UnSpyPc infection

Computing.Net > Forums > Security and Virus > UnSpyPc infection

Original Message

Name: denzil3
Date: December 13, 2005 at 17:59:46 Pacific
Subject: UnSpyPc infection
OS: Win XP Home Edition 2002
CPU/Ram: 256 MB

Comment:

I got infected with something called UnSpyPc, which pretends to be an anti-spyware program. I knocked out most of it with adaware, but there is one piece left.
Every time my computer starts, it puts a right navbar/skyscraper type of thing with categories: Gambling, Dating, Pharmacy, XXX, Spyware, and Insurance.
You can see what it looks like at:
http://www.dennyswebsites.com/spyware.jpg
I don't know what it is and can't get it off. It is invisible to AdAware and AVG virus scanner.
I hit the cntl+alt+del and starting killing processes, but couldn't get it. Anyone know anything about it? I did a search in the knowledge base thing, but nothing came up.
Help!
denzil3

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: December 13, 2005 at 19:17:28 Pacific

Reply: (edit)

denzil3, Please post a Hijack This log so that the files associated with the virus can be identified. You can download Hijack This at this link http://www.tomcoyote.org/hjt/ then place it into a folder of it's on, such as C:\HJT, so that back up copies can be made and not clutter your desktop or other folders and the backup copies of deleted items can be easily located if needed.
Once saved double click HijackThis.exe, and press "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents into the text editor at this forum.
Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Report Offensive Follow Up For Removal

Response Number 2

Name: XpUser4Real
Date: December 14, 2005 at 21:54:56 Pacific

Reply: (edit)

Just try this free
On-line Spyware Scan
and remove all it finds. That should do the trick for you.
Hopefully my advice will help you...Please post back with your results....thanks

Report Offensive Follow Up For Removal

Response Number 3

Name: denzil3
Date: December 15, 2005 at 19:46:18 Pacific

Reply: (edit)

Logfile of HijackThis v1.99.1
Scan saved at 8:42:27 PM, on 12/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\progra~1\vision~1\paperp~1\pptd40nt.exe
C:\WINDOWS\twain_32\paprport\6100b\flatbed.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Visioneer\PaperPort\Config\Ereg\REMIND32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\Winamp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Spyware\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tipsradio.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [PaperPort PTD] c:\progra~1\vision~1\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [PP6100b] C:\WINDOWS\twain_32\paprport\6100b\flatbed.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [dmlaz.exe] C:\WINDOWS\system32\dmlaz.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\Visioneer\PaperPort\Config\Ereg\REMIND32.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{740B6B28-40F7-4CEA-83B6-B1B042D34229}: NameServer = 85.255.115.98,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{F552D9F9-1C04-4D05-BCCB-38D1D434F199}: NameServer = 85.255.115.98,85.255.112.107
O17 - HKLM\System\CS1\Services\Tcpip\..\{740B6B28-40F7-4CEA-83B6-B1B042D34229}: NameServer = 85.255.115.98,85.255.112.107
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

Report Offensive Follow Up For Removal

Response Number 4

Name: jabuck
Date: December 15, 2005 at 21:49:46 Pacific

Reply: (edit)

Reboot the computer into safe mode Safe Mode
Set the computer up to view hidden files by going to start>control panel>folder options>view tab>sroll down and tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of know file types" and hide protected system operationg files".
While still in safe mode run HT again,close all browsers and windows except HT,place a check to the right of the following items then press "fix checked".
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [dmlaz.exe] C:\WINDOWS\system32\dmlaz.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
Then navigate to these files and delete them if found:
C:\WINDOWS\system32\dmlaz.exe
C:\WINDOWS\system32\idemlog.exe
Reboot into normal and see how the computer runs.Sometimes this is harder to get rid of and we may need to resort to some deeper file searches if this does not resolve the problem.

Report Offensive Follow Up For Removal

Response Number 5

Name: JohnL567
Date: December 16, 2005 at 13:00:07 Pacific

Reply: (edit)

I had this same problem. I just need to get rid of idemlog.exe and the popup stopped running after login.
Thanks a lot!

Report Offensive Follow Up For Removal


UNSpyPC Infection? IE repair after UnSpyPC infection? UnSpyPC infection UnSpyPC problem - Help! I am infected with UnSpyPC please h	said: 'Your computer is infected!' csrss.exe infected by trojan ActiveX error and virus infection Infected? Start here infected file msdirectx.sys

Response Number 6

Name: Abnormal
Date: December 16, 2005 at 18:51:23 Pacific

Reply: (edit)

Nasty 017's jabuck.
Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine

Report Offensive Follow Up For Removal

Response Number 7

Name: denzil3
Date: December 16, 2005 at 21:05:34 Pacific

Reply: (edit)

I followed the instructions jabuck advised, the two BHO things I deleted. I couldn't find the dmlaz.exe or idemlog.exe on the hard drive. And, the navbar on the right doesn't come up anymore.
But, I do have a browser hijacker that still shows up randomly or perhaps based upon my search. I did a new hijack this log and here it is:
Logfile of HijackThis v1.99.1
Scan saved at 10:00:44 PM, on 12/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\twain_32\paprport\6100b\flatbed.exe
C:\progra~1\vision~1\paperp~1\pptd40nt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Visioneer\PaperPort\Config\Ereg\REMIND32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Spyware\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tipsradio.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PP6100b] C:\WINDOWS\twain_32\paprport\6100b\flatbed.exe
O4 - HKLM\..\Run: [PaperPort PTD] c:\progra~1\vision~1\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\Visioneer\PaperPort\Config\Ereg\REMIND32.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{740B6B28-40F7-4CEA-83B6-B1B042D34229}: NameServer = 85.255.115.98,85.255.112.107
O17 - HKLM\System\CCS\Services\Tcpip\..\{F552D9F9-1C04-4D05-BCCB-38D1D434F199}: NameServer = 85.255.115.98,85.255.112.107
O17 - HKLM\System\CS1\Services\Tcpip\..\{740B6B28-40F7-4CEA-83B6-B1B042D34229}: NameServer = 85.255.115.98,85.255.112.107
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

Report Offensive Follow Up For Removal

Response Number 8

Name: pithorse
Date: December 16, 2005 at 21:29:19 Pacific

Reply: (edit)

i have the same problem, heres my hijackthis log
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Auto Power-on\AutoPower.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ISS\BlackICE\rapapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Documents and Settings\jason\Start Menu\Programs\Startup\etmin.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\jason\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - Startup: Ad-Watch SE Professional.lnk = C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
O4 - Startup: etmin.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4247DB1F-7281-4271-86FB-4342B31AB173}: NameServer = 85.255.115.60,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{65218F0D-E86C-4A1E-A009-353081DC2318}: NameServer = 85.255.115.60,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ECB64F6-06F3-446A-9684-133B31D6A618}: NameServer = 85.255.115.60,85.255.112.150
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Auto Power-on (AutoPower) - Unknown owner - C:\Program Files\Auto Power-on\AutoPower.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

Report Offensive Follow Up For Removal

Response Number 9

Name: jabuck
Date: December 16, 2005 at 22:22:49 Pacific

Reply: (edit)

denzil3, Download BlackLight from this link http://www.f-secure.com/blacklight/ and post it's log.
The log should be on your desktop or root directory (C:\). This is the format for the log file name:
fsbl-<date-and-time>.log
If you have any trouble finding it do a search for fsbl*.log.

Report Offensive Follow Up For Removal

Response Number 10

Name: pithorse
Date: December 17, 2005 at 00:16:18 Pacific

Reply: (edit)

thanks. here it is:
12/17/05 03:12:16 [Info]: BlackLight Engine 1.0.30 initialized
12/17/05 03:12:16 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/17/05 03:12:16 [Note]: 7019 4
12/17/05 03:12:16 [Note]: 7005 0
12/17/05 03:12:18 [Note]: 7006 0
12/17/05 03:12:18 [Note]: 7011 1472
12/17/05 03:12:18 [Note]: 7018 2028
12/17/05 03:12:18 [Info]: Hidden process: C:\WINDOWS\system32\idemlog.exe
12/17/05 03:12:18 [Note]: FSRAW library version 1.7.1014
12/17/05 03:12:55 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
12/17/05 03:12:55 [Note]: 10002 1
12/17/05 03:12:57 [Info]: Hidden file: C:\WINDOWS\system32\idemlog.exe
12/17/05 03:12:57 [Note]: 10002 1
12/17/05 03:12:57 [Info]: Hidden file: C:\WINDOWS\system32\csylx.exe
12/17/05 03:12:57 [Note]: 7002 32
12/17/05 03:12:57 [Note]: 7003 1
12/17/05 03:12:57 [Note]: 10002 1
12/17/05 03:12:58 [Info]: Hidden file: C:\WINDOWS\system32\dmnxx.exe
12/17/05 03:12:58 [Note]: 7002 32
12/17/05 03:12:58 [Note]: 7003 1
12/17/05 03:12:58 [Note]: 10002 1
12/17/05 03:12:58 [Info]: Hidden file: C:\WINDOWS\system32\favset.exe
12/17/05 03:12:58 [Note]: 10002 1
12/17/05 03:12:59 [Info]: Hidden file: C:\WINDOWS\system32\filesafer23.exe
12/17/05 03:12:59 [Note]: 10002 1
12/17/05 03:13:02 [Info]: Hidden file: C:\WINDOWS\system32\pppcgm.exe
12/17/05 03:13:02 [Note]: 10002 1
12/17/05 03:13:57 [Error]: 6019 0
12/17/05 03:13:57 [Error]: 6023 5
12/17/05 03:15:08 [Note]: 7007 0

Report Offensive Follow Up For Removal

Response Number 11

Name: Verdale
Date: December 17, 2005 at 07:55:25 Pacific

Reply: (edit)

I have the same problem. I removed UnSpyPC but I still have browser hi-jack attempts and every once in a while, that desktop toolbar reappears after rebooting. BlackLight didn't find anything, but HiJackThis found a few weird things. I'm a little suspicious about one thats dmzxo.exe, but I don't want to get rid of it if it is some sort of system essential file. Anyone know anything about this or would like to see my Hijack This logfile?

