Author Topic: Friend's PC problem  (Read 7393 times)

weera

  • Guest
Friend's PC problem
« on: October 02, 2006, 02:45:50 am »
Hi guys, I need some help here
My friend's PC is acting weird after startup process. It always shows My Computer window. And everytime I doubleclick a folder, it always open a new search window.
Tried with Norton but only shows 2 Adware problems.

Any ideas? I put the hijackthis log file here

Thanks in advance for any help from you guys :)

Logfile of HijackThis v1.97.7
Scan saved at 20:18:52, on 02/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\System32\DeltTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
F:\BANK of INSTALLER\REMOVER\merijn\HijackThis.exe

O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O4 - HKLM\..\Run: [systray] C:\WINDOWS\system32\a.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - Startup: windows.pif = ?
O4 - Global Startup: Empty.pif = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

And here is the startup list

StartupList report, 02/10/2006, 20:21:03
StartupList version: 1.52
Started from : F:\BANK of INSTALLER\REMOVER\merijn\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\System32\DeltTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
F:\BANK of INSTALLER\REMOVER\merijn\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\wawan\Start Menu\Programs\Startup]
windows.pif = ?

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Empty.pif = ?
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

High Definition Audio Property Page Shortcut = HDAShCut.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
WinampAgent = C:\Program Files\Winamp\winampa.exe
H2O = C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
M-Audio Delta Taskbar Icon = C:\WINDOWS\System32\DeltTray.exe
DeltTray = DeltTray.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
RunDLL = rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
systray = C:\WINDOWS\system32\a.exe
RemoteControl = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
HP Software Update = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\system32\bridge.dll - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Scan my computer - wawan.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 5.428 bytes
Report generated in 0,453 seconds

weera

  • Guest
Re: Friend's PC problem
« Reply #1 on: October 04, 2006, 11:14:20 pm »
guys.. anyone got a clue..?  ???

well, I'll try with updated AV again and let you know :)

Offline Quantum

  • Ascended One
  • Hero Member
  • *****
  • Posts: 782
  • Karma: +206/-0
  • Daniel Jackson is looking at you!
    • View Profile
Re: Friend's PC problem
« Reply #2 on: October 05, 2006, 03:54:32 am »
I've seen the 'my computer' thing before, I don't know about the double clicking though.

But I was unable to solve that problem ever, just left it doing that till a re-install of windows. Weird problems sorry, don't know how to help.
Daniel: "This tastes like chicken."
Carter: "So what's wrong with it?"
Daniel: "It's macaroni and cheese."

weera

  • Guest
Re: Friend's PC problem
« Reply #3 on: October 05, 2006, 08:21:30 am »
It
I've seen the 'my computer' thing before, I don't know about the double clicking though.

But I was unable to solve that problem ever, just left it doing that till a re-install of windows. Weird problems sorry, don't know how to help.

It's OK Quantum, thanks anyway.. :)

It seems brontok virus is the one that has to be responsible for this cause. I found some folder with brontok name on it and when I found it, the computer log off instantly. And the computer always copy new folder named "data wawan.exe" to UFD that I plugged to the machine.  ???

The strange part is NAV 2006 with latest updated definitions didn't detect it at all..!  >:(

I think he should re-install windows coz the virus already rooted and "eat the machine"..  :(

Thanks again Quantum and guys :)

james007torres24

  • Guest
Re: Friend's PC problem
« Reply #4 on: November 02, 2006, 01:32:45 am »
i just fixed my friends pc and i just installed norton 2006 with latest definitions wich got most of the things. then spybot then ad-aware, and avg free and then winsockfix then thats all its was fine. and as for start up list, i took all of them off.

Offline chip!

  • Bad Ass
  • Administrator
  • Unstoppable
  • *****
  • Posts: 2301
  • Karma: +629/-6
    • View Profile
Re: Friend's PC problem
« Reply #5 on: November 02, 2006, 11:09:08 am »
whoaaaaaaaaaa...  a bunch of stuff is wrong with that computer

bold are DEFINITELY BAD.. the other are suspicious and i would remove them as well unless you knew for sure otherwise:

C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\wawan\Application Data\explorer.exe
C:\Documents and Settings\wawan\Local Settings\Application Data\lsass.exe



and

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll


and

systray = C:\WINDOWS\system32\a.exe


and


PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
..



boot to Safe-Mode,  I would use AutoRuns but i guess you can use HijackThis to remove those entries...  then delete the files, and reboot, you should be good from there..
« Last Edit: November 02, 2006, 11:58:12 am by chip! »
  -  https://convivea.com  -   And...  boom goes the dynamite.

SHEEPFISH

  • Guest
Re: Friend's PC problem
« Reply #6 on: December 14, 2006, 02:41:41 pm »
buy a new one