; as they have lost their original icons.

[guestolo]

Can you do the following for me please

Download and UNZIP to desktop Find_It_NT_2K_XP.zip
Now you have the Find_It_NT_2K_XP folder extracted to desktop
Open the folder and double click on Find.bat
Let this run and finish, give it time
When it's done a log will be produced
Post the log back here please
[attachment=256:attachment]

Could you also open Hijackthis>>Open Misc tools section
Open Uninstall Manager
Click the SAVE LIST button
Save the list to desktop and then copy and paste the contents of it back here

[sohnir]

Here is the output file...
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Documents and Settings\meenavips\My Documents\Tools+Software\Find It NT-2K-XP

 ------- System Files in System32 Directory -------

 Volume in drive C is WINDOWS2000
 Volume Serial Number is 0A63-11FD

 Directory of C:\WINNT\System32

03/02/2000  11:01a      <DIR>          dllcache
               0 File(s)              0 bytes
               1 Dir(s)   2,600,689,664 bytes free

 ------- Hidden Files in System32 Directory -------

 Volume in drive C is WINDOWS2000
 Volume Serial Number is 0A63-11FD

 Directory of C:\WINNT\System32

06/08/2005  09:47p      <DIR>          nsvsvc
06/08/2005  09:47p      <DIR>          picsvr
03/02/2000  11:31a      <DIR>          GroupPolicy
03/02/2000  11:20a                 271 desktop.ini
03/02/2000  11:20a              21,692 folder.htt
03/02/2000  11:01a      <DIR>          dllcache
               2 File(s)         21,963 bytes
               4 Dir(s)   2,600,681,472 bytes free

 ------------ Files Named "Guard" ---------------

 Volume in drive C is WINDOWS2000
 Volume Serial Number is 0A63-11FD

 Directory of C:\WINNT\System32


 ------ Temp Files in System32 Directory ------

 Volume in drive C is WINDOWS2000
 Volume Serial Number is 0A63-11FD

 Directory of C:\WINNT\System32

12/07/1999  04:00a               2,577 CONFIG.TMP
               1 File(s)          2,577 bytes
               0 Dir(s)   2,600,665,088 bytes free

 ------------------ User Agent ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"iebar"=""


 ------------- Keys Under Notify -------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


 ------------- Locate.com Results -------------

No matches found.

 -------- Strings.exe Qoologic Results --------


 --------- Strings.exe Aspack Results ---------

C:\WINNT\system32\bmocnoq.exe: .aspack
C:\WINNT\system32\redit.cpl: .aspack

 -------------- HKLM Run Key ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe"
"Synchronization Manager"="mobsync.exe /logon"
"IBMPMSVC"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,\
  32,5c,69,62,6d,70,6d,73,76,63,2e,65,78,65,20,2d,68,65,6c,70,65,72,00
"XircWinModem4"="ltcm000c.exe 9"
"Promon.exe"="Promon.exe"
"SoundFusion"="RunDll32 cwcprops.cpl,CrystalControlWnd"
"PDIRECT"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\PDirect.exe"
"TP98UTIL"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\TP98.EXE /s"
"TpHotkey"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\tphkmgr.exe"
"PRPCMonitor"="PRPCUI.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"AUNPS2"="RUNDLL32 AUNPS2.DLL,_Run@16"
"A70F6A1D-0195-42a2-934C-D8AC0F7C08EB"="rundll32.exe E6F1873B.DLL,D9EBC318C"
"WinTask driver"="C:\\WINNT\\System32\\wintask.exe"
"98D0CE0C16B1"="rundll32.exe D0CE0C16B1,D0CE0C16B1"
"KavSvc"="C:\\WINNT\\System32\\vpnrkn.exe reg_run"
"WD Button Manager"="WDBtnMgr.exe"
"winupdtl"="C:\\WINNT\\System32\\winupdt.exe"
"Internet Optimizer"="\"C:\\Program Files\\Internet Optimizer\\optimize.exe\""
"empin"="C:\\WINNT\\System32\\Cache\\e121307.Stub.exe"
"Nsv"="C:\\WINNT\\System32\\nsvsvc\\nsvsvc.exe"
"picsvr"="C:\\WINNT\\System32\\picsvr\\picsvr.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"




[sohnir]

Here is the software list from Uninstall Mgr.

Ad-Aware SE Personal
Adobe Acrobat 5.0
AOL Instant Messenger
Canon Camera Support Core Library
Canon Camera TWAIN Driver 6.4
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon Utilities ZoomBrowser EX
ConfigSafe
Display Utility
DVDExpress
Google Toolbar for Internet Explorer
HijackThis 1.99.1
hp instant support
hp officejet g series
Intel SpeedStep technology Applet
Intel® PRO Ethernet Adapter and Software
iTunes
Jasc Paint Shop Photo Album
JGsoft EditPad Lite 5.4.0
Microsoft Office Professional Edition 2003
Palm Desktop and Synchronization Software
PC-Doctor for Windows NT
QuickTime
Related Page
Retrospect 6.5
S3 Gamma Utility
S3DuoVue Utility
Shockwave 7.0.3 Player
Spybot - Search & Destroy 1.3
TContext
ThinkPad Configuration
ThinkPad Information
Uninstall Access ThinkPad only
USB Storage Adapter FX_AT (WDC)
VNC 4.0
VPN Client
Western Digital USB Mass Storage Driver Installation
Windows 2000 Service Pack 3
Windows Media Player system update (9 Series)
WinZip
Wireless Network PC Card Configuration Utility
Yahoo! extras
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
Yahoo! Toolbar

[sohnir]

After after I ran LQFix.bat in SAFE mode yesterday, it appears that something is running in the background. There are little windows popping up and disappearing. Some remain on the screen until I kill it.
Thanks for your help.

[sohnir]

FYI, when I try to invoke Windows Media Player, it pops up a windows = "Browser Enhancer". I know it is not related to Microsoft. At this point, I just kill it. And I see that wmplayer.exe got overwritten on 6/1/2005. Hence; some spyware overwrite the wmplayer.exe. Is that a correct assumption?
Thanks.

[guestolo]

This will take a few tries to get you all clean
That's a correct assumption about wmplayer.exe...

Can I have you do the following please

==Download and Install this small program
to help clean your temp folders,cookies, etc...
Windows Cleanup
Give the link time to load or try it twice, it may be busy
Alternate Download link
We'll need this later

Access your Add/Remove programs via Control Panel
Remove these
Related Page
TContext

Afterwards,
Please Print this out or save these instructions to a Notepad file and save it to your Desktop
RESTART your Computer in SAFE MODE
You can do this by tapping the F8 key as the system is restarting, after the single post beep, or use the link
I supplied for a more detailed explanation

Set Windows To Show Hidden Files and Folders
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Uncheck the Hide Extensions for known file types
    * Click Yes to confirm.
    * Click OK.

Find and delete these files or folders if found, we'll still have to remove some others later, but try and remove these for now
FILES
C:\WINNT\tct101.dll <-file
C:\WINNT\System32\WinNB57.dll
C:\WINNT\System32\wintask.exe
C:\WINNT\System32\winupdt.exe
C:\WINNT\System32\Cache\e121307.Stub.exe

Search for these files and remove them if found, ensure you are additionally searching in hidden files and folders
E6F1873B.DLL
D9EBC318C
D0CE0C16B1
AUNPS2.DLL

FOLDERS
C:\WINNT\System32\nsvsvc <-this folder
C:\WINNT\System32\picsvr
C:\Program Files\Internet Optimizer

==Open Windows CleanUp!>>START>>programs>>Cleanup!
Click on the CleanUp button, let it finish scanning for files, when it's done
DECLINE to Log off when scan is done.

Do another scan with Hijackthis and put a check next to these entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINNT\tct101.dll
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\System32\WinNB57.dll

O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\System32\WinNB57.dll

O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [KavSvc] C:\WINNT\System32\vpnrkn.exe reg_run

O4 - HKLM\..\Run: [winupdtl] C:\WINNT\System32\winupdt.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [empin] C:\WINNT\System32\Cache\e121307.Stub.exe
O4 - HKLM\..\Run: [Nsv] C:\WINNT\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINNT\System32\picsvr\picsvr.exe

O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

After you have ticked the above entries, close All other open windows,
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

RESTART back to Normal mode

Back in Windows
Can you do the following please
Download the trial version of tds-3 anti trojan from here:
http://www.diamondcs.com.au/tds/downloads/...s/tds3setup.exe
Install it and Restart your computer when and if prompted
Don't run a scan yet

When your back in Windows it's important to update the latest RADIUS database

IMPORTANT>>>

Follow this link on how to update it>> follow the instructions carefully
http://tds.diamondcs.com.au/index.php?page=update
Use the Manual update procedure
Again, don't run a scan yet

