|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
09-06-2007, 01:02 PM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2007
Location: Texas
Posts: 24
OS: XP
 |
Here's my log! Help!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:01:15 PM, on 9/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Internet Explorer\hosycasyn22011.exe C:\Program Files\iPod Access for Windows\iPAHelper.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {930D35D2-094D-41B9-8E89-D1B76F2C6E97} - (no file) O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll O2 - BHO: (no name) - {CF2597AB-764F-4BDD-A9A4-3222882FF894} - (no file) O2 - BHO: (no name) - {E9C1E812-CC1E-4558-9615-1133F77FD383} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hosycasyn] C:\Program Files\Internet Explorer\hosycasyn22011.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted IP range: http://202.67.220.225 O15 - Trusted IP range: http://59.148.220.121 O15 - Trusted IP range: http://62.4.84.53 O15 - Trusted IP range: http://82.98.235.58 O15 - Trusted IP range: http://85.12.25.90 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143232203531 O20 - Winlogon Notify: cbxyvwu - cbxyvwu.dll (file missing) O20 - Winlogon Notify: fedcfeeecf - C:\WINDOWS\system32\fedcfeeecf.dll O20 - Winlogon Notify: nifonati - C:\WINDOWS\ O20 - Winlogon Notify: pmkjg - C:\WINDOWS\ O20 - Winlogon Notify: ssqrs - C:\WINDOWS\ O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 clr_optimization_v2.0.50727_32winmgmt (clr_optimization_v2.0.50727_32winmgmt) - Unknown owner - C:\WINDOWS\system32\acelpdecb.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 8343 bytes
__________________
Whoever appeals to the law against his fellow man is either a fool or a coward. Whoever cannot take care of himself without that law is both. For a wounded man shall say to his assailant, "If I live, I will kill you. If I die, you are forgiven." Such is the rule of honor.
|
|
     
|
|
09-08-2007, 04:51 PM
|
#2 (permalink) |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Here's my log! Help!
Please download ComboFix
Save it to the Desktop Double-click combofix.exe to run the program Follow the prompts. (Don't click on the window while the program is running, it may cause your system to stall.) When finished, a log, ComboFix.txt, is produced. ~~~~ Run HijackThis once again to obtain a new log. ~~~~ Please post the ComboFix.txt, and a new HijackThis log in your reply.
__________________
|
|
|
|
|
09-09-2007, 09:55 AM
|
#3 (permalink) |
|
Registered User
Join Date: Sep 2007
Location: Texas
Posts: 24
OS: XP
|
Re: Here's my log! Help!
ComboFix 07-09-09.5 - "Owner" 2007-09-09 11:32:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.576 [GMT -4:00] * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007 C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\Abbr C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\ProductCode C:\DOCUME~1\Owner\APPLIC~1\macromedia\Flash Player\#SharedObjects\9JM4WLJM\www.broadcaster.com C:\DOCUME~1\Owner\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\DOCUME~1\Owner\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Program Files\Common Files\companion wizard C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\fse C:\Temp\fse\tmpZTF.log C:\WINDOWS\system32\B1 C:\WINDOWS\system32\f02WtR C:\WINDOWS\system32\stera.log C:\WINDOWS\system32\X1 C:\WINDOWS\system32\X1\x22011.exe C:\WINDOWS\Temp\1060838547.exe C:\WINDOWS\Temp\1933534791.exe C:\WINDOWS\Temp\2264527293.exe C:\WINDOWS\tk58.exe E:\Autorun.inf ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\ApiMon ((((((((((((((((((((((((( Files Created from 2007-08-09 to 2007-09-09 ))))))))))))))))))))))))))))))) . 2007-09-09 11:31 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-07 09:13 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-09-05 16:14 <DIR> d-------- C:\Program Files\Trend Micro 2007-09-05 13:37 <DIR> d-------- C:\Program Files\BitTorrent 2007-09-04 10:54 <DIR> d-------- C:\Program Files\Sierra 2007-09-04 01:42 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-09-04 01:42 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\SUPERAntiSpyware.com 2007-09-04 01:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com 2007-09-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Viewpoint 2007-08-23 21:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WEBREG 2007-08-23 21:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HPSSUPPLY 2007-08-23 20:56 <DIR> d-------- C:\Program Files\Common Files\HP 2007-08-23 20:52 117,760 --a------ C:\WINDOWS\system32\hpzll4v2.dll 2007-08-23 20:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard 2007-08-23 20:50 <DIR> d-------- C:\Program Files\HP 2007-08-23 20:45 2,977 --------- C:\WINDOWS\hphmdl13.dat 2007-08-23 20:45 130,492 --a------ C:\WINDOWS\HPHins13.dat 2007-08-21 10:47 <DIR> d-------- C:\Program Files\id Software 2007-08-21 10:44 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-08-21 00:15 <DIR> d-------- C:\Program Files\PowerISO 2007-08-16 08:31 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\Quake3 2007-08-16 08:30 <DIR> d-------- C:\Program Files\ioquake3 2007-08-15 18:03 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-08-15 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-08-14 09:28 <DIR> d-------- C:\Program Files\iPod Access for Windows 2007-08-14 09:24 <DIR> d-------- C:\Program Files\QuickTime 2007-08-14 09:16 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\WinRAR 2007-08-13 23:10 <DIR> d-------- C:\WINDOWS\system32\checkdll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-09 02:43 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\BitTorrent 2007-09-08 09:51 --------- d-------- C:\Program Files\CONEXANT 2007-09-05 09:43 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\AdobeUM 2007-09-04 13:25 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-03 15:23 --------- d-------- C:\Program Files\Viewpoint 2007-09-03 15:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint 2007-09-01 10:18 --------- d-------- C:\Program Files\LimeWire 2007-08-23 21:17 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Azureus 2007-08-23 20:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP 2007-08-19 