OFFICIAL SPYWARE/MALWARE TOPIC (Help: Disappearing folders)

[mickeblue]

Think this posting should be moved to "ain't either"
it's a sod though innit?

[mati]

An update,


Given the suggestions of PC_mechanic over http://www.astonshell.com/forum/viewtopic.php?p=16097#16097

[Veratil]

Start->Run->msconfig
Select the last tab, and uncheck things you don't want to load at bootup.

[The_PC_Mechanic]

It's worth noting that Lavasoft have a new offering called AdAwareSE. It appears to be more effective at grabbing the nasties, but they recommend removing the old version you might already have. When you do this, you lose your ignore list, so remember to look for the entry that claims the shell has been compromised - PUT THAT ENTRY IN YOUR IGNORE LIST, as it is the Aston shell entry.

I have posted this behaviour on the AdAware forum, and they state that this is how they intend to have AdAware work, and they will not change it, so the ignore list is the only option for us.

Regards,

[Eugney]

PC I ran the hijackthis and it fount probs I forgot to save log but it looked fix for the next 5 times I did it than I keep fixing erch assest and it keeps comeing back, but the problam I had posted and that VEratilwas talking about is now fixed.


Logfile of HijackThis v1.98.2
Scan saved at 1:21:59 PM, on 8/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Aston\aston.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\LVComsX.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Adobe\Photoshop CS\Photoshop.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\Rar$EX00.303\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hgoavixvpitbxze.com/UOiyIPk0ecHqUndHQxPtTZ1BVj6RfHvFSblExc7jxrWINqm8KNiZZiQgUqcnmGzu.html
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

[The_PC_Mechanic]

So are you saying that you have successfully removed New.net? Make sure you read the posts regarding new.net (newdotnet) further up in this thread.

Regards,

[Eugney]

ok thank you

[Eugney]

Well PC, the proiblam came back I tried everythaing the edit you said to do for cmd alllll sort of spyware adaware stuff reg cleaners manuly doing i everythang so please help lol


Logfile of HijackThis v1.98.2
Scan saved at 12:12:00 PM, on 8/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Aston\aston.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\LVComsX.exe

C:\Program Files\Winamp\winamp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\Rar$EX00.789\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fdmimwvtiaalxgsq.com/UOiyIPk0ecHqUndHQxPtTZ1BVj6RfHvFSblExc7jxrW6okaJfk3RLyQgUqcnmGzu.php
O4 - HKLM\..\Run: [Multi iso] C:\PROGRA~1\PLUSHO~1\mathforkooze.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [areslite] "C:\Program Files\Ares Lite Edition\AresLite.exe" -h
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

[Eugney]

lol forget it I selcted a full system scan on lavasoft and it fount it and removed it so i gone I took a ss of it showed veratil he was like good for the retard lol I am all happy thank you though

[Eugney]

OK IT CAME BACK YET AGAIN ARGGGGGGGGGGGGGGG


Logfile of HijackThis v1.98.2
Scan saved at 2:19:20 PM, on 8/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Aston\aston.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\explorer.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\Rar$EX02.190\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.djnglceavudphnbcktyc.com/UOiyIPk0ecGI2hXX_HHYD/PIDqCQ1T0wgWu9cWgjMFw.cgi
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.lqfsyuwrdsbwkswbwyf.uk/UOiyIPk0ecHqUndHQxPtTZ1BVj6RfHvFSblExc7jxrXF_Y6wSFGWyiQgUqcnmGzu.asp
O2 - BHO: (no name) - {D9389421-596E-B7B2-31C3-816F0257720B} - C:\PROGRA~1\MODEMO~1\Realhole.exe
O4 - HKLM\..\Run: [Multi iso] C:\PROGRA~1\PLUSHO~1\mathforkooze.exe
O4 - HKLM\..\Run: [Debug safe bat ooze] C:\Documents and Settings\All Users\Application Data\Coal Internet Debug Safe\Barb Bind.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

[Eugney]

ok lavasoft willl find it remove it and abou 30 mins l8r it comes back

[The_PC_Mechanic]

That means you are either not removing the whole thing, or you are visiting a site that is re-downloading the hijacker. One thing you need to be sure of is that Newdotnet is not leaving the HOSTS entry intact. Assuming you aren't visiting a site that is redownloading it for you, you are going to have to try and find what item is reloading it.

What you can try (though make certain you have teatimer and Spywareblaster running, and updated) is go to http://www.google.com/search?q=uninstall6%5F34%2Eexe and click the newdotnet site link. (I can't give the link directly, as their page prohibits all linking - and it's hard to determine if they mean to the executable file or the HTML! They seem to have a set of very happy attorneys, so I'll play it safe).

Anyway, with any luck, that should remove it. If not, there is another option, put we'll only go there if we really have to.

Regards,

[Eugney]

if it is reinstalling windows I am thainking about formating duel boot slackware/windows XP

[Eugney]

okay since there are still 2 iexploers always open I am tired of it so I am prolly going to format :S

[Eugney]

Fresh format after install of msn I get 2 ieploers open all the time the hijack log is this

Logfile of HijackThis v1.97.7
Scan saved at 12:36:25 AM, on 10/28/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Aston\aston.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM\aim.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chris\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gkujlhysva.biz/kiWioY/jvatSCFQF6MJ7amDEEpF7lGtL3ilndSkZQMWylSZfQY7k1PQxK1t_BZ2o.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKCU\..\Run: [second eggs] C:\DOCUME~1\Chris\APPLIC~1\REFSTU~1\Mode Loud.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
O9 - Extra button: AIM (HKLM)

Ran regsuprme lovasof adawere and spybot also