trojan virus?? regscan32 & winu32.exe

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

nampi

Thread Starter
Joined
Sep 1, 2004
Messages
6
Hi guys. This is Hernan from Argentina.
My Panda Antivirus had detected these 2 files trying to connect to the internet and I don’t have idea if they are viruses or what:
- regscan32.exe
- winu32.exe
Anyway I’m having troubles using Outlook Express (I can’t send e-mails) and trying to see my webmail, and also I can't see the Hotmail page. Is this related with these files?? What should I do??
Thanks a lot!!!
 

dvk01

Derek
Retired Moderator Retired Malware Specialist
Joined
Dec 14, 2002
Messages
56,452
They are either agobot or sdbot new varieties


go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.
 

nampi

Thread Starter
Joined
Sep 1, 2004
Messages
6
Logfile of HijackThis v1.98.2
Scan saved at 22:48:29, on 01/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\devldr32.exe
C:\ARCHIV~1\SaveNow\SaveNow.exe
D:\AVG\avgserv.exe
D:\Panda Antivirus\APVXDWIN.EXE
C:\WINDOWS\System32\JulaPan.Exe
C:\WINDOWS\System32\msg32.exe
C:\WINDOWS\System32\winu32.exe
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\regscan32.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
D:\AVG\avgcc32.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Jukebox\mmtask.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\ctfmon.exe
D:\Panda Antivirus\Firewall\PavFires.exe
C:\Archivos de programa\Free Downloads Accelerator\fdaagent.exe
D:\Panda Antivirus\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
D:\Panda Antivirus\AVENGINE.EXE
D:\Panda Antivirus\pavProxy.exe
C:\program files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - D:\Download Accelerator\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\acrobat\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IE 4.x-6.x BHO for Free Downloads Accelerator - {98DE779A-2364-4293-AB71-2B97C61C4640} - C:\ARCHIV~1\FREEDO~1\fdahlp99.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - D:\Download Accelerator\DAPIEBar.dll
O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\Archivos de programa\Free Downloads Accelerator\fdabar99.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\Epson\Ink Monitor\inkmonitor.exe
O4 - HKLM\..\Run: [SaveNow] C:\ARCHIV~1\SaveNow\SaveNow.exe
O4 - HKLM\..\Run: [SCANINICIO] "D:\Panda Antivirus\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "D:\Panda Antivirus\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [EW Message Server] msg32.exe
O4 - HKLM\..\Run: [update service] winu32.exe
O4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exe
O4 - HKLM\..\Run: [SoniqueQuickStart] d:\Sonique\sqstart.exe -nostick
O4 - HKLM\..\Run: [AVG_CC] D:\AVG\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [mmtask] D:\Jukebox\mmtask.exe
O4 - HKLM\..\RunServices: [update service] winu32.exe
O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - D:\DOWNLO~1\DAP.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: ConferenceRoom Java Client - http://conectados.ciudad.com.ar/java/cr.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
 

dvk01

Derek
Retired Moderator Retired Malware Specialist
Joined
Dec 14, 2002
Messages
56,452
first copy these files and zip them and send to [email protected] with a short note referring to this thread

C:\WINDOWS\System32\JulaPan.Exe <<< I can't find anything out about this one so want to examine it before doing anything with it
C:\WINDOWS\System32\msg32.exe
C:\WINDOWS\System32\winu32.exe

Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked


O4 - HKLM\..\Run: [SaveNow] C:\ARCHIV~1\SaveNow\SaveNow.exe
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [EW Message Server] msg32.exe
O4 - HKLM\..\Run: [update service] winu32.exe
O4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exe
O4 - HKLM\..\RunServices: [update service] winu32.exe
O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exe


Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
then as some of the files or folders you need to delete may be hidden do this:
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Delete these files

C:\WINDOWS\System32\msg32.exe
C:\WINDOWS\System32\winu32.exe

and Delete these folders

C:\Archivos de programa\SaveNow

then go to C:\Documents and Settings\USER NAME\Local Settings\Temp and select everything in that folder and delete it

as XP will not let you delete files less than 24 hours old as it thinks it might need them please also do this
while in the temp folder, select view and select details.
then right click a blank part and select arrange icons by, and select show in groups and modified, that will give a list of all files in date order with today at the top of the page.
select all the files/folders except the today ones and delete them all.

