|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
09-11-2006, 02:06 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 27
OS: XP
|
HMAtchmt.ocx problem
Hi- my home computer lost internet connection yesterday morning. My MacAfee alerted me that a system registry change was taking place and asked if I wanted to block it, but stupidly, I said no, thinking maybe comcast was trying to get my connection restarted or something. Since then I have had some intermittent bad internet, but mostly no connection at all. Because I have no connection, I am not sure how I am going to run online scan programs and that sort of thing, but I am hoping to take my work laptop home tonight so I can use it to get the necessary programs to run on my machine.
All I can show you at this point is a screen shot of my MacAfee program showing one of the changes that occurred. Can you please tell me what I need to do to start the process of healing my pc? I do not think I have hijack this on my pc anymore so I will attempt to get a copy before I go home. Anyway, please let me know what to try- thanks |
|
     
|
|
09-11-2006, 08:02 PM
|
#2 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 27
OS: XP
|
online and ran your suggested programs
Hi- I am online at home and ran Ad-Aware- nothing found (ran it yesterday), VX2- nothing found... I ran spybot search and destroy (says spyware doctor, maybe i downloaded the wrong thing) and I will post the results below. The CWShredder found nothing, and my hijackthis log is below. I did NOT do this in safe mode- forgot...
Spyware Doctor Activity Report Generated on 9/11/2006 7:11:54 PM Spyware Doctor Homepage PC Tools Homepage Technical Support Scans (basic information only): Scan Results: scan start: 9/11/2006 7:12:48 PM scan stop: 9/11/2006 7:37:08 PM scanned items: 143558 found items: 65 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Tracking Cookie(s) cookies.txt - Line #10 Low Advertising cookies.txt - Line #102 Low Tracking Cookie(s) cookies.txt - Line #11 Low Tracking Cookie(s) cookies.txt - Line #111 Low Tracking Cookie(s) cookies.txt - Line #119 Low Tracking Cookie(s) cookies.txt - Line #12 Low Tracking Cookie(s) cookies.txt - Line #125 Low Advertising cookies.txt - Line #128 Low Tracking Cookie(s) cookies.txt - Line #13 Low Advertising cookies.txt - Line #130 Low Advertising cookies.txt - Line #131 Low Tracking Cookie(s) cookies.txt - Line #137 Low Tracking Cookie(s) cookies.txt - Line #139 Low Tracking Cookie(s) cookies.txt - Line #14 Low Tracking Cookie(s) cookies.txt - Line #24 Low Advertising cookies.txt - Line #29 Low Advertising cookies.txt - Line #30 Low Advertising cookies.txt - Line #34 Low Advertising cookies.txt - Line #35 Low Tracking Cookie(s) cookies.txt - Line #36 Low Tracking Cookie(s) cookies.txt - Line #37 Low Tracking Cookie(s) cookies.txt - Line #38 Low Tracking Cookie(s) cookies.txt - Line #39 Low Tracking Cookie(s) cookies.txt - Line #40 Low Tracking Cookie(s) cookies.txt - Line #41 Low Tracking Cookie(s) cookies.txt - Line #42 Low Tracking Cookie(s) cookies.txt - Line #43 Low Tracking Cookie(s) cookies.txt - Line #44 Low Tracking Cookie(s) cookies.txt - Line #48 Low Tracking Cookie(s) cookies.txt - Line #50 Low Tracking Cookie(s) cookies.txt - Line #54 Low Tracking Cookie(s) cookies.txt - Line #55 Low Known Bad Sites cookies.txt - Line #63 High Tracking Cookie(s) cookies.txt - Line #8 Low Advertising cookies.txt - Line #80 Low Tracking Cookie(s) cookies.txt - Line #82 Low Tracking Cookie(s) cookies.txt - Line #88 Low Tracking Cookie(s) cookies.txt - Line #89 Low Tracking Cookie(s) cookies.txt - Line #9 Low Tracking Cookie(s) cookies.txt - Line #90 Low Tracking Cookie(s) cookies.txt - Line #91 Low Tracking Cookie(s) cookies.txt - Line #92 Low Tracking Cookie(s) cookies.txt - Line #93 Low Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75} Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}\iexplore Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}\iexplore## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}\iexplore##Count Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}\iexplore##Time Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}\iexplore##Type Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3} Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\iexplore Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\iexplore## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\iexplore##Count Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\iexplore##Time Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\iexplore##Type Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B} Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}\iexplore Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}\iexplore## Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}\iexplore##Count Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}\iexplore##Time Elevated Virtumonde HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ADCD30FF-0119-4906-8A8B-D52D1EED044B}\iexplore##Type Elevated HIJACK THIS________________________ Logfile of HijackThis v1.99.1 Scan saved at 7:57:43 PM, on 9/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mclogsrv.exe C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\McAfee\MSC\mctskshd.exe C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\McAfee\MSC\McLogCln.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee\msc\mcupdui.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wrh.noaa.gov/total_foreca...&county=orc003 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [FIREBOX] C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by120fd.bay120.hotmail.msn.co...x/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{C66D239E-40D8-45E6-BCD2-D133891FD87D}: NameServer = 4.2.2.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe |
|
|
|
|
09-19-2006, 05:05 PM
|
#7 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,091
OS: WinXP and Vista
|
Hi shutterfish,
Our sincere apologies for the oversight of your thread. Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out these instructions. ****************************************************** Download ewido anti-spyware from HERE and save that file to your desktop. This is a 30 day trial of the program
Download and install CleanUp! but do not run it yet. (Not Recommended for XP64). ------------------------------------------------ Next, please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. ------------------------------------------------ *WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location. Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: *Click "Options..." *Move the arrow down to "Custom CleanUp!" *Put a check next to the following:
Press the CleanUp! button to start the program. Do NOT reboot/logoff when prompted. ------------------------------------------------ IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
----------------------------------- Reboot into Normal Mode. ----------------------------------- Also please run this online scan, to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Perform an online scan using Internet Explorer with Panda ActiveScan ** click on "Free use ActiveScan" located on the top right hand corner
Please include the following in your next reply: Ewido results Panda results New HijackThis log ***************************************** After you've posted the requested logs, you need to update your Java as it is out of date. This older version is a security risk as malwre writers exploit the weaknesses in it's code--inlcuding the Virtumonde infection that has made it's way to your system. Updating Java and Clearing Cache
|
|
|
|
|
10-01-2006, 09:24 AM
|
#8 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 27
OS: XP
|
here are the results- thanks!
New HIJACK THIS log:
Logfile of HijackThis v1.99.1 Scan saved at 9:21:38 AM, on 10/1/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mclogsrv.exe C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\McAfee\MSC\mctskshd.exe C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\mcafee\msc\mcupdui.exe C:\Program Files\Trillian\trillian.exe C:\Program Files\Internet Explorer\iexplore.exe C:\hijackthis\HijackThis.exe Active Scan Results: Incident Status Location Adware:adware/sidestep Not disinfected Windows Registry Spyware:spyware/virtumonde Not disinfected Windows Registry EWIDO Log --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 7:54:01 PM 9/27/2006 + Scan result: C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined). :mozilla.10:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.11:C:\Documents and Settings\ABLAKE\Application Data\Mozilla\Firefox\Profiles\default.pvs\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.11:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.12:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.13:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.15:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.9:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@saxowesterncommunications.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ads.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.30:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined). :mozilla.31:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined). :mozilla.35:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.36:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). :mozilla.13:C:\Documents and Settings\ABLAKE\Application Data\Mozilla\Firefox\Profiles\default.pvs\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.121:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.131:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). :mozilla.132:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\ABLAKE\Application Data\Mozilla\Firefox\Profiles\default.pvs\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ehg-accuweather.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ehg-meevee.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.81:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.89:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.92:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.37:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.38:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.39:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.40:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.41:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.42:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.94:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined). :mozilla.96:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.126:C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\default.14f\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Andrew\Cookies\andrew@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). ::Report end I think that is all you need from me- thanks for your help! Andrew |
