Cannot remove spyware (I think it is spyware)

herura · January 20th, 2005, 07:53 PM

On Windows 2000 Server, I have a process called rqyokv.exe. Whenever I stop the process it restarts. I have even deleted the file from the system32 directory and all references to it in the registry, but it keeps coming back. References will reapear in the registry, the file will reapear in the system32 directory and it will reappear as a process in task manager. Google is no help. Has anyone seen this? I cannot determine the process that spawns it, I have used proecess explorer from sysinternals.com and it is no help. Under properties process explorer listed C:\Program Files\Common Files\SYSTEM\Mapi\1033\ as the current directory.

In the registry under the the run folder there is a object called Narrator that has this file as its application. I delete the key and it reapears.

What gives

Any help would be greatly appricated

nomaxim · January 21st, 2005, 09:59 AM

Have you run the basic anti-spyware programs. Ad-Aware, Spybot S&D?

Maybe even try the Microsoft beta Anti-spyware.

If you have then d/l Hijackthis, and post your log.

herura · January 21st, 2005, 12:44 PM

I took your suggestion and here is the log:
Logfile of HijackThis v1.99.0
Scan saved at 11:39:12 AM, on 1/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\WIN2K\System32\termsrv.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\spoolsv.exe
C:\WIN2K\System32\msdtc.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\system32\hidserv.exe
C:\WIN2K\System32\llssrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\MSTask.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\System32\inetsrv\inetinfo.exe
C:\WIN2K\system32\Dfssvc.exe
C:\WIN2K\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WIN2K\system32\spool\drivers\w32x86\3\hpztsb09. exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WIN2K\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WIN2K\system32\rqyokv.exe
C:\Data\Install\Old Hard Drive\Ra95\Downloads\Kiss Viewer\PLAYFKISS.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WIN2K\System32\sol.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\WIN2K\system32\NOTEPAD.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\norine.HOME.001\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.straightdope.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {DC5FBA19-7EA3-0909-879A-7BA2DBF73C9B} - C:\WIN2K\system32\ixtaovhq.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\norine.HOME.001\Local Settings\Temp\D.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WIN2K\system32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN2K\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Search Bar - {4E7BD74F-2B8D-469E-A1F6-FC7EB590A97D} - C:\WIN2K\DOWNLO~1\search3.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WIN2K\system32\spool\drivers\w32x86\3\hpztsb09. exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NovaNet-WEB Tray Control] C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Uabrkxe] C:\WIN2K\system32\??chost.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: NovaNet-WEB Backup Tray Control.lnk = C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O12 - Plugin for .MPG: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/016ee6e3...p/RdxIE601.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5205D90-DAEB-4F39-B74A-622110F83E84}: NameServer = 24.159.0.13,141.157.136.19
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe

Kuasimodem · January 21st, 2005, 01:53 PM

Get rid of the following lines:

O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {DC5FBA19-7EA3-0909-879A-7BA2DBF73C9B} - C:\WIN2K\system32\ixtaovhq.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\norine.HOME.001\Local Settings\Temp\D.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WIN2K\system32\msbe.dll

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Search Bar - {4E7BD74F-2B8D-469E-A1F6-FC7EB590A97D} - C:\WIN2K\DOWNLO~1\search3.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll

O4 - HKCU\..\Run: [Uabrkxe] C:\WIN2K\system32\??chost.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe

O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\win2k\system32\calsp.dll

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/016ee6e...ip/RdxIE601.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares...ysb_regular.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB

herura · January 22nd, 2005, 10:52 AM

Thanks for the help. I was able to remove all the items that Kuasimodem suggested, after much work as hijackthis did not remove all items for me, but once I removed them all my system appears clean. It even boots faster!

Thanks Again!

JPMiller · January 22nd, 2005, 11:11 AM

So what exactly do you look for in these logs?
I would like to post mine as well to be perused but I feel a bit guilty having some one else do something I should be able to...

herura · January 22nd, 2005, 01:56 PM

I think I spoke to soon. Another check revealed the process is back. My hijack log looks like this:

Logfile of HijackThis v1.99.0
Scan saved at 12:50:46 PM, on 1/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\WIN2K\System32\termsrv.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\spoolsv.exe
C:\WIN2K\System32\msdtc.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\system32\hidserv.exe
C:\WIN2K\System32\llssrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\MSTask.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\System32\inetsrv\inetinfo.exe
C:\WIN2K\system32\Dfssvc.exe
C:\WIN2K\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WIN2K\system32\spool\drivers\w32x86\3\hpztsb09. exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WIN2K\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
C:\WIN2K\system32\rqyokv.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WIN2K\System32\sol.exe
C:\Documents and Settings\norine.HOME.001\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.straightdope.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN2K\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WIN2K\system32\spool\drivers\w32x86\3\hpztsb09. exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NovaNet-WEB Tray Control] C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: NovaNet-WEB Backup Tray Control.lnk = C:\Program Files\NovaNet-WEB Backup\TrayControl.exe
O12 - Plugin for .MPG: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe

cryptoguy · January 22nd, 2005, 02:50 PM

One more line bothers me
C:\WIN2K\System32\sol.exe
Here's the definition and removal proggy of this file
That rqyokv.exe file sounds like a Trojan. Run your anti-virus program. What is it by the way?

edit: link fixed

herura · January 22nd, 2005, 05:39 PM

The SOL.exe program is solitaire. As for antivirus I use Bitdefender. It found nothing.

dchw_dude · January 22nd, 2005, 06:37 PM

Try a different program. many will find things that others do not(I used 3 spyware searchers)