Unable to remove trojans and viruses

Hello,
Do you have any anti-virus software?

I hate to give you a link to just another spyware removal software...
but that's what I'm going to do :)

Have you used MS Anti-Spyware?
It seems to be doing a far better job than the rest (for right now )
As with all software be sure to do an update before you run a Full scan

http://www.microsoft.com/athome/security/spyware/software/default.mspx

click start >> run >> msconfig
Now go to the startup tab.
Let us know what start-up items are checked that you are not familiar with.

If you don't have anti-virus software that has recently been updated
here is a free online one

HouseCall
http://housecall.trendmicro.com/


If you don't have anti-virus software at all here is a free
one you can download once everything gets cleared up.
( Chances are the install will fail if you have an infection but you can try it)
AVG
http://free.grisoft.com/freeweb.php/doc/2/

Thanks for the quick response mdiglio.  Here's where I'm at with the msconfig.  I was able to verify some of these at a site called bleepingcomputer.com.  Here's what I found:

Here is a list of what the site considered to be malware/trojan/adware.  Just not good to have running in general -

CSv10P070
wsxsvc
vmss

These are some additional ones listed in startup that didn't get a hit on the site but still look weird to me -

hhtfvc
kkblzc
Zgprgh
loae
hpcmpmgr

I also had one startup item that was simply named "none".  The command also simply said "none".  It didn't get a hit on the site but does seems unusual.  Do I just disable them as a startup item?  If so once disabled will the various software apps detect and delete them?

One other question for now regarding the detection of the malicious files.  Is it unusual for a file to "disappear" or not be detected once it is picked up by anti-virus software?  One of my issues with this is that my Mcafee will "detect" a virus but the file will not be able to be deleted or cleaned.  When I search my drive for the file in question it's nowhere to be found.

Let me know what you think.

oops...I gorgot to tell you to disable system restore when you are doing your scans
right click my computer >> propeties >> system restore tab >> click 'turn off system restore'

I will look at those processes and get back to you

You can uncheck them from msconfig

you might also have to go into the registry start >> run >> regedit
expand hkey_local_machine\software\microsoft\windows\current version\run
and delete those entries especially the 'none' one

Hold off on doing that just yet though.
Is your Mcafee up to date ?

hpcmpmgr seems to be the only legit one

Have you run hijackthis and then posted the log file here?:
http://www.hijackthis.de/

If not do so.
the latest version of hijackthis can be downloaded here:
http://www.spychecker.com/program/hijackthis.html

Before we start doing anything else, have you ran a full scan with MS Antispyware yet ?

I'll disable the system restore.  I think I've done this previously but I'll verify.  I'll also uncheck the nasties from msconfig but hold off on deleting anything from the registry.

Yes the AV is up to date.  It automatically updates daily now that DATs are available that often.

In the post from greyknight17 I was also asked to run hijackthis and post the link to the analysis.  Here is the link:

http://www.hijackthis.de/index.php#anl

For some reason my actual log did not carry over to the analysys page.  Let me know if you would like me to post that rather lengthy text file here.

Thanks for the help so far and keep me posted.

First off to greyknight17 I'm sorry about repeating what you said.
I must have went right to the bottom and started reading...never saw yours :(

bullseye17 , We can't see anything from that link.
After you post your log > click anaylze > then scroll down to see the results
If still no joy then yes you can post it here

Let me at least post the text from the log file here.  I was going to post the analysis that I saved but the HTML looked sort of ugly when I attempted to paste it here.  Is there any way for me to attach a file to be uploaded?  I may signing off for the evening but I'll probably check back when I can't sleep :-)

Anyway - here is the text.  And the link I used to have it analyzed from greyknight17's original post is reprinted here:

http://www.hijackthis.de 

Logfile of HijackThis v1.99.1
Scan saved at 10:37:27 PM, on 2/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
D:\Program Files\Network Associates\VirusScan\VsStat.exe
D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
C:\WINDOWS\System32\vmss\vmss.exe
C:\WINDOWS\System32\Zgprbh.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Network Associates\VirusScan\Vshwin32.exe
D:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\n?tepad.exe
C:\Documents and Settings\Rich\Application Data\loae.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
D:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
D:\Program Files\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Documents and Settings\Rich\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll (file missing)
O2 - BHO: (no name) - {017C20C1-F86F-11D8-9B25-000ACD002AE3} - (no file)
O2 - BHO: (no name) - {066FB6E7-7300-07FF-7D80-2187ED82EA9F} - C:\WINDOWS\System32\ffrjv.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SDWin32 Class - {8B45261C-DFBF-4889-B9CA-A7C33C379183} - C:\WINDOWS\System32\kkblz.dll
O2 - BHO: SDWin32 Class - {A73CEB99-6179-4694-A3AE-073B5DBFAB42} - C:\WINDOWS\System32\hhtfv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [HP Software Update] "D:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "D:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [hhtfvc] C:\WINDOWS\System32\hhtfvc.exe
O4 - HKLM\..\Run: [kkblzc] C:\WINDOWS\System32\kkblzc.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Zgprbh.exe
O4 - HKLM\..\Run: [eTrust PestPatrol Active Protection] none
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Hfwiy] C:\WINDOWS\System32\n?tepad.exe
O4 - HKCU\..\Run: [Oteo] C:\Documents and Settings\Rich\Application Data\loae.exe
O4 - Startup: HotSync Manager.lnk = D:\Program Files\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2832d7dabce82591a700/netzip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106450693937
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/PPInstaller.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - D:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - D:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

This file is a friggin' virus....... I've dealt with it before, I understand your fustrations, this thing is evil, hard to get rid of...

spoolsv.exe is pure evil

C:\WINDOWS\system32\spoolsv.exe


below files are CRAP!
C:\WINDOWS\System32\Zgprbh.exe
C:\WINDOWS\System32\n?tepad.exe

Delete these three files, boot into safemode, run full system scans, and when finished, pull the power cord out of the wall and force a hard shutdown!!! This spoolsv.exe lives in the memory...

Mugman

Here's an update on where I am with this -

Mugman - Thanks for the heads up on spoolsv.exe but that file is actually OK as long as it is found in c:\windows\system32.  It's when you find it in root, c:\windows or c:\winnt that it becomes a problem

That being said I think the worst of it is actually over.  I can actually open an IE session without being inundated with crippling popups.  Here's what I think I need to be able to close this question out.

One of the things I did was disable a number of entries in the startup tab of msconfig. But how do you delete these entries from startup completely? Directories?  Are there registry entries that I need to delete?  What do I do?

Also - What is the deal with 2o7.net????  This critter shows up constantly in pestpatrol scans after reboots.  I can't get it to be gone no matter what.

Let me know if that's just the way it is sometimes.  Am I expecting too much to be 100% free of this crap?  Or is it just a reality of having a broadband internet connection that you just can't keep everything out anymore?

I'm sure I have additional to-do's to get this done but I can't think of them right now.

Hello,
No you're not expecting too much...100% removal is a good thing.

Yes for the startup items you can go into the registry like we discussed earlier
start >> run >> regedit
expand hkey_local_machine\software\microsoft\windows\current version\run

for the 207.net delete cookies from IE.
Then you should set the privacy settings to medium. tools >> internet options >> privacy tab

using notepad open your host file located here..c:\windows\system32\drivers\etc

If your host file is clean you should only see one entry
127.0.0.1       localhost

add this entry beneath that one
127.0.0.1     102.112.2o7.net

that address and many more 207.net addresses can be found here:
http://someonewhocares.org/hosts/

bullseye17,

You say there is a legit file called spoolsv.exe ? I've only encounter this as a virus, if you say this file is legit, what software does it come with? Any Idea...

Mugman

bullseye17,

Sounds like you've gone through a lot of effort to fight this one.

Words of wisdom for next go around (because you'll get hit again).

Backups...make a default configuration backup (use Ghost or TrueImage) then have incremental backups.

Most nasty infections come from custom malware/spyware that no tool can locate and remove.  Folks these days are writing custom backdoors and trojans.

Fight the good fight when it seems beatable, but for this instance it probably would have taken you 15 minutes to Ghost your good image and 20 minutes to recover from your incrementals...

I wrote a guide that may help you next time:
http://spaces.msn.com/members/greyhat/Blog/cns!1pUk7QRF4x9-c8NiDSc_ZYKg!129.entry

HTH

mugman21 - spoolsv.exe is a legitimate windows service found in c:\windows\System32 that is responsible for managing spooled print/fax jobs.   There are viruses, trojans etc that are written with the same filename though.  Like I said earlier the bogus files would be found elsewhere.  Most typically they would be located in c:\, c:\windows or c:\winnt.

