TechSpot

Hacktool.Rootkit and HijackThis

By yoyotek
Oct 6, 2005
  1. Google led me here.
    1st time here.

    I put the Hijack off the Desktop, did the Safe Mode but don't see the lines like in other threads.
    My NIS 2005 pops up the Hacktool.
    Just ran MS Antispyware...was clean
    puke:

    See any gotchas on the list??
     
  2. yoyotek

    yoyotek TS Rookie Topic Starter

    Newer Highjack scan

    has the 023 list
     
  3. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Rootkit:
    http://www.trendmicro-middleeast.co...p?LYstr=VMAINDATA&vNav=1&VName=TROJ_ROOTKIT.N

    Boot in Safe Mode, see how here.
    Switch System restore OFF, see how here.
    In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here.

    Next, open Windows Task Manager by pressing CTRL+ALT+DELETE.
    Click the Processes tab, select the process (if there) and click End Process for:
    ViewMgr.exe
    exec.exe
    othb.exe
    ?hkntfs.exe

    Next, click on Start/Run and type in (followed by press Enter):
    regsvr32 /u C:\Program Files\nzsearch\nzsearchenh.dll

    Next, click Start/Control Panel/Add/Remove Programs. If there, UNinstall anything to do with:
    C:\Program Files\NetZero\exec.exe
    C:\Program Files\nzsearch\nzsearchenh.dll <<== probably part of NetZero
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
    ...................................................................................................
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../sbcydsl/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
    R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\nzsearch\nzsearchenh.dll
    O2 - BHO: AIMSite Class - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} - C:\Program Files\AIM Toolbar\aimhelper.dll (file missing)
    O2 - BHO: (no name) - {F8F4FDCB-3452-6CA0-5276-3926502B62B8} - C:\WINDOWS\System32\bncssjvd.dll (file missing)
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
    O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\James\Application Data\othb.exe
    O4 - HKCU\..\Run: [Cuvviocx] C:\WINDOWS\System32\?hkntfs.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
    O15 - Trusted Zone: http://www.adventistforum.com
    O15 - Trusted Zone: http://www.clubadventist.com
    Fix ALL your O16 - DPF: entries
    ...................................................................................................
    Now click on the Fix Checked button in HJT. Exit HJT.

    When done, from between the above dotted lines, delete the highlighted bold files.
    When a \directory-name\ is bold, delete everything in it, including that directory itself.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Rightclick IE on the desktop, select Properties, click on Delete Cookies, and Delete Files.
    Delete ALL files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
    XP only: Delete ALL files from C:\WINDOWS\Prefetch.
    Boot normal. When all OK, switch System Restore back on.

    Get deletefxpfiles here http://www.deletefxpfiles.com/index2.html to get rid
    of ?hkntfs.exe if you can't delete it normally.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...