Hacked Off

[mark2]

I'm totally p***ed off, got called to a comp this morning after AVG screamed with a virus infection.

C:\ADMAGIC.EXE I-Worm/Sinmsn.A

C:\SMB.EXE:\admagic.exe I-Worm/Sinmsn.A

C:\SMB.EXE:\msnzz.exe I-Worm/Sinmsn.B

Managed to clean it out.

PC has been known to have K***** downloaded sneakily in the past, so ran Kazaabegone, Spybot etc.

Then followed with Hijack this.

Logfile of HijackThis v1.97.3

Scan saved at 19:04:25, on 31/10/2003

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sygate\SPF\Smc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe

C:\WINDOWS\System32\pctspk.exe

C:\Program Files\FinePixViewer\QuickDCF.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\PROGRA~1\Grisoft\AVG6\avgserv.exe

C:\WINDOWS\system32\crypserv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Altnet\DOWNLO~1\ASM.exe

C:\WINDOWS\System32\P2P Networking\P2P Networking.exe

C:\Program Files\ESTsoft\ALZip\ALZip.exe

C:\Documents and Settings\Owner\Local Settings\Temp\_AZTMP1_\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1.1\SDHelper.dll

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\windows\googletoolbar_en_2.0.95-big.dll

O2 - BHO: (no name) - {CD03FC97-2C85-4714-A5FF-37821781BE8C} -

C:\WINDOWS\System32\sm5.dll (file missing)

O2 - BHO: (no name) - {F0D6289D-1462-44B0-ADDA-7DF1CCF11C0D} -

C:\WINDOWS\System32\sav12.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program

Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\windows\googletoolbar_en_2.0.95-big.dll

O3 - Toolbar: ????? - {D09CFF09-A42A-4EDC-9804-E61224F59CA1} - C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe

O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft

Works\WksSb.exe /AllUsers

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"

O4 - HKLM\..\Run: [RunEm] AutoDown.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft

Money\System\Money Express.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"

/background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [ENPY] C:\ENTICA\ENPPY\ENPPY.EXE

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program

Files\Microsoft Works\WkDetect.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Exif Launcher.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel

present

O8 - Extra context menu item: &Add animation to IncrediMail Style Box -

C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm

O8 - Extra context menu item: &Google Search -

res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmsearch.html

O8 - Extra context menu item: Backward &Links -

res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmbacklinks.html

O8 - Extra context menu item: Cac&hed Snapshot of Page -

res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmcache.html

O8 - Extra context menu item: Si&milar Pages -

res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page -

res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html

O8 - Extra context menu item: ³×À̹ö ±¹¾î»çÀü °Ë»ö - res://C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll /KR_DIC.HTML

O8 - Extra context menu item: ³×À̹ö ¹é°ú»çÀü °Ë»ö - res://C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll /S100.HTML

O8 - Extra context menu item: ³×À̹ö ¿µ¾î¡¤ÇÑ¿µ»çÀü °Ë»ö - res://C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll /E_DIC.HTML

O8 - Extra context menu item: ³×À̹ö Áö½ÄiN °Ë»ö - res://C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll /KBIN.HTML

O8 - Extra context menu item: ³×À̹ö ÅëÇÕ °Ë»ö - res://C:\Program

Files\NHN\NaverJump\NaverJump_1_5_1_5.dll /SEARCH.HTML

O8 - Extra context menu item: Äij»²¨ [³ÝÇϵå] -

java script:window.open("http://www.com.ne.kr/", "_blank", "");

O9 - Extra button: Related (HKLM)

O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O9 - Extra button: Money Viewer (HKLM)

O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.blueyonder.co.uk

O16 - DPF: Yahoo! Dominoes -

http://download.games.yahoo.com/games/clients/y/dot2_x.cab

O16 - DPF: Yahoo! Go -

http://download.games.yahoo.com/games/clients/y/gt1_x.cab

O16 - DPF: Yahoo! Literati -

http://download.games.yahoo.com/games/clients/y/tt0_x.cab

O16 - DPF: Yahoo! Pyramids -

http://download.games.yahoo.com/games/clients/y/pyt1_x.cab

O16 - DPF: {00001013-A15C-11D4-97A4-0050BF0FBE67} (NetmarbleStarter13 Class)

- http://www.netmarble.net/game/NMStarter13.cab

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {09516CA0-E0F8-11D3-84DF-00104B880ED4} (NamoWeCtl 1.0 (Daum)) -

http://files.hanmail.net/hanmail/HCOMPOSE/NamoWe.cab

O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) -

http://bestgogo.com/batang/vchat/MyLink.cab

O16 - DPF: {0CE1EA86-D322-11D7-A9D8-00104B1C8CEF} (Ctrl_online Control) -

http://hompy.dreamwiz.com/BIN/ocx/_online.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX

Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {1D69EA0F-F2EE-4127-B8E6-25D3E366F320} (ENTOI Web Messenger) -

http://images.entoi.co.kr/control/webtoi.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class)

- http://messenger.zone.msn.com/binary/MineSweeper.cab

O16 - DPF: {3283DF90-1733-4A79-B1F5-2D05A8E4D448} (HanGamePlugin15 Class) -

http://down.hangame.com/dist/activex/HanGamePlugin15.cab

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -

http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB

O16 - DPF: {345CA9DC-1600-4CD2-BFCF-7B57DD1A32DA} (NeoworkInstall Control) -

http://easyinstall.icons.com.ne.kr/easyins...workInstall.cab

O16 - DPF: {4BC4C3E9-2BBB-4F28-A449-D25CD323109B} (HGAgentClient Control) -

http://www.hangame.com/bar/HGAgentClient.cab

O16 - DPF: {53F55D30-56CC-4258-8617-4A9F48E7F572} (NexgramAPIClass Class) -

http://www.buddybuddy.co.kr/cab/nexweb.cab

O16 - DPF: {5468A766-6749-4EC5-8F7A-5D47EE8FE646} (ConnectControl Control) -

http://www.x2game.com/Control/ConnectControl.Cab

O16 - DPF: {57166EC5-7407-11D7-AB26-009008A06F27} (animo Control) -

http://ainmo2.com.ne.kr/animoProj1.cab

O16 - DPF: {66B30EA0-C033-4D4B-9F90-EA0AF07363AF} (BugsMediaPlayer Control)

- http://so.bugs.co.kr/BugsOggPlay_6.CAB

O16 - DPF: {6AD92401-CE2D-452B-AA63-1291D60EC2D2} (AxINIplugin40 Control) -

http://signup3.hanafos.com/initech/plugin/axINIplugin40.cab

O16 - DPF: {72ED8878-6E16-4EA1-BDD6-3B21EF676E45} (CVTrace Control) -

http://www.seevideo.co.kr/pub/cvideox/trace/cvtrace.cab

O16 - DPF: {7451A3DE-A83D-469D-977B-D7627EEA07DD} (FcCommCtrl.AlbumDropBox)

- http://home.freechal.com/etc/FcActivePacka.../FcCommCtrl.CAB

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/76808a0...all/xscan53.cab

O16 - DPF: {79419762-2D03-48F8-A63E-0544D95143DE} (AutoPatchOCX Control) -

http://www.x2game.com/Control/AutoPatchOCX.cab

O16 - DPF: {7E45E73C-EBB5-4530-B77D-4AF065ABD904} (VOSMessenger Control) -

http://down.musicnplay.com/cache/download/VOSMessenger.cab

O16 - DPF: {8284A6F2-146C-4B51-9C88-C60FD3E4494D} (ENTICA Class) -

http://ftp.entica.com/EnLaunch/EnLaunch.cab

O16 - DPF: {8CE940A9-9E80-4D2A-8CE1-643873DBEF62} (KiRiUpdater Control) -

http://file.kiri.co.kr/file/activeX/KiRiUpdater.CAB

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient

Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {9BE29407-5A4F-4F67-BBC1-1857D330446C} (Setup_CM Control) -

http://down.musicnplay.com/cache/download/Setup_CM.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/...7870.3728356482

O16 - DPF: {A87AC5C4-E4A8-421E-84C8-12A5564EAF2B} (NAudioX Control) -

http://download.netmarble.com/NAudioX/NAudioX.cab

O16 - DPF: {A977FF0C-8757-4E76-8533-482F91946233} (session Class) -

http://dl.sayclub.com/sayclub/sayctl/sayax.cab

O16 - DPF: {BF22698D-3BED-4CB0-BA3A-64534FBC32B1} (SVWebPlayer Control) -

http://www.seevideo.co.kr/pub/seevideo2002/SVWebPlayer.cab

O16 - DPF: {CF362BDB-4EA2-11D5-AB47-000102913414} (SetGlb Control) -

http://so.bugs.co.kr/SetGlb.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {D7F0CC2E-FB09-4B38-B9A7-6807CBCD4859} (NMChatX Control) -