and select EVERYTHING in C:\windows\temp except temporary internet files, cookies and history folders and delete all that as well

1) Open Control Panel
2) Click on Internet Options
3) On the General Tab, in the middle of the screen, click on Delete Files
4) You may also want to check the box "Delete all offline content"
5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive

then
Reboot normally &

Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

Spybot - Search & Destroy from http://security.kolla.de
AdAware SE from http://www.lavasoft.de/support/download


Run Sybot S&D

After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

then reboot &

Run ADAWARE

Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
the current ref file should read at least SE1R5 22.08.2004 or a higher number/later date
Then ........
click the "Scan" button. and select full scan

When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries. You can safely ignore any MRU entries though and not delete them

reboot again

then post a new hijackthis log to check what is left
 

dvk01

Derek
Retired Moderator Retired Malware Specialist
Joined
Dec 14, 2002
Messages
56,452
Hi Hernan

the 2 files you sent me are both good

as you say the C:\WINDOWS\System32\JulaPan.Exe is part of a soundcard

and the C:\WINDOWS\System32\msg32.exe is something to do with your modem in this case

to put them back as they MIGHT be needed do this

open Hijackthis and press config/ backups select these 2 lines and press restore

O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [EW Message Server] msg32.exe


tehn if you ahve deleted the msg32.exe file go to recycle bin and select it & press restore

Sorry about that but it looked like a bad one & I should have waited before deleting it

It won't matter if it isn't there as it's a message server component of the modem and I have found very few if any people who actually use that facility in the conexant modem
 

nampi

Thread Starter
Joined
Sep 1, 2004
Messages
6
Hi! Here it's the new scan results with hijack. Let me know if I need to do something else. By the way I still can't send e-mails using Outlook Express using Hotmail accounts.
I still have a copy of the julapan and msg32.exe, don't worry and thanks a lot, talk to you later,
Hernan



--------------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.98.2
Scan saved at 12:20:04, on 02/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\devldr32.exe
D:\AVG\avgserv.exe
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Panda Antivirus\Firewall\PavFires.exe
D:\Panda Antivirus\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
D:\Panda Antivirus\AVENGINE.EXE
D:\Panda Antivirus\apvxdwin.exe
D:\Panda Antivirus\pavProxy.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\JulaPan.Exe
D:\AVG\avgcc32.exe
D:\Jukebox\mmtask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Free Downloads Accelerator\fdaagent.exe
C:\program files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\acrobat\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: IE 4.x-6.x BHO for Free Downloads Accelerator - {98DE779A-2364-4293-AB71-2B97C61C4640} - C:\ARCHIV~1\FREEDO~1\fdahlp99.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\Archivos de programa\Free Downloads Accelerator\fdabar99.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\Epson\Ink Monitor\inkmonitor.exe
O4 - HKLM\..\Run: [SCANINICIO] "D:\Panda Antivirus\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "D:\Panda Antivirus\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [SoniqueQuickStart] d:\Sonique\sqstart.exe -nostick
O4 - HKLM\..\Run: [AVG_CC] D:\AVG\avgcc32.exe /startup
O4 - HKLM\..\Run: [mmtask] D:\Jukebox\mmtask.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: ConferenceRoom Java Client - http://conectados.ciudad.com.ar/java/cr.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
 

nampi

Thread Starter
Joined
Sep 1, 2004
Messages
6
I already solved that Outlook Express problem.... I activated the cookies for Hotmail and now I can send and recieve emails normally.
Anyway let me know how is my computer going after seeing the last hijack scan I sent you.
Thanks. Have a good day!
Hernan
 
Joined
Feb 15, 2004
Messages
826
Place a check by these entries and then click fix

O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

Download Accelerator Plus is a program which is used to speed up and resume downloads. Although, I guess it has some spyware. If you didn't purposely instal this program, then remove the following:

from hjt:
O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm


Run spybot S&D again. (make sure all browser windows are closed).

The program that I use which doesn't have any spy/ad/trackware is called FreshDownload. Do a google search for it if interested.
 

nampi

Thread Starter
Joined
Sep 1, 2004
Messages
6
Thanks for your reply. I have uninstalled the DAP and I'll get the FreshDownload later. Bytes!
Hernan
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top