Logfile of HijackThis v1.99.1
Scan saved at 2:44:13 PM, on 10/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ISS\BlackICE\rapapp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HIJACKTHIS\HijackThis.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
active scan
Incident Status Location
Adware:adware/securityerror No disinfected C:\Documents and Settings\All Users\Start Menu\Online Security Center.url
smitRem log file
version 2.6
by noahdfear
The current date is: Fri 10/14/2005
The current time is: 13:37:03.18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key
ShudderLTD key not present!
checking for PSGuard.com key
PSGuard.com key not present!
Pre-run Files Present
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
msvol.tlb
mssearchnet.exe
ncompat.tlb
nvctrl.exe
hp***.tmp
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post-run Files Present
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~
CLEAN! :)
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 1:33:08 PM, 10/14/2005
+ Report-Checksum: AAA1EF5D
+ Scan result:
C:\WINDOWS\system32\ld18B2.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld4C52.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld5012.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld60B3.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld619.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6529.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld653D.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld655B.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6822.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6868.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld68F4.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6926.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6B61.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6B6B.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6CB6.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6CC0.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6CF2.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6DBA.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6DE2.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6E00.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6E5A.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld6F36.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld706D.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld70C7.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7167.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld71AD.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7258.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld726C.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld72E4.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7456.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7565.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld75C9.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld764B.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7687.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld778C.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld77C8.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld78A4.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7926.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7A99.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7B9D.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7BA7.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7DC4.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7EDC.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7F22.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld7F36.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld8048.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld80B3.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld822F.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld82F8.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld8A02.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld974F.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld9B39.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ld9CB5.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ldA578.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ldB15D.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ldD5D2.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ldDDF5.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\ldFD87.tmp -> TrojanDownloader.Agent.uz : Cleaned with backup
C:\WINDOWS\system32\mscornet.exe -> TrojanDownloader.Zlob.aq : Cleaned with backup
::Report End