Unknown Messenger Service pop-up

Hi again picca
Could you post a HJT log please,
I don't think we ever finished up from the last time

Well, this Infection that the PC having now will not let me run Hijackthis. Isn't he smart?

Download CWShredder Here to its own folder.

Update CWShredder

• Open CWShredder and click I AGREE
  
• Click Check For Update
  
• Close CWShredder
  

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about. Reboot your computer into normal windows.
See if you can run HJT now

Hi Don,

I run CWShredder but detected nothing.
I tried to run Hijackthis in Safemode and have this. but wonder if it helps.

Oh yeah, the pop-up are gone after I restarted my PC. I'm uable to view Task Manager by clicking Ctrl+Alt+Del. The window will close very quickly b4 I even have the chance of looking at it.

Logfile of HijackThis v1.99.1
Scan saved at 10:44:30 PM, on 12/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\download\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [Windows Services] spoolsvc.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\kaqiyo.exe reg_run
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [Windows Automatical Updater] dcz.exe
O4 - HKLM\..\Run: [symwsc.exe] C:\ssdg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\RunServices: [Windows Services] spoolsvc.exe
O4 - HKLM\..\RunServices: [Windows Automatical Updater] dcz.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Services] spoolsvc.exe
O4 - HKCU\..\Run: [Windows Automatical Updater] dcz.exe
O4 - HKCU\..\RunServices: [Windows Services] spoolsvc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Efficient Networks\Tango Manager\app\TangoService.exe

This isn't the same computer we worked on earlier is it ?

You have some nasty infections there and not very fun to get rid of
I need to see another log in fact I will need to see 2 of them but for right now lets start with this one


Download winpfind

Extract WinPFind.zip to your c:\ folder.

Reboot your computer into Safe Mode

Then open c:\WinPFind and double-click on WinPFind.exe. When the program is open, click on the Start Scan button to scart scanning your computer. Be patient as this scan may take a while. When it is done, it will show a log and tell you the scan is completed. Reboot your computer back to normal mode and and post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.


I will be gone in a bit for the rest of the day and may not get back to this till late tonight or tomorrow so don't get impatient on me


Don

Sorry one more thing I need as well for right now

• Start HijackThis
  
• Click on the Config button
  
• Click on the Misc Tools button
  
• Click on the Open Uninstall Manager button.
  
• You can click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad into this topic please,
  
  

May take you a couple replies to fit the first log in do the uninstall list as a seperate reply please,



I would strongly recommend that you don't use this computer for any online baking or such the system has been severally compromised
You have a couple very nasty Trojans and worms that steal passwords. Try and stay offline with this computer

Re: Unknown Messenger Service pop-up


I got that too.

http://elamb.blogharbor.com/hacked/messagefromsystemalert.htm

Look at the link above. Do any of the messages that appear on that page, look familiar? If so, try getting yourself a firewall. Zone Alarm is free, Symmantec is good and so is Mcaffee.

First thing's first, however, I suggest you go to http://www.itc.virginia.edu/desktop/docs/messagepopup/ and read what they have to say about it. Someone is exploiting your messenger service to trick you into downloading things.

Ignore the messages completely.

While not addressing other probable yuckware issues on that apparently wide-open, unpatched, unprotected machine, Steve Gibson's Shoot The Messenger will shut off those annoying Windows Messenger Service dependent popups while not interfering with common chat or instant messaging clients.

As for anything else affecting the machine represented by the logs posted here by picca, there is little to no point tackling the assorted infections indicated absent at least the application of Windows XP Service Pack 1; nothing of substance can be accomplished absent that and its associated subsequent pre-Service Pack 2 required critical updates at a minimum.