1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

trojan virus?? regscan32 & winu32.exe

Discussion in 'Virus & Other Malware Removal' started by nampi, Sep 1, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    Hi guys. This is Hernan from Argentina.
    My Panda Antivirus had detected these 2 files trying to connect to the internet and I don’t have idea if they are viruses or what:
    - regscan32.exe
    - winu32.exe
    Anyway I’m having troubles using Outlook Express (I can’t send e-mails) and trying to see my webmail, and also I can't see the Hotmail page. Is this related with these files?? What should I do??
    Thanks a lot!!!
     
  2. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,382
    First Name:
    Derek
    They are either agobot or sdbot new varieties


    go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
    make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
    Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
    It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
    so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
     
  3. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    Logfile of HijackThis v1.98.2
    Scan saved at 22:48:29, on 01/09/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\ARCHIV~1\SaveNow\SaveNow.exe
    D:\AVG\avgserv.exe
    D:\Panda Antivirus\APVXDWIN.EXE
    C:\WINDOWS\System32\JulaPan.Exe
    C:\WINDOWS\System32\msg32.exe
    C:\WINDOWS\System32\winu32.exe
    C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
    C:\WINDOWS\System32\regscan32.exe
    C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
    D:\AVG\avgcc32.exe
    C:\WINDOWS\System32\nvsvc32.exe
    D:\Jukebox\mmtask.exe
    C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\System32\ctfmon.exe
    D:\Panda Antivirus\Firewall\PavFires.exe
    C:\Archivos de programa\Free Downloads Accelerator\fdaagent.exe
    D:\Panda Antivirus\pavsrv51.exe
    C:\WINDOWS\System32\svchost.exe
    D:\Panda Antivirus\AVENGINE.EXE
    D:\Panda Antivirus\pavProxy.exe
    C:\program files\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
    O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - D:\Download Accelerator\DAPBHO.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\acrobat\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: IE 4.x-6.x BHO for Free Downloads Accelerator - {98DE779A-2364-4293-AB71-2B97C61C4640} - C:\ARCHIV~1\FREEDO~1\fdahlp99.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - D:\Download Accelerator\DAPIEBar.dll
    O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\Archivos de programa\Free Downloads Accelerator\fdabar99.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\Epson\Ink Monitor\inkmonitor.exe
    O4 - HKLM\..\Run: [SaveNow] C:\ARCHIV~1\SaveNow\SaveNow.exe
    O4 - HKLM\..\Run: [SCANINICIO] "D:\Panda Antivirus\Inicio.exe"
    O4 - HKLM\..\Run: [APVXDWIN] "D:\Panda Antivirus\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
    O4 - HKLM\..\Run: [EW Message Server] msg32.exe
    O4 - HKLM\..\Run: [update service] winu32.exe
    O4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exe
    O4 - HKLM\..\Run: [SoniqueQuickStart] d:\Sonique\sqstart.exe -nostick
    O4 - HKLM\..\Run: [AVG_CC] D:\AVG\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [mmtask] D:\Jukebox\mmtask.exe
    O4 - HKLM\..\RunServices: [update service] winu32.exe
    O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
    O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm
    O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - D:\DOWNLO~1\DAP.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: ConferenceRoom Java Client - http://conectados.ciudad.com.ar/java/cr.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
     
  4. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,382
    First Name:
    Derek
    first copy these files and zip them and send to [email protected] with a short note referring to this thread

    C:\WINDOWS\System32\JulaPan.Exe <<< I can't find anything out about this one so want to examine it before doing anything with it
    C:\WINDOWS\System32\msg32.exe
    C:\WINDOWS\System32\winu32.exe

    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked


    O4 - HKLM\..\Run: [SaveNow] C:\ARCHIV~1\SaveNow\SaveNow.exe
    O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
    O4 - HKLM\..\Run: [EW Message Server] msg32.exe
    O4 - HKLM\..\Run: [update service] winu32.exe
    O4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exe
    O4 - HKLM\..\RunServices: [update service] winu32.exe
    O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exe


    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\System32\msg32.exe
    C:\WINDOWS\System32\winu32.exe

    and Delete these folders

    C:\Archivos de programa\SaveNow

    then go to C:\Documents and Settings\USER NAME\Local Settings\Temp and select everything in that folder and delete it

    as XP will not let you delete files less than 24 hours old as it thinks it might need them please also do this
    while in the temp folder, select view and select details.
    then right click a blank part and select arrange icons by, and select show in groups and modified, that will give a list of all files in date order with today at the top of the page.
    select all the files/folders except the today ones and delete them all.

    and select EVERYTHING in C:\windows\temp except temporary internet files, cookies and history folders and delete all that as well

