Do I have a virus?

[allnighter]

Some program tries to send emails which are blocked by Norton, and Norton proxy window pops up and I have to click ok on about 60 of them.I scanned the pc with Norton and found nothing.I scanned it with Lavasofdt AdAware, and SpyBot and deleted all cookies and anything they found yesterday.Today I am back to square one.Does this virus reactivate every time I start the computer?

What solutions can you think of? (Please No get rid of Norton routine).

[BliarOut]

Find HijackThis through Google and post up a logfile.

[allnighter]

BliarOut said:

Find HijackThis through Google and post up a logfile.

Ok

[allnighter]

BliarOut said:

Find HijackThis through Google and post up a logfile.

Here we go:

Hijack said:

Logfile of HijackThis v1.99.1
Scan saved at 12:26:58, on 05/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSvcHst.exe
C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32umonit.exe
C:Program FilesVIAVIAudioiSBADeckADeck.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSSOUNDMAN.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesC-Organizer StdC-Organizer.exe
C:Program FilesCommon FilesSymantec SharedccSvcHst.exe
C:WINDOWSsystem32crypserv.exe
C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlservr.exe
C:WINDOWSsystem32 vsvc32.exe
C:WINDOWSsystem32svchost.exe
c:program filespinnacleshared filesprogramsmediaserverpmshost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32wuauclt.exe
C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
C:Program FilesSymantecLiveUpdateAUPDATE.EXE
C:Program FilesSymantecLiveUpdateLuCallbackProxy.exe
C:Program FilesSymantecLiveUpdateLuCallbackProxy.exe
C:Program FilesSymantecLiveUpdateLuCallbackProxy.exe
C:Program FilesSymantecLiveUpdateLuCallbackProxy.exe
C:Program FilesHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://news.sky.com/skynews/home
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkI
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkI
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkI
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkI
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:Program FilesCommon FilesSymantec SharedcoSharedBrowser1.5NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:Program FilesCommon FilesSymantec SharedcoSharedBrowser1.5UIBHO.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [UMonit] C:WINDOWSsystem32umonit.exe
O4 - HKLM..Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [AudioDeck] C:Program FilesVIAVIAudioiSBADeckADeck.exe 1
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [osCheck] "C:Program FilesNorton Internet SecurityosCheck.exe"
O4 - HKLM..Run: [PCLEPCI] C:PROGRA~1PinnaclePPEPPE.EXE
O4 - HKLM..Run: [PinnacleDriverCheck] C:WINDOWSsystem32\PSDrvCheck.exe
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Startup: C-Organizer Std.lnk = C:Program FilesC-Organizer StdC-Organizer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~4Office10EXCEL.EXE/3000
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:Program FilesCommon FilesMicrosoft SharedEncarta Search BarENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedVAScannercomHost.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:WINDOWSSYSTEM32crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:Program FilesNorton Internet SecurityisPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32 vsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:program filespinnacleshared filesprogramsmediaserverpmshost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:Program FilesSiSoftwareSiSoftware Sandra Lite XIWin32RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:Program FilesSiSoftwareSiSoftware Sandra Lite XIRpcSandraSrv.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe

This was done after I ran Spybot, before I posted the original message.

[BliarOut]

First thoughts, get rid of umonit.exe using HijackThis, reboot the machine and double check it's not put itself back.

[allnighter]

BliarOut said:

First thoughts, get rid of umonit.exe using HijackThis, reboot the machine and double check it's not put itself back.

I will report back later on this afternoon.I have to dash out to Cash & Carry.Thanks anyway.

[allnighter]

I think the file UMONIT.EXE has gone.Rebooted now and no sign of it.

Hijackthis said:

Logfile of HijackThis v1.99.1
Scan saved at 16:10:53, on 05/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSvcHst.exe
C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesVIAVIAudioiSBADeckADeck.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSSOUNDMAN.EXE
C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesC-Organizer StdC-Organizer.exe
C:Program FilesCommon FilesSymantec SharedccSvcHst.exe
C:WINDOWSsystem32crypserv.exe
C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlservr.exe
C:WINDOWSsystem32 vsvc32.exe
C:WINDOWSsystem32svchost.exe
c:program filespinnacleshared filesprogramsmediaserverpmshost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesMicrosoft SharedWorks Sharedwkcalrem.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://news.sky.com/skynews/home
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkI
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkI
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkI
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkI
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:Program FilesCommon FilesSymantec SharedcoSharedBrowser1.5NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:Program FilesCommon FilesSymantec SharedcoSharedBrowser1.5UIBHO.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [AudioDeck] C:Program FilesVIAVIAudioiSBADeckADeck.exe 1
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [osCheck] "C:Program FilesNorton Internet SecurityosCheck.exe"
O4 - HKLM..Run: [PCLEPCI] C:PROGRA~1PinnaclePPEPPE.EXE
O4 - HKLM..Run: [PinnacleDriverCheck] C:WINDOWSsystem32\PSDrvCheck.exe
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Startup: C-Organizer Std.lnk = C:Program FilesC-Organizer StdC-Organizer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~4Office10EXCEL.EXE/3000
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:Program FilesCommon FilesMicrosoft SharedEncarta Search BarENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedVAScannercomHost.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:WINDOWSSYSTEM32crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:Program FilesNorton Internet SecurityisPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32 vsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:program filespinnacleshared filesprogramsmediaserverpmshost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:Program FilesSiSoftwareSiSoftware Sandra Lite XIWin32RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:Program FilesSiSoftwareSiSoftware Sandra Lite XIRpcSandraSrv.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:Program FilesPinnacleMediaServerMicrosoft SQL ServerMSSQL$PINNACLESYSBinnsqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe

Anymore stuff I need to take out or is that it Bliarout?
Cheers.

[BliarOut]

How's it behaving now? There's nothing jumping out at me there that screams malware at the moment.

[allnighter]

BliarOut said:

How's it behaving now? There's nothing jumping out at me there that screams malware at the moment.

Ok after rebooting Spybot scan returned the same cookies it deleted earlier.

Here is the list produced by Spybot:

1.Avenue A,Inc.(tracking cookie internet explorer)
Internet explorer (my name):Cookie:my [e-mail]/()

2.DoubleClick. (Tracking cookie etc... same as above :my [e-mail]/ ()

3.MediaPlex.(Tracking cookie etc...: my [e-mail]/ ()

I thought the above were deleted, but they come back upon reboot, and no I have not been to any dodgy porn website and did not download anything dodgy.

[bigdods]

Download AVG free edition from www.download.com, disable Norton, install and run AVG (not forgetting to get all the updates!). AVG *might* pick up something Norton missed, costs nothing but a few minutes of your time to try it.

[paulmjg66]

allnighter said:

BliarOut said:

How's it behaving now? There's nothing jumping out at me there that screams malware at the moment.

Ok after rebooting Spybot scan returned the same cookies it deleted earlier.

Here is the list produced by Spybot:

1.Avenue A,Inc.(tracking cookie internet explorer)
Internet explorer (my name):Cookie:my [e-mail]/()

2.DoubleClick. (Tracking cookie etc... same as above :my [e-mail]/ ()

3.MediaPlex.(Tracking cookie etc...: my [e-mail]/ ()

I thought the above were deleted, but they come back upon reboot, and no I have not been to any dodgy porn website and did not download anything dodgy.

hi,i have spyware doctor installed,not free,but has deleated some nasty *hit permanently,including trojans and nasty cookies.