[harryvm]

I am having some difficulties deleting several related 'rogue' programs. They have been placed in folder c:\program files\vptqwpvp and are called: GEADGsBN.exe; GEADGsBN.DLL; NBsGDAEG.exe; cnml.exe and profile.dat.

When I use Taskmaster to stop the process it appears to stop them but they return almost immediately. I deleted all references to them in the Registry that I could find (but obviously missed some), and I have tried to delete them, but am denied permission because they are being used.

What are these files? What damage can they do (they appear to be related to Outlook Express and caused several reboots when I tried to use OE).

How can I get rid of them?

Thanks

harryvm

 

[telecom69]

Go here and do an online scan http://housecall.trendmicro.com/housecall/start_corp.asp

Do you have Spybot and adaware installed on your computer?

 

[harryvm]

I'll try that - thanks. Yes, I have both spybot and adaware - neither have been of help with this problem. I've also tried HijackThis and it won't delete the files. Even flagging them to be deleted at the next bootup, using the HijackThis start-up add-on, hasn't worked. I'll keep trying.

 

[telecom69]

Did you try to fix them with hijack in SAFE MODE ? that will sometimes work ......

 

[harryvm]

I've now tried the TrendMicro scan - it didn't designate these files as virus or other risk factors and accepted them.

I'll try hijack in safe mode.

 

[harryvm]

Tried to fix it in safe mode, and in safe mode with prompt. Neither worked. With hijack it appeared to 'fix' it but the file GEADGsBN.exe immediately returned. In prompt mode it wouldn't delete the files : "Access denied or file in use".

Any other suggestions? Is it doing any damage? My computer appears to be OK at the moment and is managing email once more - but I don't like having programs on my system which I haven't put there (at least, not purposely) and which can't be switched off or deleted.

 

[ohheck]

im guessing they are some nasty spyware - adware progs that refuse to go away-
had a similar thing a while back and it was hard as hell to get rid of
the file names are random so you wont find any info on google either
If you are comfortable messing with your registry search for all references to GEADGsBN.exe GEADGsBN.DLL NBsGDAEG.exe and cnml.exe - it may give you a clue what is making the program run - [i'd say delete all references to them but do so at your own risk!]
go here-
http://www.subratam.org/?page=removal
at least d/l cwshredder, pv.zip and vx2 finder - may help
also consider this- it's free and easy to use
http://www.javacoolsoftware.com/spywareblaster.html

 

[harryvm]

Thanks, I'll try them all! What a waste of time though!

 

[WhitPhil]

Fastest and easiest?

Post the HJT log in the Security Forum for review.

 

[harryvm]

I've tried the lot - still no change. I clean the entry from the registry and when I reboot it's there again! Any other ideas?

 

[harryvm]

Here it is:

Logfile of HijackThis v1.99.0
Scan saved at 4:24:10 PM, on 17/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\pmsvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\vptqwpvp\GEADGsBN.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\PROGRA~1\vptqwpvp\NBsGDAEG.exe
C:\Program Files\MagicKey\MagicKey.exe
C:\Program Files\MagicKey\OSD.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\xplorer2\xplorer2_UC.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CamMonitor] G:\Photo\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] G:\Photo\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus CX3100] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3100" /O6 "USB001" /M "Stylus CX3100"
O4 - Global Startup: Magic Keyboard.lnk = C:\Program Files\MagicKey\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Intel(R) 82865G Graphics Controller Power Management - Intel Corporation - C:\WINNT\System32\pmsvc.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

 

[telecom69]

Since you obviously know what you are doing and have tried almost everything I will get you some better advice on this from the Moderators

 

[harryvm]

Thanks for your help so far (my comment about the 'waste of time' wasn't directed at your proposals - it was my frustration at being 'infected' by such software/spyware/whatever). As for knowing what I'm doing - I doubt it. I have also posted the HJT log on the security web site.

 

[telecom69]

I understand your frustration hang in there help will be with you shortly ...

 

[Gazornenplat]

Sounds like one of the shedloads of 'backdoor....' viruses. Your AV should have picked it up. If you don't have an up to date one, try the free AVG one (http://free.grisoft.com/freeweb.php/doc/2/). Most aren't actually dangerous in themselves, but delete your antivirus and expose you that way, add keyloggers, open up backdoors etc

It creates random file names, so it sounds like you have windows system restore turned on which (very usefully) restores viruses if you ever manage to delete them. Seek professional help! from nai or cai etc

Ian

 

[harryvm]

Hi Ian,

I have Symantic anti virus software fully updated and it hasn't picked it up. Nor have any of the web-based detectors I have used over the past 24 hours. I think you are right about its nature - but I'm not sure why no av program is picking it up.

 

[dvk01]

As this has now been posted in security I will close this thread and please continue here
http://forums.techguy.org/showthread.php?t=320227