Can't get rid of this

wireneck · September 14, 2008

I keep getting a pop up through Internet explorer (which I don't use to browse) which states that my system privacy etc.. may be at stake. The message is similar to the winAntivirus etc.. but it tries to get me to install PC Privacy Cleaner. If I close it out, it pops back up about 20 minutes later. MAlwarebytes keeps detecting Pc Privacy cleaner but it never actually gets rid of it? Spybot search and destroy doesnt even detect it (which I normally have success with) I have tried it in safe mode with little success. I have tried googling for more information but I haven't seen anything that looks exactly like this. I am thinking it is a new variant? I am running windows Xp if this matters. Not sure if this is where this goes, this is my first post. Sorry if it is in the wrong place.

Any help or advice greatly appreciated.

JeanInMontana · September 14, 2008

Hi Wireneck and welcome to Malwarebytes. Follow the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936 and someone will be happy to help you.

wireneck · September 15, 2008

Hi Wireneck and welcome to Malwarebytes. Follow the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936 and someone will be happy to help you.

Thanks Jean, here are my logs.

Malwarebytes' Anti-Malware 1.28

Database version: 1151

Windows 5.1.2600 Service Pack 2

9/14/2008 5:14:11 PM

mbam-log-2008-09-14 (17-14-11).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 103959

Time elapsed: 31 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\PCPrivacyCleaner (Rogue.PCPrivacyCleaner) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-09-14 19:56:56

PROTECTIONS: 0

MALWARE: 8

SUSPECTS: 0

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00249874 application/alfacleaner HackTools No 0 Yes No c:\documents and settings\owner\application data\skinux

00519333 Application/Processor HackTools No 0 Yes No C:\System Volume Information\_restore{47D617EF-D3E7-4725-81A4-DA2CAC53DC54}\RP143\A0050971.exe

03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\WINDOWS\system32:wupdate.exe

03610262 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{47D617EF-D3E7-4725-81A4-DA2CAC53DC54}\RP142\A0049969.dll

03610263 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{47D617EF-D3E7-4725-81A4-DA2CAC53DC54}\RP142\A0049970.dll

03610264 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{47D617EF-D3E7-4725-81A4-DA2CAC53DC54}\RP142\A0049971.dll

03620380 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\Documents and Settings\Owner\Local Settings\Temp\sfsrv.exe

03620380 Adware/RogueAntimalware2008 Adware Yes 0 Yes No C:\DOCUME~1\Owner\LOCALS~1\Temp\sfsrv.exe

03644242 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{47D617EF-D3E7-4725-81A4-DA2CAC53DC54}\RP142\A0049967.dll

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location N.

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description N.

;===============================================================================

================================================================================

=

===================

182048 HIGH MS07-069 N.

176382 HIGH MS07-057 N.

170907 HIGH MS07-046 N.

170906 HIGH MS07-045 N.

170904 HIGH MS07-043 N.

164913 HIGH MS07-033 N.

160623 HIGH MS07-027 N.

150253 HIGH MS07-016 N.

;===============================================================================

================================================================================

=

===================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:58:50 PM, on 9/14/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\DOCUME~1\Owner\LOCALS~1\Temp\sfsrv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

C:\Program Files\Creative Professional\E-MU PatchMix DSP\EmuPMixDSP.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Digidesign\Drivers\MMERefresh.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Last.fm\LastFM.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iUpd646] C:\DOCUME~1\Owner\LOCALS~1\Temp\sfsrv.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [setDefaultMIDI] MIDIDef.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1211572747405

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe

O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe

O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--

End of file - 5609 bytes

nosirrah · September 15, 2008

When update 1153 comes out it might have this solved . If not we will likely need some samples from your system .

wireneck · September 15, 2008

OK I will stay on the look out for the update. Any idea when it is due?

nosirrah · September 15, 2008

Its out now , let me know how the next scan goes .

wireneck · September 15, 2008

OK just ran a scan with the newest update. It didn't detect any malicious items this time? This might be due to the scan I ran earlier. I know I cleared the Privacy cleaner more than once with the older updates and it came back. I will keep you posted. Thanks again for the help.

wireneck · September 15, 2008

Still getting the Pop up from Privacy cleaner. Malwarebytes didn't detect anything on a 2nd scan this morning. Any ideas?

nosirrah · September 15, 2008

Please get me another HijackThis log , I may need some files .

wireneck · September 15, 2008

Newest Hi Jack this log. Pop up is definitely still active. Thanks again

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:50:26 PM, on 9/15/2008