Removing Spyware and Trojans From a Dell B110 Desktop PC
Posted: Sun Dec 07, 2008 8:46 pm
A friend of mine brought over a Dell Dimension B110 desktop PC that is a friends of a friends... He said it has a ton of spyware on it and that the owner has spent over $150 buying spyware programs online to remove them and now the PC blue screens. He gave me a $100 bill and said call him when it's down no rush.
The PC is from 2005 and is a snail from what we are all used to. I downloaded and tried SpyBot and AdAware and Spybot Blue Screens about 110,000 files into the ~340,000 file search on what looks like anebay toolbar thing. Adaware doesn't blue screen, but it gets stuck on a host file called http://www.avp.ru about 2 minutes 6 seconds into the run. I downloaded and ran Ccleaner and the active processes went from ~70 down to 34 now that I cleaned up all the startup crap. I installed Norton Anti-Virus 2009 and it runs through the system and just removed a single cookie and came book good on a full system scan... The system seems to run much faster now, but it worries me that both Spybot and Adaware get stuck. I thought it might be a memory issue so i removed the two 256MB sticks of memory and tossed in a 2GB kit that I have and still the same. Thought it might be heat and stuck a couple 120mm fans in there and used compressed air on the cpu heat sink and still no luck...
Right now I'm doing just stupid stuff to make the system faster like updating the BIOS and changing the hard disk performance level from 'quite' to 'performance'. Doing another defrag now...
If you guys have any ideas let me know!
Here are some screen shots of the scans...
1st up Spybot:
2nd up Full Scan of Norton:
Even though Spybot said it removed Asware.zangosearch it was still detected and removed by Norton
3rd up Adware, which quits at 2min 6 seconds and goes to this screen:
Here is the Current HiJackThis log:
The PC is from 2005 and is a snail from what we are all used to. I downloaded and tried SpyBot and AdAware and Spybot Blue Screens about 110,000 files into the ~340,000 file search on what looks like anebay toolbar thing. Adaware doesn't blue screen, but it gets stuck on a host file called http://www.avp.ru about 2 minutes 6 seconds into the run. I downloaded and ran Ccleaner and the active processes went from ~70 down to 34 now that I cleaned up all the startup crap. I installed Norton Anti-Virus 2009 and it runs through the system and just removed a single cookie and came book good on a full system scan... The system seems to run much faster now, but it worries me that both Spybot and Adaware get stuck. I thought it might be a memory issue so i removed the two 256MB sticks of memory and tossed in a 2GB kit that I have and still the same. Thought it might be heat and stuck a couple 120mm fans in there and used compressed air on the cpu heat sink and still no luck...
Right now I'm doing just stupid stuff to make the system faster like updating the BIOS and changing the hard disk performance level from 'quite' to 'performance'. Doing another defrag now...
If you guys have any ideas let me know!
Here are some screen shots of the scans...
1st up Spybot:
- run1.JPG (80.58 KiB) Viewed 6775 times
- norton.JPG (64.8 KiB) Viewed 6778 times
3rd up Adware, which quits at 2min 6 seconds and goes to this screen:
- adaware_scan.JPG (66.94 KiB) Viewed 6778 times
I'm 99% certain that zevehahu.dll is part of a trojan from years back, but Norton isn't getting it off. I did a google search on zevehahu.dll and only one site in the Google search engine mentions it.Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:29:37 PM, on 12/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\regsvr32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Belkin\F5D9050\Belkinwcui.exe
C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MJ\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://axiaecampus.phoenix.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://axiaecampus.phoenix.edu/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {517280d3-d46d-4c85-8f00-19d4c5b9e5ab} - C:\WINDOWS\system32\fafisaya.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: cpmsky browser enhancer - {A3AA4FD3-CDDD-2F71-9659-8A526609F56C} - C:\WINDOWS\system32\pdwzqnynrd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [slcdeshfpujqqpem] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\pdwzqnynrd.dll"
O4 - HKLM\..\Run: [bc438d76] rundll32.exe "C:\WINDOWS\system32\bufezeza.dll",b
O4 - HKLM\..\Run: [CPMbf70beea] Rundll32.exe "c:\windows\system32\bupudofa.dll",a
O4 - HKLM\..\Run: [fukuwusama] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s
O4 - HKUS\S-1-5-19\..\Run: [fukuwusama] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fukuwusama] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s (User 'NETWORK SERVICE')
O4 - Global Startup: Belkin Wireless Client Utility.lnk = C:\Program Files\Belkin\F5D9050\Belkinwcui.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4817136605
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/ ... leId=24931
O20 - AppInit_DLLs: c:\windows\system32\bupudofa.dll,C:\WINDOWS\system32\sidejasu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bupudofa.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bupudofa.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 7294 bytes
