god damn spyware

[lancer]

no i never went to any crack sites never used any key generators or anything like that. and never downloaded anything, ok disabled prefetch and cleaned it out, also deleted all i could find but when i delete nail.exe, it just appears again in c"/windows about 10 secs later. any suggestions also that aurora program just wont go away.

 

[muzikool]

nail.exe is part of the aurora program. You might know that already but it wasn't completely clear to me.

I found a very comprehensive thread for this. There are quite a few suggested solutions so you might try each one until it's taken care of.

http://www.broadbandreports.com/forum/remark,13337560~mode=flat~days=9999

 

[yoyo]

First unzip HijackThis to its own folder. Don't run it directly from the zipfile.

Download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions. Don't run a scan yet.

Download Nailfix from here:
http://users.pandora.be/bluepatchy/nailfix.zip
Unzip it to the desktop. Don't run it yet.

Reboot into safe mode (hit F8 when Windows starts). Log in to your usual user account.

Doubleclick on nailfix.bat. Your icons and desktop will dissappear and reappear - this is normal.

Next run Ewido. Perform a full scan.

Run HijackThis again, put a checkmark next to the following items and then click Fix Checked:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [tF4f3nS] pifupapi.exe
O4 - HKLM\..\Run: [xchgil] c:\windows\system32\otgbctq.exe
O4 - HKCU\..\Run: [covpRhe3W] penecsnp.exe
O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0033.exe

Restart into normal mode.

Go to this site http://virusscan.jotti.org/ and have it check the following files:
C:\WINDOWS\system32\pifupapi.exe
C:\WINDOWS\system32\penecsnp.exe
c:\windows\system32\otgbctq.exe

Post the result along with a new HijackThis log please.

 

[muzikool]

Hey yoyo, good to see ya! Nice job!

 

[lancer]

heres the log the virus website could not find any of those files you asked, so i assume i deleted them for good this time. nail.exe seems to have permanantly dissapeared too.


Logfile of HijackThis v1.99.1
Scan saved at 3:39:47 PM, on 5/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cidaemon.exe
C:\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116248085045
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Before i did all you said yoyo, i manually searched and deleted all the perps, and that seemed to work, but i also did what you said, the comp seems to be 100% free, i hope, thanks for all your help guys. thanks yoyo

 

[yoyo]

Your HijackThis log is clean.

 

[Perris Calderon]

^^^^^
/love that guy

 

[lancer]

thanks yoyo. learnt a lot about spyware removal today,

 

[NetRyder]

^^^^^
/love that guy

I agree!

 

[muzikool]

Yep, he comes out of the shrubbery, fixes something, then disappears again.

 

[Johnny]

the best thing to do is delete the partition, and recreate it before putting reformating. Most cases when you do a restore you are just over writing files and not deleting very many.

 

[muzikool]

He did a reformat, not a restore.

 

[LeeJend]

I'm still wondering about the root cause.

Any chance another machine on the LAN at work could have infected the one you reformated Lancer? Malware is getting smarter.

 

[Johnny]

He did a reformat, not a restore.

If he did the reformat properly, then, he should not have any probs now ...

 

[Kush]

use avg antivirus not norton it sucks

 

[muzikool]

If he did the reformat properly, then, he should not have any probs now ...

The issue was probably with connecting to the network before installing security software, or installing software that was infected with the spyware. Seems like we're running in circles here with the speculation...

 

[lancer]

i think the issue was i went on the internet, BEFORE i updated the windows or my anitvirus, allowing the suckers free rein of my pc.

is avg antivirus free? and is it as good as norton or better?

 

[VenomXt]

avg free is free. and works well i use norton on one machine and avg on 2 others never had a virus on anyonf them.

 

[Kush]

yeah much better than norton

 

[Mastershakes]

Unless you have access to Norton Corporate. Very light on the system, provided it's set up right.

The Norton personal suites are so bloated... perhaps they've improved, I gave it up in 03 and put AVG on the home PC.