http://download.netmarble.com/NMChatX/NMChatX.cab

O16 - DPF: {DDA887E8-E6E4-4D48-81E4-817DCA66B8FB} (NethardShort Control) -

http://icons.com.ne.kr/active-x/shortcut/n...rt/NetShort.cab

O16 - DPF: {E5F55B7A-89D5-4387-B665-43437B3E293D} (X2Run Control) -

http://www.x2game.com/Control/X2Run.Cab

O16 - DPF: {F0D6289D-1462-44B0-ADDA-7DF1CCF11C0D} (StealthObject Class) -

http://script.mine.nu/red1.php

O16 - DPF: {F256FF53-8057-4F7E-996B-963E27CE5EA1} (PdBox2 Control) -

http://www.pdbox.co.kr/filebox/ctrl_down/PDBox2.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class)

- http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} -

%SystemRoot%\System32\mshtml.dll

Where the f888 do I start !!! :smart: :angry:

2 regular users, both young girls, guests at the house. they've been warned about this crap but THEY KNOW BEST !!!

They've been warned (again).

The major problem for me is some of the c*** trying to access the net is in Korean language.

I'm fed up !!......

ps any help gratefully accepted

[Guest ellas]

reformat and be done,but its a lost cause as the crap will be on again as soon as they get back on the internet.

[mark2]

reformat and be done,but its a lost cause as the crap will be on again as soon as they get back on the internet

Yup they will be, I'm just trying to hold it all together until they go or see reason :angry:

I'm trying to find some way of locking it down but short of pulling the plug or watching them constantly I know I'm fighting a losing battle, but the owner just may put his foot down now.

I live in hope !!

[Boris]

You could just disconnect the H/D until they've gone ? :D

[mark2]

Hopefully they will go home for Xmas, 1 to Korea & 1 to Canada, then it's Blitz time and I may have found a way to lock the comps down by the time they get back.

or steal the keyboards and mice :rolleyes:

[-pops-]

2 regular users, both young girls, guests at the house. they've been warned about this crap but THEY KNOW BEST !!!

They've been warned (again).

Obviously not enough control or discipline around. Young girls?? My arm! She-devils more like.

Everyone who uses any of my machines knows that messing about downloading anything, anything at all, without my specific permission can say goodbye to their fingers. Anyone still thinking it's OK has a very short life expectancy.

[andsome]

2 regular users, both young girls, guests at the house. they've been warned about this crap but THEY KNOW BEST !!!

They've been warned (again).

Obviously not enough control or discipline around. Young girls?? My arm! She-devils more like.

Everyone who uses any of my machines knows that messing about downloading anything, anything at all, without my specific permission can say goodbye to their fingers. Anyone still thinking it's OK has a very short life expectancy.

I couldn't agree more. Mark do you do this for a living? If so why not tell the computer owner that if he wants all this lot removing, he will have to pay for a full format and reinstall on each occasion?

[mark2]

-pops-

The young girls are exchange students, we can't discipline them as such, threats of chopping hands off may work.

andsome

thankfully I don't do this for a living, :D but the owner of the comp is my boss so I do get paid for it when I have to spend time away from the workshop fixing these things. It's a lot cleaner than MOT'ing or welding :D the 2hrs away cost him £50 in my lost work tho.

I think he's finally had enough of the rubbish being downloaded now tho and will be putting his foot down, especially since worm_mimail_A turned up after I'd cleared those viruses there already. And a link to a sex site :smart:

Just got to learn Korean now so I can check what her home page is set to :wacko:

[-pops-]

Everyone should have respect for other people's property, no matter which country they originate from.

What sort of girls are they?

When we've had exchange students staying here in the past, we were required to write a report about them and send it back to their school/college. This alone was enough for them to at least show us some deference in regard to their behaviour. Are these reports no longer required?

It's a very sad reflection on today's youth and modern discipline-free, namby-pamby upbringing where dissent and vandalism is the norm.

:( :( :( :( :( :( :( :(

[andsome]

Everyone should have respect for other people's property, no matter which country they originate from.

What sort of girls are they?

When we've had exchange students staying here in the past, we were required to write a report about them and send it back to their school/college. This alone was enough for them to at least show us some deference in regard to their behaviour. Are these reports no longer required?

It's a very sad reflection on today's youth and modern discipline-free, namby-pamby upbringing where dissent and vandalism is the norm.

:(  :(  :(  :(  :(  :(  :(  :(

Couldn't agree more.

[mark2]

Sorted now, I think.

Had a heart to heart with the young lady too, promises not to download anymore junk, we'll see.

More protections now in place . ^_^

[Guest Grim Reaper]

promises not to download anymore junk

promises are made to be broken!!!!!!