Report Offensive Follow Up For Removal

Response Number 12

Name: denzil3
Date: December 17, 2005 at 09:12:24 Pacific

Reply: (edit)

jabuck, here is the blacklight log file. Not much there?
12/17/05 10:09:37 [Info]: BlackLight Engine 1.0.30 initialized
12/17/05 10:09:37 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/17/05 10:09:37 [Note]: 7019 4
12/17/05 10:09:37 [Note]: 7005 0
12/17/05 10:09:43 [Note]: 7006 0
12/17/05 10:09:43 [Note]: 7011 1436
12/17/05 10:09:43 [Note]: FSRAW library version 1.7.1014
12/17/05 10:10:38 [Note]: 7007 0

Report Offensive Follow Up For Removal

Response Number 13

Name: jabuck
Date: December 17, 2005 at 09:25:34 Pacific

Reply: (edit)

denzil3, Run Ht again,close all windows and browswers except HT, place a check by the following items and press"fix checked".
O17 - HKLM\System\CCS\Services\Tcpip\..\{4247DB1F-7281-4271-86FB-4342B31AB173}: NameServer = 85.255.115.60,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{65218F0D-E86C-4A1E-A009-353081DC2318}: NameServer = 85.255.115.60,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ECB64F6-06F3-446A-9684-133B31D6A618}: NameServer = 85.255.115.60,85.255.112.150
A special thanks to abnormal, who of course is always keeping me straight.

Report Offensive Follow Up For Removal

Response Number 14

Name: jabuck
Date: December 17, 2005 at 09:43:53 Pacific

Reply: (edit)

pithorse,You should always start you own thread so it cad be followed.
Delete the files from safe mode:
C:\WINDOWS\system32\idemlog.exe
C:\WINDOWS\system32\csylx.exe
C:\WINDOWS\system32\dmnxx.exe
C:\WINDOWS\system32\favset.exe
C:\WINDOWS\system32\filesafer23.exe
C:\WINDOWS\system32\pppcgm.exe
Be sure to set the computer up to view hidden files.Go th control panel>folder options>view tab>tick the circle beside"show hidden files and folders and untick the box beside "hid extensions of know file types" and hide protected system operating files". Then rehide when finished.

Report Offensive Follow Up For Removal

Response Number 15

Name: pithorse
Date: December 17, 2005 at 14:15:46 Pacific

Reply: (edit)

thanks, i got rid of the pop up on my desktop, but i still get hijacked when i go to some websites. maybe reinstalling internet explorer will help?

Report Offensive Follow Up For Removal

Response Number 16

Name: jabuck
Date: December 17, 2005 at 15:49:23 Pacific

Reply: (edit)

pithorse,Start a new thread and state the problem you are having. Reinstalling internet explorer will not help.Maybe we can help you once you have a thread of your on. Do not post any logs yet.

Report Offensive Follow Up For Removal

Response Number 17

Name: hobson
Date: December 21, 2005 at 20:16:34 Pacific

Reply: (edit)

After getting infected with unspypc, I did several things that I thought had removed all the offending files. But now when I open my internet explorer, I only have one blank bar above the address bar instead of (1) the bar with the drop-down menus "File," "Edit," "View," etc., and (2) the bar that begins with the Back arrow. How can this be repaired? Reinstalling didn't help. (Unspypc also took out the computer-resident software for my 2Wire HomePortal 1000S.)

Report Offensive Follow Up For Removal

Response Number 18

Name: Hikari
Date: December 22, 2005 at 18:30:43 Pacific

Reply: (edit)

I am having the UnSpyPc infection problem as well.
Here is a Hijack This Log...

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\STOPzilla!\SZServer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Derek Schweitzer\Desktop\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131865923489
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe

The STOPzilla is the trial version, it shows the infections but it won't remove them since it is just the trial.

Report Offensive Follow Up For Removal

Response Number 19

Name: jabuck
Date: December 22, 2005 at 20:52:32 Pacific

Reply: (edit)

Please post your UnSpyPc into your own thread and do not post any logs yet.

Report Offensive Follow Up For Removal

Potential Hacker Problem

Virus Problem!

Use following form to reply to current message:

Name: From My Computing.Net Settings E-Mail: From My Computing.Net Settings Subject: UnSpyPc infection

Comments:

  Homepage URL (*): 
Homepage Title (*): 
         Image URL:

Have you ever used OpenOffice?

Poll Finishes In 4 Days.
Discuss in The Lounge

Odd Routing Issue

disable secuity in Outlook using VC

New printer cannot find in XP

DNS with router gone

Reset ROM BIOS password for Nx7400

All Posts Awaiting Replies