Trojans Again

[DemonStar55]

well my sisters are experts at gettign trojans so I need some help again

Logfile of HijackThis v1.99.1
Scan saved at 11:30:44 PM, on 2/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\LiteStep\litestep.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
c:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\d3eg32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\Mike's Zone\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Exploader
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe" -win
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O4 - Global Startup: Shortcut to TeaTimer.lnk = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404...meInstaller.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\d3eg32.exe



I ran it through hijackthis.de but every time I open something in explorer it gets back on

 

[trooper]

Don`t really know how to decipher that listing, But have you got a firewall installed, Or at least enabled the built-in XP one ?.

**Looks over shoulder to see if Rico is watching**

Trooper

 

[DemonStar55]

I belive it is and the one in the router too

okay I belive it is called win32/TrojanDownloader.NBS or something and when remove it w/ nod32 another one comes up w/ a different set of last 3 letters

 

[Titcher]

Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive.

 

[DemonStar55]

how do i know which programs are the trojans?

 

[Titcher]

This one looks alot like it could be C:\WINDOWS\d3eg32.exe It's just a matter of you looking to see if it's something you use, if not, delete it.

 

[Steve-O]

Run Anti Vir...

How the hell do trojans get onto a PC anyway?? Can it be something simple like visiting a web site??

I get atleast 2 trojans a week

 

[Rico]

Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.

 

[Bingo Jesus]

Run the log file though this.

I ran yours though it and it said that,

O15 - Trusted Zone: *.frame.crazywinnings.com
Nasty If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
Nasty If you did not add these pages to your trusted pages, they should be fixed.

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404...meInstaller.exe
Nasty This entry is possibly nasty. Should be fixed.

C:\LiteStep\litestep.exe
Unknown running process. (litestep.exe)
This is a unknown process.

C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
Unknown running process. (AD2KClient.exe)
Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk This is a unknown process.

C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
Unknown running process. (MSBNTray.exe)
This is a unknown process.

C:\WINDOWS\d3eg32.exe
Unknown running process. (d3eg32.exe)
This is a unknown process.

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
Unknown
Hit rate: 3 % (result) Unknown application.

O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
Unknown Found in the HPSelectFrontend directory on a HP machine. What is its purpose and is it required?
Hit rate: 99 % (result) Unknown application.

O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
Unknown
Hit rate: 8 % (result) Unknown application.

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe" -win
Unknown
Hit rate: 6 % (result) Unknown application.

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
Unknown

O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
Unknown These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it. Unknown service. (IomegaAccess.exe)

O23 - Service: Remote Procedure Call (RPC) Helper ( 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\d3eg32.exe
Unknown These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it. Unknown service. (d3eg32.exe)

The rest were all safe.

 

[DemonStar55]

yeah I need to do the msconfig thing

and we don't use IE anymore but Im not sure if my sisters still do but if they do I will kill them

 

[trooper]

Get a 486 or pentium 1 computer stick windows 98 on and let them use that.

Problem solved.

Trooper

 

[Thyphoid]

Use Linux for all Internet activity.

 

[Nilsiboy]

Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.

​

you dont mean service pack 2 do you?
makes programs not work....and games...and makes opening downloaded files sooo complicated....it's EVUL
i dont have it and dont have any trojans either, although I'm sometimes visiting .... lets say dangerous sites

 

[Steve-O]

Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.

​

yea I use Firefox, But have never updated Windows since 2002 I think LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean

and the last time I tried to update windows I have to reformat

 

[aapje89]

yea I use Firefox, But have never updated Windows since 2002 I think LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean

and the last time I tried to update windows I have to reformat

​

ooooh LOL, get a decent firewall and virus scanner (antivir, zone alarm), then youll have no problems

 

[trooper]

yea I use Firefox, But have never updated Windows since 2002 I think LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean

and the last time I tried to update windows I have to reformat

​

ooooh LOL, get a decent firewall and virus scanner (antivir, zone alarm), then youll have no problems

​

Or at least a key that works with WU.

Trooper

 

[Thyphoid]

yea I use Firefox at But have never updated Windows since 2002 I think LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean

and the last time I tried to update windows I have to reformat

If you have a "old" CD-Key, not capable installing SP2 you can "register" your windows again and enter a new key that is functional. Modding tutorials for the Registry here. The Registry is changed and Windows starts the Activation-Wizard again, then you can enter a "new" CD-Key. Update your Windows, not only for your own sake.

 

[bast525]

I notice lots of people mention Anti Vir, and Zone Alarm... I actually bought a copy of Macafee a while ago and am subscribed to get virus updates regularly, but no one ever recommends macafee... is it just useless or what?

 

[Steve-O]

well, Currently Im using Anti Vir, Sygate Pro, Microsoft Spyware scanner thing, Spybot and Adaware...

I have had no problems so seen as its all working Im not gonna touch it