After TDS3 is updated

Reboot back to Safe mode
Launch TDS-3. In the top bar of tds window click system testing> full systemscan.
Let it completely finish scanning---Even if it appears to hesitate at times
Give this time to finish
Detections will appear in the lower pane of tds window after the scan is finished  Right click the list> select save as txt.>> save this to a convenient location, I'll need to see it later

After saving the scandump.txt go ahead and right click the list of alarms again, this time select delete...only delete those with POSITIVE IDENTIFICATION

After you have removed the ones with postitive Identification

Restart back to Normal mode

After you have done the above
Post back the scandump.txt from TDS-3 file and a new Hijackthis log
Could you also let me know what other files you see in this folder
C:\WINNT\System32\Cache <-this folder

Could you also
download FindQoologic from here:
http://forums.net-integration.net/index.ph...=post&id=134981
UNZIP the contents within to desktop
Open the extracted folder and double click on Find-Qoologic2.bat
Wait for the log and post it back here

[sohnir]

As per your instructions, I removed the TContext and it went away. But the "Related Page" does not. It pops up a ad with radio buttons and when answering NO to each request; it does not de-isntall. What do I do with "Related Page". I think that's the one that shows up on IE on top of Google Bar.

I will perform the rest of the steps later today and post an update.
Thanks.

[Guest]

I performed all the steps you suggested. Here are all the dumps and the log files.

###  scandump.txt from TDS-3 ##############
Scan Control Dumped @ 05:46:22 10-06-05
RegVal Trace: Suspicious: HKEY_LOCAL_MACHINE
  File: Software\Microsoft\Windows\CurrentVersion\Run [KavSvc=C:\WINNT\System32\vpnrkn.exe reg_run]

Positive identification: TrojanDownloader.Win32.Small.akz3
  File: c:\temporary\aun_0015.exe

Positive identification: Trojan.Win32.StartPage.nk10
  File: c:\winnt\protector.exe

Positive identification: TrojanDownloader.Win32.Qoologic.o
  File: c:\winnt\system32\pkvqa.dat

Positive identification: TrojanDownloader.Win32.Qoologic.o
  File: c:\winnt\system32\vpnrkn.exe

Positive identification: TrojanDownloader.Win32.Qoologic.n1
  File: c:\winnt\system32\bmocnoq.exe

Positive identification (DLL): Adware.Toolbar.Mirar.a (dll)
  File: c:\winnt\system32\windmy.dll

Positive identification (DLL): TrojanDownloader.Win32.Braidupdate.d (dll)
  File: c:\winnt\system32\stlb2.dll

Positive identification: TrojanDropper.Win32.Agent.lu
  File: c:\winnt\system32\cache\installaps.exe

Positive identification: TrojanDropper.Win32.Delf.z4
  File: c:\winnt\system32\cache\helperinstall.exe

Positive identification: TrojanDropper.Win32.Small.wd
  File: c:\winnt\system32\cache\ssk3_b5 advagency.exe

Positive identification (embedded in file): TrojanDownloader.Win32.Small.abd
  File: c:\winnt\system32\cache\setup1024.exe

Positive identification: TrojanDropper.Win32.Agent.hl
  File: c:\winnt\system32\cache\setup1024.exe

Positive identification: TrojanDownloader.Win32.Apropo.ab1
  File: c:\winnt\system32\cache\cxtpls_loader.exe

Positive identification (embedded in file): Adware.Toolbar.Mirar.a (dll)
  File: c:\winnt\system32\cache\876004.exe

Positive identification (embedded in file): Adware.Toolbar.Mirar (dll)
  File: c:\winnt\system32\cache\876004.exe

Positive identification: TrojanDownloader.Win32.Qoologic.o
  File: c:\documents and settings\all users\start menu\programs\startup\nitd.exe

Positive identification: TrojanDownloader.Win32.Qoologic.o
  File: c:\documents and settings\meenavips\local settings\temporary internet files\content.ie5\pqrakcmw\2.8.7.4[1].exe

Positive identification <Adv>: Possible keylogger
  File: c:\documents and settings\meenavips\my documents\tools+software\ufwin\setuprw.exe

Positive identification <Adv>: Possible keylogger
  File: c:\documents and settings\meenavips\my documents\tools+software\ufwin\backup\setuprw.exe

Positive identification: Trojan.Win32.StartPage.nk10
  File: c:\program files\sdf_bad.exe

