Trojans Again

DemonStar55

chai chai chai chai chai chai chai chai chai chai
Joined
Nov 24, 2003
Messages
1,889
Age
30
Location
Wrentham, MA
Website
demonstar55.phpnet.us
well my sisters are experts at gettign trojans so I need some help again

Logfile of HijackThis v1.99.1
Scan saved at 11:30:44 PM, on 2/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\LiteStep\litestep.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
c:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\d3eg32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\Mike's Zone\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Exploader
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe" -win
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O4 - Global Startup: Shortcut to TeaTimer.lnk = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404...meInstaller.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\d3eg32.exe



I ran it through hijackthis.de but every time I open something in explorer it gets back on
 

trooper

Trooper`s watching you !!!
Joined
Apr 20, 2003
Messages
5,503
Location
The DarkSide (London)
Website
Visit site
Don`t really know how to decipher that listing, But have you got a firewall installed, Or at least enabled the built-in XP one ?.

**Looks over shoulder to see if Rico is watching**

Trooper
 

DemonStar55

chai chai chai chai chai chai chai chai chai chai
Joined
Nov 24, 2003
Messages
1,889
Age
30
Location
Wrentham, MA
Website
demonstar55.phpnet.us
I belive it is and the one in the router too

okay I belive it is called win32/TrojanDownloader.NBS or something and when remove it w/ nod32 another one comes up w/ a different set of last 3 letters
 

Titcher

Active Member
Joined
Nov 10, 2003
Messages
538
Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive.
 

Titcher

Active Member
Joined
Nov 10, 2003
Messages
538
This one looks alot like it could be C:\WINDOWS\d3eg32.exe It's just a matter of you looking to see if it's something you use, if not, delete it.
 

Steve-O

Very Active Member
Joined
Aug 28, 2003
Messages
4,054
Run Anti Vir...

How the hell do trojans get onto a PC anyway?? Can it be something simple like visiting a web site??

I get atleast 2 trojans a week :(
 

Rico

Certified Guru
Joined
Apr 4, 2003
Messages
5,649
Age
33
Location
England, UK
Website
Visit site
Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.
 

Bingo Jesus

GP2X Hardcore
Joined
Jun 25, 2004
Messages
384
Age
31
Location
Cumbria, UK
Run the log file though this.

I ran yours though it and it said that,

These were Nasty said:
O15 - Trusted Zone: *.frame.crazywinnings.com
Nasty If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
Nasty If you did not add these pages to your trusted pages, they should be fixed.

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404...meInstaller.exe
Nasty This entry is possibly nasty. Should be fixed.
These were unknown said:
C:\LiteStep\litestep.exe
Unknown running process. (litestep.exe)
This is a unknown process.

C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
Unknown running process. (AD2KClient.exe)
Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk This is a unknown process.

C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
Unknown running process. (MSBNTray.exe)
This is a unknown process.

C:\WINDOWS\d3eg32.exe
Unknown running process. (d3eg32.exe)
This is a unknown process.

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
Unknown
Hit rate: 3 % (result) Unknown application.

O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
Unknown Found in the HPSelectFrontend directory on a HP machine. What is its purpose and is it required?
Hit rate: 99 % (result) Unknown application.

O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
Unknown
Hit rate: 8 % (result) Unknown application.

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe" -win
Unknown
Hit rate: 6 % (result) Unknown application.

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
Unknown

O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
Unknown These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it. Unknown service. (IomegaAccess.exe)

O23 - Service: Remote Procedure Call (RPC) Helper ( 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\d3eg32.exe
Unknown These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it. Unknown service. (d3eg32.exe)
The rest were all safe.
 
Last edited by a moderator:

Nilsiboy

1337 T045T
Joined
Jul 9, 2004
Messages
561
Age
29
Website
Visit site
Rico posted on Feb 27 2005 at 10:35 PM said:
Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.
you dont mean service pack 2 do you?
makes programs not work....and games...and makes opening downloaded files sooo complicated....it's EVUL
i dont have it and dont have any trojans either, although I'm sometimes visiting .... lets say dangerous sites
 
Last edited by a moderator:

Steve-O

Very Active Member
Joined
Aug 28, 2003
Messages
4,054
Rico posted on Feb 27 2005 at 08:35 PM said:
Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

Steve-O, start using Firefox and make sure Windows is fully updated.

yea I use Firefox, But have never updated Windows since 2002 I think :p LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean :)

and the last time I tried to update windows I have to reformat :(
 
Last edited by a moderator:

aapje89

Still here...
Joined
Jun 12, 2004
Messages
2,753
Age
30
Location
The Netherlands
Website
Visit site
Steve-O posted on Feb 28 2005 at 05:49 PM said:
yea I use Firefox, But have never updated Windows since 2002 I think :p LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean :)

and the last time I tried to update windows I have to reformat :(
ooooh :eek: LOL, get a decent firewall and virus scanner (antivir, zone alarm), then youll have no problems
 
Last edited by a moderator:

trooper

Trooper`s watching you !!!
Joined
Apr 20, 2003
Messages
5,503
Location
The DarkSide (London)
Website
Visit site
aapje89 posted on Feb 28 2005 at 10:21 PM said:
Steve-O posted on Feb 28 2005 at 05:49 PM said:
yea I use Firefox, But have never updated Windows since 2002 I think :p LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean :)

and the last time I tried to update windows I have to reformat :(
ooooh :eek: LOL, get a decent firewall and virus scanner (antivir, zone alarm), then youll have no problems
Or at least a key that works with WU. ;)

Trooper
 
Last edited by a moderator:

Thyphoid

Member
Joined
Jul 31, 2003
Messages
205
Location
Germany
Website
Visit site
Steve-O posted on Feb 28 2005 at 05:49 PM said:
yea I use Firefox at But have never updated Windows since 2002 I think :p LOL

do I realy have to update windows as my windows xp has a bad cd key if you know what I mean :)

and the last time I tried to update windows I have to reformat :(
If you have a "old" CD-Key, not capable installing SP2 you can "register" your windows again and enter a new key that is functional. Modding tutorials for the Registry here. The Registry is changed and Windows starts the Activation-Wizard again, then you can enter a "new" CD-Key. Update your Windows, not only for your own sake.
 
Last edited by a moderator:

bast525

Well-Known Member
Joined
Dec 4, 2004
Messages
1,653
I notice lots of people mention Anti Vir, and Zone Alarm... I actually bought a copy of Macafee a while ago and am subscribed to get virus updates regularly, but no one ever recommends macafee... is it just useless or what?
 

Steve-O

Very Active Member
Joined
Aug 28, 2003
Messages
4,054
well, Currently Im using Anti Vir, Sygate Pro, Microsoft Spyware scanner thing, Spybot and Adaware...

I have had no problems so seen as its all working Im not gonna touch it :)
 
Top