Phil - Yes this has been quite an ordeal.  :-( Thanks for the heads up.  I'll have to check out your guide.

mdiglio - Deleted any remaining cookies on the system.  Privacy was already set to Medium so I raised it to Medium - High.

I also went to delete the startup entries from the registry but they were not there at all.  But there are still in the startup - just disabled.

And for the hosts file I don't understand what adding the address to my hosts is supposed to do.  Won't that just point the traffic from that address to my PC.  I just need to understand it a little better.

That's it for now.  Still pluggin' away!!

Hello,
putting that entry in the host file will tell your browser to go to the address 127.0.0.1 the next time it is told to access the 207.net site.
This will redirect it to your machine and come back as a page not found error.
To test it out you can add this line to the host file then go to the google website
127.0.0.1      www.google.com

Basically it will prevent you from ever going to that page again

OK.  I get it now.  Thanks.

Now what about getting those entries out of the startup?  Any ideas since there weren't any registry entries?

Hello,
See if these keys works for you


[HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKLM\SOFTWARE\Microsoft\SharedTools\MSConfig\startupfolder]

Clean-up the MSCONFIG startup tab listings - Windows XP
http://windowsxp.mvps.org/MSCONFIG.htm

Hello,

Getting ever closer to the end of this question.  I've been able to remove those entries from the startup.  The only thing still bothering me about this is that I still constantly get items found when running my scans.

Basically what I do is scan, clean what's found, reboot and then scan again.  The biggest mystery to me right now is that #%$%@% 2o7.net.  I added every entry for that address from the link at someonewhocares.com and the cookie still shows up on every scan.  But when I ping the address in the cookie I get my loopback address just like I should.

The other thing I was wondering about is this - If I boot into safe mode and run Spybot I get no nasties found.  If I reboot and run another scan it finds one or two items though.  That seemed a little strange to me.  Maybe I'll try another one of the tools available.  I haven't tried the MS app yet.  Although I have run Ad-Aware, Spybot, HijackThis and PestPatrol.

Let me know if you think there's anything else I can do.

OK.  This just in......

So what I just did was restrict third party cookies.

Tools --> Internet Options --> Privacy.  In the settings I went to the Advanced area and selected to prompt me when third party cookies wanted to be installed.

Sure enough I started to see requests from 2o7.net, DoubleClick and others.  I'll probably leave the setting on prompt until I'm no longer fascinated with just how many requests come in and then change it to block third party cookies.

Do you know of any downside to doing this?

Was it set to Medium under the Privacy tab?

I don't see any downside except that you will be prompted each time when these third party cookies want to be installed.  Is your HijackThis log clean now?  If not, give us a link to your log at http://www.hijackthis.de

The setting was originally set to Medium and I changed it to Medium-High but I was still getting items that were showing up when running a scan.

So I went to the Advanced button in the Privacy settings tab and I was able to block/allow/prompt on First or Third party cookies.  I saw that there was also an option to always allow session cookies that appears to be disabled by default.

To be honest I'm not sure what a session cookie is so I left that alone.  I did change the Third-Party cookie option to prompt though just to see what sites were trying to place a cookie.  So far I've only seen traffic from adware sites or from some site that wants to solicit me for something.

I'll scan again with HijackThis and let you know what happens.

btw - I'm thinking that my problem may be resolved I guess I'm just not sure of the impact is if I block all third party cookies.

OK, give us the new link to your log when ready.

You shouldn't block all third party cookies.  Some sites will need to use these cookies to allow you access to login.  If you block them, you might not be allowed to login at all.

The HijackThis log is clean.  Yeaaaaaa!!!!  All scans with the other tools are actually coming back clean as well.  My understanding of the third party cookies is that they are coming from a site other than the one that I am currently at.  I'm going to try a few of the sites that I frequent to see if the changes affect anything.

Glad to hear it...sorry I was away from email for the weekend

I'm soooooo sorry for taking so long to get back to this and post as resolved.  Not my usual MO.  Thanks to mdiglio and greyknight17 for sticking through this and helping me out so thoroughly.  Additional thanks to everyone else who pitched in.  I can't begin to express my thanks for the help.  It was a real pain and the effort put forth just shows how great this site is.  Thanks again to all!!