|
|
|
|
10-02-2006, 05:04 PM
|
#10 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,091
OS: WinXP and Vista
|
Hello Andrew,
 The HijackThis log you posted is not complete. Please run another scan with HijackThis and post the entire log here once again. As neither Panda nor Ewido reported anything major, I'd like you to run this tool as well: Download combofix from one of these locations:
Double click on combofix.exe & follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
|
|
|
|
10-03-2006, 08:47 PM
|
#11 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 27
OS: XP
|
Logfile of HijackThis v1.99.1 Scan saved at 8:45:45 PM, on 10/3/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mclogsrv.exe C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\McAfee\MSC\mctskshd.exe C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\PROGRA~1\mcafee\msc\mcupdui.exe C:\Program Files\Trillian\trillian.exe c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wrh.noaa.gov/total_foreca...&county=orc003 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [FIREBOX] C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by120fd.bay120.hotmail.msn.co...x/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{C66D239E-40D8-45E6-BCD2-D133891FD87D}: NameServer = 4.2.2.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe combo fix Andrew - 06-10-03 20:42:23.46 Service Pack 2 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Andrew\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-09-03 to 2006-10-03 )))))))))))))))))))))))))))))))))) No new files created in this timespan (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-03 08:32 -------- d-------- C:\Program Files\ewido anti-spyware 4.0 2006-10-02 21:26 -------- d-------- C:\Program Files\Trillian 2006-10-01 09:33 -------- d-------- C:\Program Files\Java 2006-09-27 22:24 -------- d-------- C:\Program Files\WinZip 2006-09-27 22:23 -------- d-------- C:\Program Files\QuickTime 2006-09-27 22:14 -------- d-------- C:\Program Files\Internet Explorer 2006-09-27 22:13 -------- d-------- C:\Program Files\Google 2006-09-22 23:02 -------- d-------- C:\Documents and Settings\Andrew\Application Data\Google 2006-09-21 11:48 -------- d-------- C:\Program Files\McAfee 2006-09-11 19:47 -------- d-------- C:\Program Files\Registry Mechanic 2006-09-11 18:47 -------- d-------- C:\Program Files\Lavasoft 2006-09-11 18:47 -------- d-------- C:\Documents and Settings\Andrew\Application Data\Lavasoft 2006-09-10 21:16 -------- d-------- C:\Program Files\CleanUp! 2006-09-07 22:18 -------- d-------- C:\Program Files\PartyGaming 2006-08-21 05:21 16896 --a------ C:\WINDOWS\SYSTEM32\fltlib.dll 2006-08-21 02:14 23040 --a------ C:\WINDOWS\SYSTEM32\fltmc.exe 2006-08-21 02:14 128896 --------- C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys 2006-08-14 16:26 37832 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys 2006-08-14 16:25 33928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys 2006-08-14 16:25 31752 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys 2006-08-14 16:25 162504 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys 2006-08-14 13:00 104536 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys 2006-08-12 10:06 -------- d-------- C:\Documents and Settings\Andrew\Application Data\AdobeUM 2006-08-11 20:18 -------- d-------- C:\Documents and Settings\Andrew\Application Data\HP 2006-08-11 20:17 -------- d-------- C:\Program Files\HP 2006-08-11 20:17 -------- d-------- C:\Program Files\Common Files\HP 2006-08-11 20:16 -------- d-------- C:\Program Files\Common Files 2006-08-11 20:14 -------- d-------- C:\Program Files\Hewlett-Packard 2006-08-11 20:12 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard 2006-07-27 06:24 679424 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-07-21 01:24 72704 --a------ C:\WINDOWS\SYSTEM32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\G001-1.0.25.0\\gnotify.exe" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "FIREBOX"="C:\\Program Files\\PreSonus\\1394AudioDriver_FIREBox\\FIREBOX Control.exe" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RegistryMechanic"="" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="about:Home" "SubscribedURL"="about:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{ADCD30FF-0119-4906-8A8B-D52D1EED044B}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Digital Line Detect.lnk" "backup"="C:\\WINDOWS\\pss\\Digital Line Detect.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\DIGITA~1\\DLG.exe " "item"="Digital Line Detect" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Do |
