Help! The F-secure antivirus can't rename or disinfect

MikeEinziger · Cadet Joined: Mar 29, 2004 Posts: 1 Location: Argentina

Hi, this is the first time that I used Hijack this. I did a virus scan with the F-secure and it found at least 6 different virus, trojan,dialer etc... but the infected files can't be disinfected or renamed.... so I decide to try Hijack this. Here's the logLogfile of HijackThis v1.97.7
Scan saved at 3:56:17, on 29/03/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FSMA32.EXE
C:\WINDOWS\SYSTEM\SCVHOST.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FSMB32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FCH32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FNRB32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FAMEH32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\ANTI-VIRUS\FSGK32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FIH32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\ANTI-VIRUS\FSSM32.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\COMMON\FSM32.EXE
C:\ARCHIVOS DE PROGRAMA\MSN MESSENGER\MSNMSGR.EXE
C:\ARCHIVOS DE PROGRAMA\F-SECURE\BACKWEB\7681197\PROGRAM\BACKWEB-7681197.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MIS DOCUMENTOS\PROGRAMAS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://best-search.cc/search.php?v=6&aff=2788105
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://best-search.cc/index.php?v=6&aff=2788105
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://best-search.cc/index.php?v=6&aff=2788105
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.orbitexplorer.com/cgi-bin/IE...&affid=1cj
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: OESearchHook Class - {341FB59F-3507-443b-8147-423B4E3B2B15} - C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\OE\SEARCH.DLL
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\SYSTEM\STOPZILLABHO.DLL
O2 - BHO: (no name) - {D48F2E28-68E2-4920-9848-D6E6C7AB3EB7} - C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\OE\REDIRECTOR.DLL
O2 - BHO: (no name) - {702AD576-FDDB-4d0f-9811-A43252064684} - C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\OE\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPIEBAR.DLL
O3 - Toolbar: &Search Toolbar - {702AD576-FDDB-4d0f-9811-A43252064684} - C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\OE\TOOLBAR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Overnet] C:\ARCHIVOS DE PROGRAMA\OVERNET\Overnet.exe -t
O4 - HKLM\..\Run: [MSStartOptimizer] C:\WINDOWS\SYSTEM\SCVHOST.EXE
O4 - HKLM\..\Run: [RegCompres] C:\WINDOWS\SYSTEM\REGCPM32.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Archivos de programa\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\RunServices: [fsaa] C:\Archivos de programa\F-Secure\Common\fsaa.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Archivos de programa\F-Secure\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [MSStartOptimizer] C:\WINDOWS\SYSTEM\SCVHOST.EXE
O4 - HKLM\..\RunServices: [RegCompres] C:\WINDOWS\SYSTEM\REGCPM32.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\ARCHIVOS DE PROGRAMA\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Global Startup: F-Secure BackWeb.lnk = C:\Archivos de programa\F-Secure\BackWeb\7681197\Program\backweb-7681197.exe
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Software (HKLM)
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc...wflash.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://download.rfwnad.com/cab/update.CAB
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/es/SysWebTelecom.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab...endada.cab
O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} (SysWebTelecom Class) - http://www.sponsoradulto.com/SysWebTelecom2.cab
O16 - DPF: ConferenceRoom Java Client - http://conectados.ciudad.com.ar/java/cr.cab
O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/scandl_cnry.cab
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} (IntDialerData Class) - http://www.grupomarineda.net/auto/DialerData.cab
O16 - DPF: {A3499961-A717-4C45-B08D-3D3B8B068AB5} (ADSLPlugin Class) - http://www.grupomarineda.net/auto/ADSLPlugin.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P...a_pack.cab
O16 - DPF: {5DF6FB84-749D-4AAE-AE37-708DE09B0588} (IntSfTx Class) - http://www.thismedia.com/dialers/dialnew.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/...1/chat.cab
O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.whenusearch.com/WUInstSEWC.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc...tor/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/...mv9VCM.CAB
O16 - DPF: {73F0FD85-BD47-4A95-86D1-DE38860462C1} (PremiumHTML Class) - file://C:\IberoDialerHTML.cab
O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://c:\windows\temp\demo.exe
O16 - DPF: {D7B3E460-9968-4191-BD6F-BEED1BC18482} (Loader Class) - http://www.orbitexplorer.com/OELoader.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

Thank you so much.

Marianna · Posted: Thu Apr 22, 2004 1:23 am Post subject:

Hi MikeEinziger

pls. run cwshredder first:

Be sure to close all browser windows before hitting the "Fix" button.

http://www.merijn.org/files/CWShredder.exe

Then rescan with Hijack This and post a new log please.


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 950 pages served in previous 5 minutes. Page Generation: 1.454 seconds.