Svchost

[mark2]

you can untick

backweb,

MS office

ctfmon

Nwiz

NCpl

I also see 2 explorer perhaps untick one of thosethen reboot, once done maybe we should have a look at another start up list

[carnau]

ok i unchecked everything and here is my new startup

StartupList report, 9/7/2003, 4:13:23 PM

StartupList version: 1.52

Started from : C:\Documents and Settings\Administrator\My Documents\StartupList.EXE

Detected: Windows 2000 SP3 (WinNT 5.00.2195)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\dllcache\drivers\MicroSofts.EXE

C:\WINNT\system32\dllcache\drivers\MicroSofts.EXE

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\dllcache\drivers\bot\sysinfo.exe

C:\WINNT\system32\dllcache\drivers\raiden\raidenftpd.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\SYSTEM32\ServUDaemon.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE

C:\Program Files\Motherboard Monitor 5\MBM5.EXE

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE

C:\WINNT\System32\taskmgr.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINNT\System32\ctfmon.exe

C:\Documents and Settings\Administrator\My Documents\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon

AdaptecDirectCD = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

CreateCD50 = C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r

MBM 5 = "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"

zBrowser Launcher = C:\Program Files\Logitech\iTouch\iTouch.exe

Run32dll = c:\winnt\system32\WINClock.exe

Windows Explorer = C:\WINNT\ServicePackFiles\i386\explorer.exe

EPSON Stylus C62 Series = C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

LDM = C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

ctfmon.exe = ctfmon.exe

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {00041A26-7033-432C-94C7-6371DE343822}

CCHelper - C:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll - {0CF0B8EE-6596-11D5-A98E-0003470BB48E}

(no name) - (no file) - {146f854c-f46c-4d9e-b5fc-c1a76f76c2f2}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{11111111-1111-1111-1111-111111111111}]

CODEBASE = http://207.246.124.105/cabs/ROOSTRS3002/TPS108.cab

[Musicnotes Viewer]

InProcServer32 = C:\WINNT\Downloaded Program Files\mnviewer.dll

CODEBASE = http://www.musicnotes.com/download/mnviewer.cab

[shockwave ActiveX Control]

InProcServer32 = C:\WINNT\system32\Macromed\Director\SwDir.dll

CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab

[{26E8361F-BCE7-4F75-A347-98C88B418322}]

CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_50006/btiein.cab

[RdxIE Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\RdxIE.dll

CODEBASE = http://207.188.7.150/09169704652047f51d03/...ip/RdxIE601.cab

[ExentInf Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\exentctl_0_0_0_1.ocx

CODEBASE = http://us.games2.yimg.com/download.games.y...ctl_0_0_0_1.ocx

[HouseCall Control]

InProcServer32 = C:\WINNT\DOWNLO~1\xscan53.ocx

CODEBASE = http://housecall.trendmicro-europe.com/hou...all/Xscan53.cab

[Yahoo! Audio UI1]

InProcServer32 = C:\WINNT\Downloaded Program Files\yacsui.dll

CODEBASE = http://chat.yahoo.com/cab/yacsui.cab

[HouseCallButton.setup]

InProcServer32 = C:\WINNT\Downloaded Program Files\HouseCallButton.dll

CODEBASE = http://de.trendmicro-europe.com/file_downl...eCallButton.CAB

[installShield International Setup Player]

InProcServer32 = c:\winnt\downlo~1\isetup.dll

CODEBASE = http://www.installengine.com/engine/isetup.cab

[WebCam Control]

InProcServer32 = C:\WINNT\DOWNLO~1\ACTIVE~1.OCX

CODEBASE = http://webcamnow.com/broadcast/ActiveXWebCam.cab

[update Class]

InProcServer32 = C:\WINNT\System32\iuctl.dll

CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/...7604.4510069444

[shockwave Flash Object]

InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx

CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

[Yahoo! Webcam Viewer Wrapper]

InProcServer32 = C:\WINNT\Downloaded Program Files\yvwrctl.dll

CODEBASE = http://chat.yahoo.com/cab/yvwrctl.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll

WebCheck: C:\WINNT\System32\webcheck.dll

SysTray: stobject.dll

--------------------------------------------------

End of report, 7,034 bytes

Report generated in 0.050 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

[mark2]

And to further speed things up for you by disabling unneeded services Black Viper has some tips.

only disable a few at a time tho, so if you disable the wrong one you can back track easily

then we may find the processes list shorter too.

Going to do some more research on that start up list as cftmon and backweb are still starting :(

[Guest LB]

here is the official solution for ctfmon.exe

ctfmon.exe process removal

[mark2]

Thanks LB

[carnau]

man that thing is anoying.. i can't do anything with my system is at 100%

[mark2]

another virus in there

run32dll (1) = WINClock.exe > definition: MIRC worm variant

someone else pointed me to

Since Trojans are not really viruses, they may not be detected by a virus software and even if you remove a virus, the Trojan program can stay behind.

To check your computer for files that may compromise security, use the Windows Search features to look for the following Trojan Horse files on your hard disk drive:

wdll.exe

wdll32.exe

xdcc.ini

xdccreg.bat

dll.exe

whvldx.exe

servudaemon.exe

pipecmdsrv.exe

firedaemon.exe

iroffer.exe

taskmngr.exe

gg.bat

dll32.hlp

You can also use your Task Manager to check for the following processes:

iroffer.exe

whvlxd

system32.exe

servudaemon.exe

firedaemon.exe

These files may indicated a security breach and action should be taken right away.

found at http://www.miguelfra.com/services/document...ts/security.htm

I think you need to use a trojan scanner and a worm scanner, free Trials of WormGuard and TDS-3 are available here

and perhaps you can uninstall the Logitech software completely, with any luck Backweb will go with it... if you don't use the hotkeys.

you can also turn off mspmspsv.exe it's media player process you can turn it off by going to Start > Run > services.msc.

[mark2]

Further information has been offered regarding other things, which require you to download another utility, Hijack This

There is a tutorial page for Hijackthis Here with advice on how to use it.

The recommendations are to get rid of the following using Hijack this to disable them.

Start in safe mode to ensure that none of the programs are actually running.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Logitech Desktop Messenger.lnk

AdaptecDirectCD

CreateCD50

MBM 5

zBrowser Launcher

Run32dll = c:\winnt\system32\WINClock.exe

Windows Explorer

EPSON Stylus C62 Series

LDM

ctfmon.exe

Let Hijack this remove

{0CF0B8EE-6596-11D5-A98E-0003470BB48E}

(no name) - (no file) - {146f854c-f46c-4d9e-b5fc-c1a76f76c2f2}

The following ActiveX controls also need to go from your

C:\WINNT\Downloaded Program Files

[{11111111-1111-1111-1111-111111111111}]

CODEBASE = http://207.246.124.105/cabs/ROOSTRS3002/TPS108.cab

[Musicnotes Viewer]

InProcServer32 = C:\WINNT\Downloaded Program Files\mnviewer.dll

CODEBASE = http://www.musicnotes.com/download/mnviewer.cab

[{26E8361F-BCE7-4F75-A347-98C88B418322}]

CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_50006/btiein.cab

[RdxIE Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\RdxIE.dll

CODEBASE = http://207.188.7.150/09169704652047f51d03/...ip/RdxIE601.cab

[ExentInf Class]

InProcServer32 = C:\WINNT\Downloaded Program Files\exentctl_0_0_0_1.ocx

CODEBASE = http://us.games2.yimg.com/download.games.y...ctl_0_0_0_1.ocx

It has also been pointed out you no longer seem to have an antivirus or or firewall running.

I would recommend AVG Free edition for your antivirus and Sygate as your firewall

but have a look at Redhats post in the security forum for further ideas