Positive identification: TrojanDownloader.Win32.Small.apm
  File: c:\program files\windows media player\wmplayer.exe

Positive identification (DLL): Adware.MiniBug (dll)
  File: c:\program files\aws\weatherbug\minibugtransporter.dll

Positive identification: TrojanDownloader.Win32.VB.eu
  File: c:\program files\fwbartemp_bad\searchbar.exe

################

[Guest]

#########  New Hijack Log ###########
Logfile of HijackThis v1.99.1
Scan saved at 6:45:41 AM, on 6/10/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Linksys\Wireless Network PC Card\NICServ.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\tp4mon.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\System32\Promon.exe
C:\WINNT\System32\RunDll32.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\PDirect.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\WINNT\System32\PRPCUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\System32\WDBtnMgr.exe
C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
C:\Program files\ThinkPad\Utilities\tponscr.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Linksys\Wireless Network PC Card\WPC11Cfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\System32\vpnrkn.exe
C:\Documents and Settings\meenavips\My Documents\Tools+Software\hijackthis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINNT\System32\stlb2.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINNT\System32\stlb2.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IBMPMSVC] %SystemRoot%\System32\ibmpmsvc.exe -helper
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SoundFusion] RunDll32 cwcprops.cpl,CrystalControlWnd
O4 - HKLM\..\Run: [PDIRECT] C:\PROGRA~1\ThinkPad\UTILIT~1\PDirect.exe
O4 - HKLM\..\Run: [TP98UTIL] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE /s
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [KavSvc] C:\WINNT\System32\vpnrkn.exe reg_run
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: DSW IPSec Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\Wireless Network PC Card\WPC11Cfg.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICSer_WPC11 - Unknown owner - C:\Program Files\Linksys\Wireless Network PC Card\NICServ.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

###################

[Guest]

c:\WINNT\system32\Cache <- Contents below
###################
dist006.exe
SmartDownload.exe
ven_d1.exe
weirdontheweb_ventura2.exe
################

These looks like a spyware....Should I delete them?

[Guest]

Here is the synopsys of all my runs on your suggestions in details:
1) I was not able to de-install Related Page from Control Panel -> Add/Remove s/w programs. It still exists there. It popus a ad window and does not delete unless I click one of their choices. How do I get rid of "Related Page"?
2) Not able to find C:\WINNT\System32\Cache\e121307.Stub.exe and hence cannot delete it
3) Cannot find D9EBC318C and hence cannot delete it
4) C:\Program Files\Internet Optimizer <- did not exist
5) In the final step before I ran the Find-Wooloci2.bat <- Normal start of after runninng the TDS-3; I got the following Windows message: RUNDLL -> Error loading stlb2.dll -> The speicified module could not be found
6) Lastly I am uploading the output of Find-Wooloci2.bat
Thanks again. Look forward to hearing for your feedback.

[Guest]

#### OUTPUT from Find-Qoolic2.bat ########


PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
some examples are MRT.EXE NTDLL.DLL.
»»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
* KavSvc  C:\WINNT\System32\VPNRKN.EXE
* KavSvc  C:\WINNT\System32\ZRGPIGB.DLL
* KavSvc  C:\WINNT\System32\SUPDATE.DLL
* KavSvc  C:\WINNT\System32\PUDCK.DLL
* aspack  C:\WINNT\System32\BMOCNOQ.EXE
* aspack  C:\WINNT\System32\REDIT.CPL
* UPX!  C:\WINNT\System32\VPNRKN.EXE
* UPX!  C:\WINNT\System32\ZRGPIGB.DLL
* UPX!  C:\WINNT\System32\SUPDATE.DLL
»»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»  

* exe  C:\docume~1\alluse~1\startm~1\programs\startup\NITD.EXE

»»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»»

(fstarts by IMM - test ver. 0.001) NOT using address check -- 0x77f8593c

Global Startup:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
 .
 ..
 AUTOCHK.LNK
 Acrobat Assistant.lnk
 DSW IPSec Client.lnk
 Instant Wireless Configuration Utility.lnk
 nitd.exe

User Startup:
C:\Documents and Settings\meenavips\Start Menu\Programs\Startup
 .
 ..
 HotSync Manager.lnk

»»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»»  

####################

[Guest]

There is still some residual stuff that I can see.
A "Registry Cleaner" ad just popped up.
Thanks again.

[sohnir]

All the updates above are done by sohnir; Sorry I forgot to login and I did not realize that it allows guest forum updates.