PDA

Click to See Complete Forum and Search --> : Hijacked!

tcroteau
September 28th, 2006, 08:32 PM
Hello,
I've been hijacked. I cannot open regedit, my antivirus software locks up (ViursScan Enterprise 7.1.0) and my spyware apps lock up as well (ad-aware, spybot).

When I surf the web, google links go to bogus pages. Task Manager doesn't allow me to end processes. I have to "shut down" and turn my computer back on to allow it to boot.

WinXP Pro

Here's my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 7:00:30 PM, on 9/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.mc.xerox.com:8000
O1 - Hosts: 127.0.1.32 xww.isrve.world.xerox.com
O1 - Hosts: 127.0.1.19 mc0300uv007.apps.mc.xerox.com
O1 - Hosts: 127.0.1.12 hrapps.xpn.xerox.com
O1 - Hosts: 127.0.1.23 download.mainframe.xerox.com
O1 - Hosts: 127.0.1.20 wb0300ux118.mc.xerox.com
O1 - Hosts: 127.0.1.17 emax45.apps.mc.xerox.com
O1 - Hosts: 127.0.1.26 eng.mc.xerox.com
O1 - Hosts: 127.0.1.16 xww.emax.world.xerox.com
O1 - Hosts: 127.0.1.18 www.mainframe.xerox.com
O1 - Hosts: 127.0.1.27 miaps-web1.mainframe.xerox.com
O1 - Hosts: 127.0.1.15 hrapps5.xpn.xerox.com
O1 - Hosts: 127.0.1.28 miaps-web2.mainframe.xerox.com
O1 - Hosts: 127.0.1.29 miaps-web3.mainframe.xerox.com
O1 - Hosts: 127.0.1.21 xww.thefic.xerox.com
O1 - Hosts: 127.0.1.30 miaps-web4.mainframe.xerox.com
O1 - Hosts: 127.0.1.10 mc0300ux190.apps.mc.xerox.com
O1 - Hosts: 127.0.1.22 xww.purchase-net.world.xerox.com
O1 - Hosts: 127.0.1.24 onpprod.apps.mc.xerox.com
O1 - Hosts: 127.0.1.11 www.xpn.xerox.com
O1 - Hosts: 127.0.1.13 hrapps3.xpn.xerox.com
O1 - Hosts: 127.0.1.31 www.etime.xerox.com
O1 - Hosts: 127.0.1.14 hrapps4.xpn.xerox.com
O1 - Hosts: 127.0.1.25 xww.edits.world.xerox.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {A27C203D-8C60-11D3-AA4E-0000C0D98DCF} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwcc.ops.placeware.com/etc/place/CHAIR/VACpws-c2/5.1.8.511/lib/quicksilver.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://press-sense.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{10C5001A-7EDC-4E95-A1B0-C740A86422F3}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{65F7A501-1EAF-4A6F-974A-21259059E26B}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{78640DCA-CED3-41C0-AB36-90F85349F545}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.42 85.255.112.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{10C5001A-7EDC-4E95-A1B0-C740A86422F3}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.42 85.255.112.20
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

Any help would be greatly appreciated.

Tom
lgbpop
September 28th, 2006, 10:50 PM
Hi Tom, welcome to VirtualDr.http://www.taurusclub.com/forum/html/emoticons/WELCOME.gif

Run HiJackThis and click Scan, then check the boxes next to the following, if present:

O2 - BHO: (no name) - {A27C203D-8C60-11D3-AA4E-0000C0D98DCF} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{10C5001A-7EDC-4E95-A1B0-C740A86422F3}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{65F7A501-1EAF-4A6F-974A-21259059E26B}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{78640DCA-CED3-41C0-AB36-90F85349F545}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.42 85.255.112.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{10C5001A-7EDC-4E95-A1B0-C740A86422F3}: NameServer = 85.255.114.42,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.42 85.255.112.20
...(These are Ukrainian IP addresses and are highly suspect.)


Now, with all windows closed except HiJackThis, click fix checked.

Next, reboot into Safe Mode and try running AdAware again; assuming it runs in Safe Mode, save the report to your desktop. Reboot when finished into Regular mode, then run HJT again; post the fresh scan log and the AdAware report back here.