Urgent help required

[Fallen-Angel]

Ok, over the past few days, something severely messed up is going on. I've ran spy bot and adaware, but they don't seem to pick everything up. Minutes ago i saw a cmd window open up and do something, and now IE is popping up all over the show

Here is a HJT log.


Logfile of HijackThis v1.99.1
Scan saved at 17:33:32, on 5/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\nzm.exe
C:\WINDOWS\retadpu2000206.exe
C:\WINDOWS\system32\wscntfy.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\retadpu2000206.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\retadpu2000206.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Carl\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nintendo-europe.com/NOE/e..._treasures.jsp
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O1 - Hosts: 66.240.231.193 l2authd.lineage2.com
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [McAfee Online Virus Scanner] nzm.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu2000206.exe 61A847B5BBF72810329B385472FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\RunServices: [McAfee Online Virus Scanner] nzm.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1134663887640
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab55579.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E94FED30-FCF7-427F-948B-2EF421B67F46}: NameServer = 80.225.250.178 80.225.250.186
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\V2luZG93cyBYUCBQcm8\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe




I know a few things are fked, like that retadpu2000206, but if someone with some skill could look at it ASAP, and also suggest anything to do, i would appreciate it, thanks

[Paparika]

go to trend micro and use the house doctor
your AVG is scewed


oh and get a decent internet provider

[Puratech]

I only had time for a very quick glance.

C:\WINDOWS\retadpu2000206.exe
C:\WINDOWS\retadpu2000206.exe
C:\WINDOWS\retadpu2000206.exe
(3 instances running)

O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu2000206.exe 61A847B5BBF72810329B385472FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310

http://fileinfo.prevx.com/fileinfo.asp?PXC=481891137716 - I havent read that, but it looks to be some info on what youre looking for.

Go safemode, and delete the O4 registry link, then go to your c:\windows and delete anything with retadpu in it, "del c:\windows\retadpu*" should work fine from a command prompt.

Sort it quickly before it installs more ****e on your pc, doesnt look like anything else is there now but i dont have time to check everything thoroughly sorry.


PS. AoL are alright as an ISP, i used them some time ago and a couple of friends use them without problem. They just have a bad reputation for mailspamming with cds and id certainly recommend them over sky or tiscali, for example.

[Mean]

I have AOL & never have any probs tbh.

[Fallen-Angel]

Wait. AOL is not my isp, i'm on Tiscali

[Paparika]

Originally Posted by Fallen-Angel

Wait. AOL is not my isp, i'm on Tiscali

but the program roots are still there....



i used to work for AOL, i really honestly wouldn't recommend them to anyone

[Puratech]

Originally Posted by Paparika

but the program roots are still there....



i used to work for AOL, i really honestly wouldn't recommend them to anyone

Cos of the crappy software? Company ethics?


They do provide a pretty reliable service to the majority of people from what it seems, and having worked for an isp myself and known friends at a few other uk isps im pretty sure they all look bad when you see the company from the inside

Tiscali are however certainly poo, crap peering, crap latency etc.

[Fallen-Angel]

I think the big thing thats giving me my pop ups is something like command service, and im having a really hard time deleting it. Upon googling it, it's giving me the symptoms, and spybot can't remove it cause it's running. This is annoying as hell. Every 20 minutes an IE window pops up and its doing my fkcing head in


Edit: This is the sort of link im getting when the IE window opens

http://url.cpvfeed.com/cpv.jsp?p=110...tingId=6243871

[Paparika]

Originally Posted by Puratech

Cos of the crappy software? Company ethics?


They do provide a pretty reliable service to the majority of people from what it seems, and having worked for an isp myself and known friends at a few other uk isps im pretty sure they all look bad when you see the company from the inside

Tiscali are however certainly poo, crap peering, crap latency etc.

for the lying to the customers, taking money when they shouldn't, the rules to abide by so that you cant help the customer for too long. company ethics yes, software..hmmmmm you can get it on your pc no probs, but a full wipe to remove it... tiscali search has a naked lady site that is easily availble to see, how do i know that, well its certainly wasn't from hearing it from a mate, i was sat with my nephew when his parents were on it, he wanted to show me a kiddie site, clicked on the wrong thread and had a full view of a naked ladies site.

anyway were not here to argue about isp's

FA is the pc any better?

[Fallen-Angel]

Originally Posted by Paparika

for the lying to the customers, taking money when they shouldn't, the rules to abide by so that you cant help the customer for too long. company ethics yes, software..hmmmmm you can get it on your pc no probs, but a full wipe to remove it... tiscali search has **** that is easily availble to see, how do i know that, well its certainly wasn't from hearing it from a mate, i was sat with my nephew when his parents were on it, he wanted to show me a kiddie site, clicked on the wrong thread and had a full view of a **** site.

anyway were not here to argue about isp's

FA is the pc any better?

I'm not sure at the moment, i cant seem to pinpoint that last thing. BUT i deleted the AVG.dat earlier, and i tried to reinstall and it has worked! I'm running a scan at the moment to try and pick something up. But if this doesnt get it, God knows what I'll do

[Paparika]

Originally Posted by Fallen-Angel

I think the big thing thats giving me my pop ups is something like command service, and im having a really hard time deleting it. Upon googling it, it's giving me the symptoms, and spybot can't remove it cause it's running. This is annoying as hell. Every 20 minutes an IE window pops up and its doing my fkcing head in


Edit: This is the sort of link im getting when the IE window opens

http://url.cpvfeed.com/cpv.jsp?p=110...tingId=6243871

you can stop pop ups to a certain degree in admin tools, services, and disable messenger (has nothing to do with msn)..
you can block loads more if you are using firefox and use the addon adbloc plus


would still suggest a visit to trend micro house doctor to make sure you have no nasties lurking around

[Fallen-Angel]

It's weird though. I'm using firefox as my dominant broswer, but an IE one pops up every so often with a dead link

[Laz]

You could try to rename IExplore.exe to something else (eg IExlpore2.exe) and see if that confounds the little bugger.