The symptoms are as follows
- Homepage changed in IE6 to C:\spex\start.html
- Icons on my desktop with an X on it called "default" or "-- The nicest hobby on Earth ;) --"
- Random 4-letter ".dat" files (in the C:\Documents and Settings\%USERNAME\Local Settings\Temp folder) trying to connect to the internet. I have opened one in notepad and added it to this post for you to see what it does. BTW, I have ZoneAlarm and that catches the files trying to access the net: it says "llki.dat [or any 4 letters followed by .dat] is trying to access the Internet."
- Pop-ups occur that look like system "exclamations". They are a side-effect of the .dat files and if you look at the one in this post you will see what they can say.
- Once a toolbar came up at the top of the screen called "World Wide Web" with 2 search boxes. One called "Search:" and directly you to wowweb.com and the other "Surf:" and directed you to msn.com. Weird....
Note about the HijackThis log: the first 2 R0's are www.google.com. I HAVE NOT set this as my homepage: i have set it as www.google.co.uk. In addition, i have posted this log recently after trying to remove a few things so if I post another one in reply later on, it may be different.
This is the Hijack This log:
========================
Logfile of HijackThis v1.97.7
Scan saved at 12:58:27, on 27/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Utilities\NProtect.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\System32\Launcher.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\AKT\My Documents\Downloaded\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.myexexex.com/searchbar.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.myexexex.com/search.php?said=spage&qq=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/broadband
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\System32\Launcher.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/broadband
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...7952.6449537037
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by17fd.bay17.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF300152-0CAF-465C-B301-754FA5D7D88E}: NameServer = 212.74.114.129 212.74.114.193
============END OF LOG==========
Now this is the .dat file in text format:
============START OF .DAT FILE======
MZ @ !L!This program cannot be run in DOS mode.
$ G)E)E)E(E)E"tE)E"E)ERich)E PE L @ 0 @ 0 d | .text v
8 (
& @ V b | p Z "#%&' 0@ $@ @ @ @ @ @ @ @ tibsystems. statsbank.com boards.cexx.org adultwebmasterinfo.com spywareinfo. dialerschutz.de webmasterworld.com crutop.nu gofu**yourself.com FindCloseUrlCache FindNextUrlCacheEntryA FindFirstUrlCacheEntryA wininet.dll COMSPEC " " .bat /c @echo off
:start
echo > %1
del %1
if exist %1 goto start
del %0
http://www.wowweb.net/search.php?said=pmcap4&q=party%20poker The $1 MILLION GUARANTEED PRIZE IS WITING FOR YOU!!! Do you wish to apply for it with our -- Look for another playground --s?
Note: by clicking YES you confirm, that you at least 21 yr. old. Internet Explorer: $1000000 Guaranteed Prize http://www.wowweb.net/search.php?said=pmcr...yware%20removal http://www.wowweb.net/search.php?said=pmcr...dware%20removal Your computer may be infected with Trojan Horse Virus!!! Do you wish to remove it? Internet explorer:Trojan Horse ALERT! open http://www.wowweb.net/search.php?said=pmca...0spyware%20scan SOFTWARE\Microsoft\Internet Explorer\Main\Config cid The following SPYWARE was detected on your computer:
IETray
IEAccess/IEDial
MoneyTree
Xrenoder
IEDll
Gator
SVAPlyer
You need to perform the FREE SPYWARE SCAN In order to keep your computer functional!!! Caution:Spyware Trojan Horse ALERT! Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {8403CB53-12B3-4537-9DEC-4F12F70A883D} CLSID SVh@ 2T@ tiW=X@ hp@ VhX@ V @ hD@ V @
@ @ _t0
@ t&t" t& tV`@ ^[2V`@ ^[ÐSUVW=p@ j j u_^]2[Í P6 u_^]2[UV;tU8 2_^][3ۅ~(3ftQh|@ uC;|U _^][QSVWh D$ D$ PWj @ t]@ @ t WQR u%FuD$ D$ PWS @ tWm 2_^[YS @ WV _^[YÐD$@ t&8 t!L$ QPL@ tPP@ @ 2@ ÐQS\$ UVWSh @ 5@ SD$ |$t P։D$,8D$ D$,8|$t$ tL$ʃ,@ ЀaFIuD$ MPQ H@ S!u_^][YÐL D$LVW@ |$ fh@ PH@ j L$[h@ Q T$Wj h jj j h @R0@ D$j PL$jFQV\@ V(@ 5$@ T$Th@ R֍D$Th P@ $\ LXQR @ D$Th@ P֍$T h Qh@ @ j T$Xh @ $\ RPj j h@ _^L ÐQ:uj j 8@ SUV5 @ D$ WPh? j h@ h = @ h@ L$QT$R@ D$Ph? j h@ h h@ L$Qj4h\@ h@ j t@ =$@ h@ uWh h v Uh@ hX@ h h@ Vj j j Vh @ j V^ UX h 4@ j4h@ h@ j t@ uWh h Uh@ hX@ h D hP@ Vj j j Vh @ j V U h' 4@ j4h\@ h@ j t@ uWh h Uh@ hX@ h h @ Vj j j Vh @ j Vh Ub h' 4@ jh@ h8@ j t@ uWh h Uh@ hX@ h N h@ Vj j j Vh @ j V U j j 8@ _^][QL$ T$SUVD$ W3PjVQR2ۉt$$ @ u^|$ L$-@ D$ PVVVWQt$4ՋD$ ;t8PK T$ D$RVj j WPՅuL$$VQH@ V< D$tP@ _^][YÐD$Pj@@ P<@ ÐD$Pj @@ PD@ ÐSVD$ W|$? t9t1ҋt +t +u TAu9 t
P@u3_^[ÐL$T$t :tAAuS3:H[#Ð 8 p $ L j h
8 (
& @ V b | p Z FreeLibrary GetProcAddress HLoadLibraryA FindClose FindFirstFileA lstrcpyA GetTickCount lstrlenA GetTempPathA PGetEnvironmentVariableA uGetModuleFileNameA lstrcatA . CloseHandle WriteFile M CreateFileA ISleep ExitProcess HeapAlloc GetProcessHeap HeapFree KERNEL32.dll #GetKeyboardLayoutList MessageBoxA USER32.dll RegCloseKey RegDeleteKeyA RegOpenKeyExA RegQueryValueExA ADVAPI32.dll ShellExecuteA SHELL32.dll
===========
If someone would PLEASE help - all hope has failed elsewhere.
Most gratefully,
AKT. :(