Tech Support Forum - View Single Post - Hi-jack this analyser log

cleggsy · 11-10-2005, 01:01 PM

Sorry for the slow response, had another busy week. Here are the logs, HiJackthis:

Logfile of HijackThis v1.99.1
Scan saved at 19:58:06, on 10/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\PROGRA~1\BTBROA~1\SMARTB~1\BTHelpNotifier.exe
C:\WINDOWS\System32\msaconfig.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\BT Broadband Help\bin\mpbtn.exe
C:\virus stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [BBDial] C:\Program Files\BT Voyager 105 ADSL Modem\BT Broadband.exe
O4 - HKLM\..\Run: [Microsft Configure 32] msaconfig.exe
O4 - HKLM\..\RunServices: [Microsft Configure 32] msaconfig.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsft Configure 32] msaconfig.exe
O4 - Startup: Punch! Super Home Design Help.lnk = C:\Punch! Super\P!ProHD.hlp
O4 - Startup: Punch! Super Home Design User's Guide.lnk = C:\Punch! Super\P!HDSuite.pdf
O4 - Startup: Punch! Super Home Design.lnk = C:\Punch! Super\P!HDSuite.exe
O4 - Startup: Uninstall Punch! Super Home Design.lnk = C:\Punch! Super\UNWISE.EXE
O4 - Global Startup: BT Broadband Basic Help.lnk = C:\Program Files\BT Broadband Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

and Kaspersky log:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, November 10, 2005 19:47:35
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 10/11/2005
Kaspersky Anti-Virus database records: 149539
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 139771
Number of viruses found: 12
Number of infected objects: 15
Number of suspicious objects: 0
Duration of the scan process: 6539 sec

Infected Object Name - Virus Name
C:\found.000\dir0116.chk\0289073D Infected: Trojan-Downloader.Java.OpenConnection.v
C:\found.000\dir0116.chk\04D70BCE Infected: Exploit.Java.Bytverify
C:\found.000\dir0116.chk\0FB1677D.mpg Infected: P2P-Worm.Win32.Banuris.a
C:\found.000\dir0116.chk\2AA92B84 Infected: Trojan-Clicker.Win32.XMedia.g
C:\found.000\dir0116.chk\3B6C4AEF.htm Infected: Exploit.HTML.Mht
C:\found.000\dir0116.chk\41131D60.tmp Infected: Trojan-Downloader.Win32.Femad.p
C:\found.000\dir0116.chk\44D133DF.exe Infected: Trojan-Clicker.Win32.XMedia.g
C:\found.000\dir0116.chk\4ABF0537 Infected: Trojan.Java.ClassLoader.c
C:\found.000\dir0116.chk\6C9313BB Infected: Trojan.Java.ClassLoader.Dummy.a
C:\mmxeyn007.exe Infected: Trojan-Downloader.Win32.VB.sh
C:\System Volume Information\_restore{39D1CDBA-7D60-4474-BDE2-026DA9662DE3}\RP71\A0031998.exe Infected: Trojan-Clicker.Win32.Small.fx
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J419G6MI\defrag[1].exe Infected: Trojan-Clicker.Win32.Small.fx
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J419G6MI\mmxeyn007[1].exe Infected: Trojan-Downloader.Win32.VB.sh
C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab
C:\WINDOWS\system32\msaconfig.exe Infected: Backdoor.Win32.Rbot.gen

Scan process completed.

Once again, thanks for your help and paitence.

Cheers Cleggsy

11-10-2005, 01:01 PM	#11 (permalink)
cleggsy Registered User Join Date: Oct 2005 Posts: 22 OS: xp	Sorry for the slow response, had another busy week. Here are the logs, HiJackthis: Logfile of HijackThis v1.99.1 Scan saved at 19:58:06, on 10/11/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\mnmsrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe C:\PROGRA~1\BTBROA~1\SMARTB~1\BTHelpNotifier.exe C:\WINDOWS\System32\msaconfig.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\BT Broadband Help\bin\mpbtn.exe C:\virus stuff\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~1\SMARTB~1\BTHelpNotifier.exe O4 - HKLM\..\Run: [BBDial] C:\Program Files\BT Voyager 105 ADSL Modem\BT Broadband.exe O4 - HKLM\..\Run: [Microsft Configure 32] msaconfig.exe O4 - HKLM\..\RunServices: [Microsft Configure 32] msaconfig.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Microsft Configure 32] msaconfig.exe O4 - Startup: Punch! Super Home Design Help.lnk = C:\Punch! Super\P!ProHD.hlp O4 - Startup: Punch! Super Home Design User's Guide.lnk = C:\Punch! Super\P!HDSuite.pdf O4 - Startup: Punch! Super Home Design.lnk = C:\Punch! Super\P!HDSuite.exe O4 - Startup: Uninstall Punch! Super Home Design.lnk = C:\Punch! Super\UNWISE.EXE O4 - Global Startup: BT Broadband Basic Help.lnk = C:\Program Files\BT Broadband Help\bin\matcli.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe and Kaspersky log: ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Thursday, November 10, 2005 19:47:35 Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 10/11/2005 Kaspersky Anti-Virus database records: 149539 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics: Total number of scanned objects: 139771 Number of viruses found: 12 Number of infected objects: 15 Number of suspicious objects: 0 Duration of the scan process: 6539 sec Infected Object Name - Virus Name C:\found.000\dir0116.chk\0289073D Infected: Trojan-Downloader.Java.OpenConnection.v C:\found.000\dir0116.chk\04D70BCE Infected: Exploit.Java.Bytverify C:\found.000\dir0116.chk\0FB1677D.mpg Infected: P2P-Worm.Win32.Banuris.a C:\found.000\dir0116.chk\2AA92B84 Infected: Trojan-Clicker.Win32.XMedia.g C:\found.000\dir0116.chk\3B6C4AEF.htm Infected: Exploit.HTML.Mht C:\found.000\dir0116.chk\41131D60.tmp Infected: Trojan-Downloader.Win32.Femad.p C:\found.000\dir0116.chk\44D133DF.exe Infected: Trojan-Clicker.Win32.XMedia.g C:\found.000\dir0116.chk\4ABF0537 Infected: Trojan.Java.ClassLoader.c C:\found.000\dir0116.chk\6C9313BB Infected: Trojan.Java.ClassLoader.Dummy.a C:\mmxeyn007.exe Infected: Trojan-Downloader.Win32.VB.sh C:\System Volume Information\_restore{39D1CDBA-7D60-4474-BDE2-026DA9662DE3}\RP71\A0031998.exe Infected: Trojan-Clicker.Win32.Small.fx C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J419G6MI\defrag[1].exe Infected: Trojan-Clicker.Win32.Small.fx C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J419G6MI\mmxeyn007[1].exe Infected: Trojan-Downloader.Win32.VB.sh C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab C:\WINDOWS\system32\msaconfig.exe Infected: Backdoor.Win32.Rbot.gen Scan process completed. Once again, thanks for your help and paitence. Cheers Cleggsy