1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

MSupdater

Discussion in 'Virus & Other Malware Removal' started by BobbyT, Oct 12, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. BobbyT

    BobbyT Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    17
    Hello,

    It looks like you guys have a great thing going here. I turned my comp on tonight and my Norton's Internet Security flashed up MSupdater trying to launch an install. I put a stop on it and started surfing the web. I clicked on the link to your page from Google since the only other link I found on Yahoo they think it is a new virus.

    Anyway my problem is how do I get rid of it, Msupdater? I went to Spybot and tried to run the free checker but it say's the file is corrupted. I also went to Lava as you guys indicated to do before posting but could not find what I needed to download there. My third stop was the Hijackthis part and I ran it. Below you will see a posting of that info. Could someone instruct me on my next step please? I would really like to get this and anything else that should not be on my pc off.

    Thanks very much for any info or help you can give.

    Logfile of HijackThis v1.97.3
    Scan saved at 7:39:02 PM, on 10/12/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Norton Internet Security\NISSERV.EXE
    C:\Program Files\Norton Internet Security\SymProxySvc.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\Norton Internet Security\IAMAPP.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\WINDOWS\NCLAUNCH.EXe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Norton Internet Security\ATRACK.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Microsoft Money\System\urlmap.exe
    C:\Documents and Settings\Main\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ewebsearch.net/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/www.searchv.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://search.unipages.cc/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.unipages.cc/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchv.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/search.php?qq=%s
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.ewebsearch.net/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINDOWS\winshow.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O4 - Global Startup: MSupdater.exe
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: MoneySide (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com/start.html
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://www.spywarenuker.com/product/camp/SpywareNuker_com/SpywareNukerInstaller.exe
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs1b.instantservice.com/jars/customerxsigned35.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37906.6661111111
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

    Thanks again for any help or opinion's
    Bobby
     
  2. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    BobbyT

    Welcome to TSG!

    Click on the link below and it will download CWShredder. Close all browser windows. UnZip it and click on the cwshredder.exe and let it do it's thing.

    http://www.spychecker.com/download/download_cwshredder.html

    When it is finished restart your computer.


    Next run Hijack This again and put a check by any of these that are left. Close all browser windows and "Fix checked"

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ewebsearch.net/sp.htm

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/www.searchv.com/search.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://search.unipages.cc/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.unipages.cc/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchv.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/search.php?qq=%s

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.ewebsearch.net/

    O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINDOWS\winshow.dll

    O4 - Global Startup: MSupdater.exe

    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll

    O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://www.spywarenuker.com/product...erInstaller.exe

    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab

    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab

    Restart to Safe Mode: press f8 on startup and select Safe Mode from the boot menu.

    In Safe Mode delete:

    The C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MSupdater.exe file


    Now download LSPfix here: http://www.cexx.org/lspfix.htm

    Launch the application, and click the "I know what I'm doing" checkbox.

    Check all instances of msspi.dll (and nothing else) , and move them to the "Remove" pane.
    Then click Finish.

    Now start your computer in Safe Mode, and find and delete the c:\windows\system32\msspi.dll file itself

    Go here http://www.lavasoftusa.com/software/adaware/ and download Adaware 6

    Install the program and launch it.

    I strongly recommend that you read the help file to familiarize yourself with the program.

    Before running the scan look at the top of the main window and you will see a Gear Icon. This is where you configure the settings. Click on that and then in the next window that pops up click on the "Scanning" tab on the left side. Under "Drives and Folders" put a check by "Scan within archives" and below that under "Memory and Registry" put a check by all the options there.
    The click on the "Tweak" tab and under "Scanning engine" put a check by "Unload recognized processes during scanning" ...........then......under "Cleaning engine" put a ckeck by "Automatically try to unregister objects prior to deletion" and "Let windows remove files in use at next reboot" then click "Proceed"

    Next in the main window look in the bottom right corner and click on "Check for updates now" and get the latest referencefiles.
    After getting the latest referencefiles you are ready to scan.

    Click "Start" and in the next window make sure "Active in depth scanning" is checked then click "Next" and the scan will begin.

    When it is finished let it fix everything it finds.

    Restart your computer.

    Then go here http://spybot.eon.net.au/index.php?lang=en&page=download and download Spybot.

    Install the program and launch it.

    Before scanning press "Online" and "Search for Updates" .

    Put a check mark at and install all updates.

    Click "Check for Problems" and when the scan is finished let Spybot fix/remove all it finds.

    Restart your computer.

    Be sure and take advantage of the "Immunize" feature in Spybot.

    Finally go here http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?;act=ST;f=38;t=3051 for info on how this happens and how to help prevent future attacks.
    On this page you will find links to Javacool's SpywareBlaster and SpywareGuard. Get them both and check for updates frequently.
    The Immunize feature in Spybot used in conjunction with SpywareBlaster , SpywareGuard and weekly scans with Spybot and Adaware will go a long way toward keeping you spyware free.

    Important!: ALWAYS check for updated detections and referencefiles before scanning with Spybot and Adaware. And be sure to check for updates to SpywareBlaster and SpywareGuard on a weekly basis.
     
  3. BillC

    BillC

    Joined:
    May 28, 2003
    Messages:
    2,366
    I did fid this aout MSUpdater:
     
  4. BobbyT

    BobbyT Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    17
    Hello again,

    I had to go to work last night so I am just getting to do this now.
    I have my other infected PC in safemode at the moment but the MSupdater file is not there to delete. All of the above steps have been follow and I was to go in and delete the MSupdater.exe file. Has it hidden itself? Should I just continue on with the steps since it is not showing by skipping the deleting of the file MSupdater.exe?

    Also another quick question I should leave safemode and restart in regular mode both times to download the LSP fix and the Adaware 6 correct?

    Thanks so much for the help you are giving.

    BobbyT
     
  5. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Yes you have to leave safe mode to dowload and run LSP fix and Adaware.

    The msupdater.exe file may have hidden attributes. Make sure "show hidden files" is checked in Folder options > View and search for it again.
     
  6. BobbyT

    BobbyT Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    17
    Ok I did the "show hidden files" and it's still not seeing it.
    Last night I did see it there without the "shf" being clicked. Could the cwshredder have deleted it? Just wanting to get the step's right here not meaning to bother you so much.
    So just keep moving forward with the rest of the steps yes?

    Thanks again
    BobbyT
     
  7. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Yes I'm sure that CWshredder took care of the file. I completely forgot that you had run it.

    Yes keep moving forward.

    It is no bother at all!:)
     
  8. BobbyT

    BobbyT Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    17
    All is done, I cannot thank you enough for all of your help.
    You guys really rock!
    Thanks so much for the fantastic help.

    After going thru this I started thinking about how I could have gotten this virus. I run Norton's Int Sec and Norton's Virus Scan on my pc at all times. I think the other day when I hit a website I got a Norton's Virus Alert and clicked the X box instead of the Quarintine. I will know better next time and maybe this info will help out others.

    Thanks again for the help and God Bless!
     
  9. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    You're welcome. Glad we were able to help. (y)

    Happy surfing! :D
     
  10. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/171525

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice