Hijack This log

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by BaBang, Jun 9, 2004.

  1. BaBang

    BaBang Private E-2

    I've been trying for hours to get some adware/spyware off my computer and it just keeps returning, I've used Spybot, Ad-Aware, CWShredder, AVG, Norton Anti-Virus, Registry Mechanic, HijackThis, and even tracked it down in the registry but It simply WON'T go away. Please help me! Here's my HijackLog, and fYI what it keeps doing is resetting my homepage to "About:blank" which is taking me to a search page and since I've deleted the registry keys countless times I guess there is something that is adding them back in and what keeps ocming up in spybot is "WebDialer" and in adaware coolwebsearch keeps coming up, despite my attempts with CWShreddder. But anyway here is the file.


    Scan saved at 5:00:09 PM, on 6/9/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Norton AntiVirus\navapsvc.exe
    C:\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Registry Mechanic\RegMech.exe
    C:\Documents and Settings\Infamous\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    BaBang, Jun 9, 2004
    #1
  2. BaBang

    BaBang Private E-2

    Ok I think I got rid of it. Thanks for the help:rolleyes: . Just kidding, I'll post again if it comes back up.
     
    BaBang, Jun 9, 2004
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    BaBang, Did you cleanup that other stuff from your HijaakThis log, like:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\cjcen.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
     
    chaslang, Jun 9, 2004
    #3
  4. BaBang

    BaBang Private E-2

    Thankd for all the help guys and yes I did delete those thing that you just posted but they came back.
     
    BaBang, Jun 10, 2004
    #4
  5. General_Lee_Stoned

    General_Lee_Stoned BuZZed Lightyear

    Hi Babang, i would personally make sure you had all the latest updates for ad-aware and spybot, then reboot into safe mode and run the scans fix anything found, then find this (you will need to show hidden files and folders) and delete it
    C:\WINDOWS\System32\cjcen.dll/sp.html

    Try that and let us know how it goes
     
    General_Lee_Stoned, Jun 10, 2004
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    And in addition to what the General has said, while in safe mode run Hijaak This again and remove those lines again that have the cjcen.dll/sp.html stuff in them.
     
    chaslang, Jun 10, 2004
    #6
  7. BaBang

    BaBang Private E-2

    Ok, I did all of the stuff you said, i think it really helped, and I didn't find C:\WINDOWS\System32\cjcen.dll/sp.html

    Here's my new Hijackthis file just in case.


    Logfile of HijackThis v1.97.7
    Scan saved at 3:58:34 PM, on 6/10/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\Infamous\Desktop\HijackThis.exe
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {A1A86C06-5C2F-49B5-B983-67E46885BA3F} - C:\WINDOWS\System32\jgcnh.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O4 - HKLM\..\Run: [NAV Agent] C:\NORTON~2\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [WFXSwtch] C:\NORTON~2\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38148.4759027778
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    BaBang, Jun 10, 2004
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looking good BaBang!
     
    chaslang, Jun 10, 2004
    #8
  9. BaBang

    BaBang Private E-2

    But get this, after I posted that, I scanned agsin because my start page was reset again and all of this stuff came back.Logfile of HijackThis v1.97.7
    Scan saved at 4:21:22 PM, on 6/10/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\NORTON~2\NORTON~1\navapw32.exe
    C:\NORTON~2\WinFax\WFXSWTCH.exe
    C:\WINDOWS\System32\wfxsnt40.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\NORTON~2\SPEEDD~1\nopdb.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Infamous\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jgcnh.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {A1A86C06-5C2F-49B5-B983-67E46885BA3F} - C:\WINDOWS\System32\jgcnh.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O4 - HKLM\..\Run: [NAV Agent] C:\NORTON~2\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [WFXSwtch] C:\NORTON~2\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38148.4759027778
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    BaBang, Jun 10, 2004
    #9
  10. BaBang

    BaBang Private E-2

    Should I try it in safe mode again?
     
    BaBang, Jun 10, 2004
    #10
  11. BaBang

    BaBang Private E-2

    Ok, got it fixed again, hope it doesen't come back, Thank you so much everyone.
     
    BaBang, Jun 10, 2004
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you get it fixed for good? If so how? If not, we need to find out what is the cause of these new forms of hijackers. This is happening a lot lately. They are getting very stubborn.
     
    chaslang, Jun 11, 2004
    #12
  13. BaBang

    BaBang Private E-2

    Well, It jsut came back, I can only get it fixed for a short amount of time before it returns, I just don't know what to do now. :(There has to be some way, we just haveto figure it out.
     
    BaBang, Jun 11, 2004
    #13
  14. General_Lee_Stoned

    General_Lee_Stoned BuZZed Lightyear

    You really need to find that DLL and kill it, did you enable the show hidden files and folders option in windows explorer before looking for it
     
    General_Lee_Stoned, Jun 11, 2004
    #14
  15. BaBang

    BaBang Private E-2

    What DLL? Give me some file names to search for and I'll try to find them.
     
    BaBang, Jun 11, 2004
    #15
  16. BaBang

    BaBang Private E-2

    If your talkign about cjcen.dll, then yes I did and I didn't find anything, but i'm searching again.

    BTW, spybot keeps picking up a WebDialer that won't go away, if that helps any. And a DSO exploit.
     
    BaBang, Jun 11, 2004
    #16
  17. BaBang

    BaBang Private E-2

    Ok my computer found the dll file finally, it is a backdoor trojan but get this, it wont let me delete it or quarantine or heal it, because for somereason my access is denied. Here's the file C:\WINDOWS\system32\mso.dll
     
    BaBang, Jun 11, 2004
    #17
  18. BaBang

    BaBang Private E-2

    Update: After AVG finding the trojan and not letting me do anything to it, my computer mysteriously restarted and after the restart I ran, AVG, Norton, and The Cleaner, and now it doesen't detect it as a virus, although it's still there.
     
    BaBang, Jun 11, 2004
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try booting in safe mode and deleting it but disable system restore first. Then re-enable system restore later.
     
    chaslang, Jun 12, 2004
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I again suggest disabling system restore, booting in safe mode, and running all your scans (virus, trojans, Ad-aware, SpyBot S&D). Afterwards enable system restore again.
     
    chaslang, Jun 12, 2004
    #20
  21. BaBang

    BaBang Private E-2

    Ok here's another up date I deleted a Clfbel.dll and my problem hasn't come back. And my brother and I got into safe mode and the mso.dll file wasn't there. My brother said that since norton didn't pick it up it might not be a virus and AVG may have made a mistake, so we just forgot about it, so we kind of forgot about it. So I believe clfbel.dll ,that I deleted without system restore, was the problem. It was a BHO, BTW. But if my problem doesen't persist, I'll stick around and help others since this experiance has kindled a feeling to serve within me. I'll keep you updated.
     
    BaBang, Jun 12, 2004
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looking good BaBang. Keep us informed!
     
    chaslang, Jun 12, 2004
    #22

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds