Friend's PC problem

[weera]

Hi guys, I need some help here
My friend's PC is acting weird after startup process. It always shows My Computer window. And everytime I doubleclick a folder, it always open a new search window.
Tried with Norton but only shows 2 Adware problems.

Any ideas? I put the hijackthis log file here

Thanks in advance for any help from you guys

Logfile of HijackThis v1.97.7
Scan saved at 20:18:52, on 02/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\System32\DeltTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
F:\BANK of INSTALLER\REMOVER\merijn\HijackThis.exe

O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O4 - HKLM\..\Run: [systray] C:\WINDOWS\system32\a.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - Startup: windows.pif = ?
O4 - Global Startup: Empty.pif = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

And here is the startup list

StartupList report, 02/10/2006, 20:21:03
StartupList version: 1.52
Started from : F:\BANK of INSTALLER\REMOVER\merijn\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\System32\DeltTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
F:\BANK of INSTALLER\REMOVER\merijn\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\wawan\Start Menu\Programs\Startup]
windows.pif = ?

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Empty.pif = ?
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

High Definition Audio Property Page Shortcut = HDAShCut.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
WinampAgent = C:\Program Files\Winamp\winampa.exe
H2O = C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
M-Audio Delta Taskbar Icon = C:\WINDOWS\System32\DeltTray.exe
DeltTray = DeltTray.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
RunDLL = rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
systray = C:\WINDOWS\system32\a.exe
RemoteControl = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
HP Software Update = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\system32\bridge.dll - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Scan my computer - wawan.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 5.428 bytes
Report generated in 0,453 seconds

[weera]

guys.. anyone got a clue..? 

well, I'll try with updated AV again and let you know

[Quantum]

I've seen the 'my computer' thing before, I don't know about the double clicking though.

But I was unable to solve that problem ever, just left it doing that till a re-install of windows. Weird problems sorry, don't know how to help.

[weera]

It

I've seen the 'my computer' thing before, I don't know about the double clicking though.

But I was unable to solve that problem ever, just left it doing that till a re-install of windows. Weird problems sorry, don't know how to help.

It's OK Quantum, thanks anyway..

It seems brontok virus is the one that has to be responsible for this cause. I found some folder with brontok name on it and when I found it, the computer log off instantly. And the computer always copy new folder named "data wawan.exe" to UFD that I plugged to the machine. 

The strange part is NAV 2006 with latest updated definitions didn't detect it at all..! 

I think he should re-install windows coz the virus already rooted and "eat the machine".. 

Thanks again Quantum and guys

[james007torres24]

i just fixed my friends pc and i just installed norton 2006 with latest definitions wich got most of the things. then spybot then ad-aware, and avg free and then winsockfix then thats all its was fine. and as for start up list, i took all of them off.

[chip!]

whoaaaaaaaaaa...  a bunch of stuff is wrong with that computer

bold are DEFINITELY BAD.. the other are suspicious and i would remove them as well unless you knew for sure otherwise:

C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe



and

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll

and

systray = C:\WINDOWS\system32\a.exe


and


PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
..



boot to Safe-Mode,  I would use AutoRuns but i guess you can use HijackThis to remove those entries...  then delete the files, and reboot, you should be good from there..

[SHEEPFISH]

buy a new one