    1) Open Control Panel
    2) Click on Internet Options
    3) On the General Tab, in the middle of the screen, click on Delete Files
    4) You may also want to check the box "Delete all offline content"
    5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
    6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive

    then
    Reboot normally &

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware SE from http://www.lavasoft.de/support/download


    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &

    Run ADAWARE

    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least SE1R5 22.08.2004 or a higher number/later date
    Then ........
    click the "Scan" button. and select full scan

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries. You can safely ignore any MRU entries though and not delete them

    reboot again

    then post a new hijackthis log to check what is left
     
  5. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,382
    First Name:
    Derek
    Hi Hernan

    the 2 files you sent me are both good

    as you say the C:\WINDOWS\System32\JulaPan.Exe is part of a soundcard

    and the C:\WINDOWS\System32\msg32.exe is something to do with your modem in this case

    to put them back as they MIGHT be needed do this

    open Hijackthis and press config/ backups select these 2 lines and press restore

    O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
    O4 - HKLM\..\Run: [EW Message Server] msg32.exe


    tehn if you ahve deleted the msg32.exe file go to recycle bin and select it & press restore

    Sorry about that but it looked like a bad one & I should have waited before deleting it

    It won't matter if it isn't there as it's a message server component of the modem and I have found very few if any people who actually use that facility in the conexant modem
     
  6. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    Hi! Here it's the new scan results with hijack. Let me know if I need to do something else. By the way I still can't send e-mails using Outlook Express using Hotmail accounts.
    I still have a copy of the julapan and msg32.exe, don't worry and thanks a lot, talk to you later,
    Hernan



    --------------------------------------------------------------------------------------------------------------------------------
    Logfile of HijackThis v1.98.2
    Scan saved at 12:20:04, on 02/09/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\devldr32.exe
    D:\AVG\avgserv.exe
    C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
    C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\nvsvc32.exe
    D:\Panda Antivirus\Firewall\PavFires.exe
    D:\Panda Antivirus\pavsrv51.exe
    C:\WINDOWS\System32\svchost.exe
    D:\Panda Antivirus\AVENGINE.EXE
    D:\Panda Antivirus\apvxdwin.exe
    D:\Panda Antivirus\pavProxy.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\WINDOWS\System32\JulaPan.Exe
    D:\AVG\avgcc32.exe
    D:\Jukebox\mmtask.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Archivos de programa\Free Downloads Accelerator\fdaagent.exe
    C:\program files\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\acrobat\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
    O2 - BHO: IE 4.x-6.x BHO for Free Downloads Accelerator - {98DE779A-2364-4293-AB71-2B97C61C4640} - C:\ARCHIV~1\FREEDO~1\fdahlp99.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\Archivos de programa\Free Downloads Accelerator\fdabar99.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\Epson\Ink Monitor\inkmonitor.exe
    O4 - HKLM\..\Run: [SCANINICIO] "D:\Panda Antivirus\Inicio.exe"
    O4 - HKLM\..\Run: [APVXDWIN] "D:\Panda Antivirus\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
    O4 - HKLM\..\Run: [SoniqueQuickStart] d:\Sonique\sqstart.exe -nostick
    O4 - HKLM\..\Run: [AVG_CC] D:\AVG\avgcc32.exe /startup
    O4 - HKLM\..\Run: [mmtask] D:\Jukebox\mmtask.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
    O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm
    O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
    O16 - DPF: ConferenceRoom Java Client - http://conectados.ciudad.com.ar/java/cr.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
     
  7. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    Hey the Spybot couldn’t fix some problems, I send you a .jpg file with the image.
     

    Attached Files:

  8. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    I already solved that Outlook Express problem.... I activated the cookies for Hotmail and now I can send and recieve emails normally.
    Anyway let me know how is my computer going after seeing the last hijack scan I sent you.
    Thanks. Have a good day!
    Hernan
     
  9. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Place a check by these entries and then click fix

    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

    Download Accelerator Plus is a program which is used to speed up and resume downloads. Although, I guess it has some spyware. If you didn't purposely instal this program, then remove the following:

    from hjt:
    O8 - Extra context menu item: &Download with &DAP - D:\DOWNLO~1\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - D:\DOWNLO~1\dapextie2.htm
    O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Archivos de programa\Free Downloads Accelerator\fdaie.htm


    Run spybot S&D again. (make sure all browser windows are closed).

    The program that I use which doesn't have any spy/ad/trackware is called FreshDownload. Do a google search for it if interested.
     
  10. nampi

    nampi Thread Starter

    Joined:
    Sep 1, 2004
    Messages:
    6
    Thanks for your reply. I have uninstalled the DAP and I'll get the FreshDownload later. Bytes!
    Hernan
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/269092

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice