UNSOLVED

gular04

updated

21 years ago

G

gular04

4 Posts

0

463

April 3rd, 2006 18:00

Please help to remove those popups

Some popups like this. "From System to Administrator.
Critical System Error! The Windows registry appears to be corrupted or
damaged. Please go to www.regfix.info to scan and repair the system registry."
Some times tell me go to www.DLPATCH.com or www.fixwin32.com to download some exe file.
Installed in my computer...etc.
Here is my Logfile. Please help me to fix it. Thanks!
 
Logfile of HijackThis v1.99.1
Scan saved at 3:32:32, on 4/4/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\GetRight\getright.exe
C:\WINDOWS\system32\QTRAYIME.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\D_drive\Tool\Anti Virus\hijackthis_sfx\HijackThis.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: 收音機(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC1A2C94-E06A-4520-A270-744425F6C36F}: NameServer = 218.102.62.71 205.252.144.126
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
 
  • RKinner

    2 Intern

    •

    5851 Posts

    143

    0

    Posted April 4th, 2006 02:00

    Nothing showing in the log. 

    Is this what you are getting:

     

    "Messenger Service
    Message from System to Administrator

    Critical System Error! The Windows registry appears to be corrupted or damaged. Please go to www.regfix.info to scan and repair the system registry."

     

    That's probably because you have the messenger service on and they are spoofing admin messages.  Start, Run, services.msc, OK.  Find the Messenger service and double click on it.  Change the Startup Type: from Automatic to Disabled then Apply then STOP the service.

    IF that doesn't help then:

     

     

    There is a winfixer stealth variation out there.

    If none of the above show up then you can use rootkitrevealer
     
     
    and look for a file wingenerics.dll.  If you find it then:
     
    Please download AproposFix from here:
    http://swandog46.geekstogo.com/aproposfix.exe

    Save it to your desktop but do NOT run it yet.

    Then please reboot your computer in Safe Mode by doing the following:
    1) Restart your computer
    2) After hearing your computer beep once during startup, but before the
    Windows icon appears, press F8.
    3) Instead of Windows loading as normal, a menu should appear
    4) Select the first option, to run Windows in Safe Mode.

    Once in Safe Mode, please double-click aproposfix.exe and unzip it to the
    desktop. Open the aproposfix folder on your desktop and run RunThis.bat.
    Follow the prompts.

    When the tool is finished, please reboot back into normal mode and run rootkitrevealer and see if the file is gone.

    Also the smitfraud variations can be invisible.  You can try smitrem and see if that helps:

    The smitrem program at http://noahdfear.geekstogo.com/ will cure most cases of SpyAxe, SmitFraud, Spy Sheriff, WinHound and many other infections that mess up the desktop.
     
    Note that you should login with your usual login when you go into Safe Mode.  If that is a problem then run the program once in Safe Mode as Administrator then boot into regular mode and run it again.  The Cleanup routine at the end is optional.
     
    Better instructions for running smitrem are available at:
     
     
     
    which was actually written to help get rid of SpyFalcon but the same procedure applies to all desktop hijacker problems.
     
    Ron
  • gular04

    4 Posts

    143

    0

    Posted April 4th, 2006 07:00

    Ron,
     
    I think it has worked. I've been online for about 4 hours. So far and I haven't received any popups yet. But if I do, I'll need your other advice as well. And i will try smitrem and see if that helps.
    Thank you again!
     
    Gular
  • RKinner

    2 Intern

    •

    5851 Posts

    143

    0

    Posted April 4th, 2006 14:00

    I think that was the problem.  You don't need to run the others tho they won't hurt anything (smitrem will reset your desktop to the default blue background).

    Ron

    A Few Recommendations.

    You can delete any programs we had you install but leave Hijackthis for now.  You can also run Hijackthis, View the List of Backups and Delete All.  If we used killbox its backup files can be removed now too.  Run Killbox and select File, Cleanup, Delete All Backups.  If you have an antivirus, check its quarantined files and delete any it had found.

    You should also definitely toggle System Restore Off and then back On.

    Following site has very clear instructions for turning it off.  To turn it back on you just repeat the instructions but uncheck the box where it says to Turn Off System Restore on all Drives.

    http://www.f-secure.com/v-descs/sfc_dis1.shtml

    The reason we do this is to remove any archived copies of the infection from System Restore so that if you have to use SYstem Restore to fix a problem you won't accidentally reinfect your system.  The next link explains how to use System Restore to go back in time if you hit a bad site or get infected.

    http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx


    One way to make an infection more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new.  You do this by None of the Above Just start the program, Config (Main) and then check the box in front of Run Hiajckthis at startup and show it when items are found.  OK.  Then if Hijackthis opens after a boot it will show you any new programs that have been added.  You can then decide if you want to keep them or not.  If in doubt you can google for the .exe or .dll file at the end of the entry and see if what other people think of it.

     

    To avoid going to a bad site you might want to install IE-SpyAd and SpywareBlaster and make the other changes recommended at:.
    http://www.mvps.org/winhelp2002/restricted.htm
    I used to recommend Spybot's Immunize system but have recently learned it is not as good as the one at:
    http://www.mvps.org/winhelp2002/hosts.htm

    Always run a firewall.  The one in XP SP2 is pretty good tho I think the free one from Zone Alarm is better.

    http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

    Turn on Autoupdates so you always get the latest patches from Windows.

    Never hurts to do one of the free on line scans from Panda or Trend.  They take a while but are pretty good.
    www.pandasoftware.com/activescan/activescan.asp?
    http://housecall.trendmicro.com/


    I like to run Spybot S&D. 
    http://www.safer-networking.org/en/download/index.html
    Also like to run AdAware once in a while. 
    http://www.lavasoftusa.com/software/adaware/

    Get the latest version of
    Java:
    http://www.java.com/en/download/windows_automatic.jsp

     Make sure you have removed any older versions of Java or JRE  with Control Panel, Add/Remove Programs.  Updates do not remove the older versions which have exploitable flaws.

    If you have an older PC get rid of Microsoft Java Virtual Machine. 

    Following site explains how to tell if you have it:

    http://www.java.com/en/download/help/uninstall_msvm.xml

    The automated removal tool is no longer available on Microsoft's site but can be obtained here:

    Download the MSJVM Removal Tool from:
    http://www.majorgeeks.com/download4158.html
     
    and run it.

    If you feel that


    If you feel that Internet Explorer is running a bit slower after the latest Java update you can try checking this line and then Fix Checked.

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    It was added by the latest version of Java.  We don't know why.  Earlier versions did not have it.  It has been proven to slow down connections on some systems and removing it doesn't seem to hurt anything.

    Other items you may wish to get rid of if you own a Dell are:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
    O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

    THese are from the MyWay Adware program installed on most Dells.  The uninstaller was broken on many of them.
     To remove just close Internet Explorer, run HijackThis (scan only) and check them then Fix Checked.


    If you are not running the latest version of Adobe you should consider updating.  There are reports of a loophole for hackers in pre 7.03 versions.
    As an alternative you can dump adobe completely and use fox-it instead:
    http://www.foxitsoftware.com/pdf/rd_intro.php

    If you do not have an antivirus program or the one you have was a trial that has expired then try the free antivirus for home users from Avast!
    http://www.avast.com/eng/download-avast-home.html  (Uninstall any other antivirus program first.)

    If you run Macromedia Flash make sure you have the latest version.  We just got a warning the following versions are vulnerable:
    * Flash Player 8.0.22.0 and earlier
    * Flash Professional 8
    * Flash Basic
    * Flash MX 2004
    * Flash Debug Player 7.0.14.0 and earlier
    * Flex 1.5
    * Breeze Meeting Add-In 5.1 and earlier
    * Adobe Macromedia Shockwave Player 10.1.0.11 and earlier

  • gular04

    4 Posts

    143

    0

    Posted April 5th, 2006 03:00

    Ron,
     
    Your valuable recommendations really help me a lot. Thank you so much!
     
    Gular