14:53 --------- d-------- C:\Program Files\Hewlett-Packard 2007-08-14 12:16 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Apple Computer 2007-08-13 21:03 --------- d-------- C:\Program Files\Windows Media Connect 2 2007-08-13 21:03 --------- d-------- C:\Program Files\DivX 2007-08-08 10:49 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\DivX 2007-08-07 21:50 --------- d-------- C:\Program Files\iTunes 2007-08-07 21:50 --------- d-------- C:\Program Files\iPod 2007-08-04 11:54 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\HP 2007-07-28 00:54 --------- d-------- C:\Program Files\7-Zip 2007-07-27 13:52 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Ahead 2007-07-27 13:05 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-27 13:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero 2007-07-27 13:01 --------- d-------- C:\Program Files\Nero 2007-07-27 12:48 --------- d-------- C:\Program Files\Ahead 2007-07-23 21:19 --------- d-------- C:\Program Files\Western Digital Technologies 2007-07-19 10:08 --------- d-------- C:\Program Files\Lavasoft 2007-07-16 20:55 --------- d-------- C:\Program Files\Apple Software Update 2007-07-16 20:51 --------- d-------- C:\Program Files\Common Files\Apple 2007-07-16 20:51 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple 2007-07-16 20:15 --------- d-------- C:\Program Files\Quake III Arena 2007-07-09 15:07 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-07-09 15:07 2560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-07-09 15:07 2432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-13 06:23 1033216 --a------ C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF2597AB-764F-4BDD-A9A4-3222882FF894}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9C1E812-CC1E-4558-9615-1133F77FD383}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 13:41] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2006-11-10 16:19] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44] "hosycasyn"="C:\Program Files\Internet Explorer\hosycasyn22011.exe" [2007-08-07 16:30] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] "Aim6"="" [] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyvwu] cbxyvwu.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fedcfeeecf] C:\WINDOWS\system32\fedcfeeecf.dll 2007-08-25 14:44 92672 C:\WINDOWS\system32\fedcfeeecf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nifonati] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkjg] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrs] R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys S2 clr_optimization_v2.0.50727_32winmgmt;.NET Runtime Optimization Service v2.0.50727_X86 clr_optimization_v2.0.50727_32winmgmt;C:\WINDOWS\system32\acelpdecb.exe srv S3 EMCFILT;Alcor Micro Corp for Emachine- 9361;\??\C:\WINDOWS\System32\Drivers\EMcFilt.sys S3 jswmidin;jswmidin;\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\jswmidin.sys S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder "2007-09-05 00:55:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-09 11:40:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-09-09 11:43:51 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-09 11:43 . --- E O F ---
__________________
Whoever appeals to the law against his fellow man is either a fool or a coward. Whoever cannot take care of himself without that law is both. For a wounded man shall say to his assailant, "If I live, I will kill you. If I die, you are forgiven." Such is the rule of honor.
|
|
|
|
|
09-09-2007, 09:56 AM
|
#4 (permalink) |
|
Registered User
Join Date: Sep 2007
Location: Texas
Posts: 24
OS: XP
|
Re: Here's my log! Help!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:12 AM, on 9/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\iPod Access for Windows\iPAHelper.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Internet Explorer\hosycasyn22011.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll O2 - BHO: (no name) - {CF2597AB-764F-4BDD-A9A4-3222882FF894} - (no file) O2 - BHO: (no name) - {E9C1E812-CC1E-4558-9615-1133F77FD383} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hosycasyn] C:\Program Files\Internet Explorer\hosycasyn22011.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted IP range: http://202.67.220.225 O15 - Trusted IP range: http://59.148.220.121 O15 - Trusted IP range: http://62.4.84.53 O15 - Trusted IP range: http://82.98.235.58 O15 - Trusted IP range: http://85.12.25.90 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143232203531 O20 - Winlogon Notify: cbxyvwu - cbxyvwu.dll (file missing) O20 - Winlogon Notify: fedcfeeecf - C:\WINDOWS\system32\fedcfeeecf.dll O20 - Winlogon Notify: nifonati - C:\WINDOWS\ O20 - Winlogon Notify: pmkjg - C:\WINDOWS\ O20 - Winlogon Notify: ssqrs - C:\WINDOWS\ O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 clr_optimization_v2.0.50727_32winmgmt (clr_optimization_v2.0.50727_32winmgmt) - Unknown owner - C:\WINDOWS\system32\acelpdecb.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 8104 bytes
__________________
Whoever appeals to the law against his fellow man is either a fool or a coward. Whoever cannot take care of himself without that law is both. For a wounded man shall say to his assailant, "If I live, I will kill you. If I die, you are forgiven." Such is the rule of honor.
|
|
|
|
|
09-09-2007, 09:16 PM
|
#5 (permalink) | |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Here's my log! Help!
Please open Notepad (Start > Run > in the Open field type: notepad)
Click: OK Copy/paste the text in the quote box below to Notepad: Quote:
Change the Save as type to: All Files Save it to the Desktop.  Referring to the screenshot above, drag CFScript.txt >>> into >>> ComboFix.exe ComboFix runs a scan on your system, and may reboot when it finishes. This is normal. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced: ComboFix.txt ~~~~ Run HijackThis once again to obtain a new log. ~~~~ Please provide the contents of the new ComboFix log , and the new HijackThis log in your reply.
__________________
|
|
|
|
|
|
09-09-2007, 10:17 PM
|
#6 (permalink) |
|
Registered User
Join Date: Sep 2007
Location: Texas
Posts: 24
OS: XP
|
Re: Here's my log! Help!
ComboFix 07-09-09.5 - "Owner" 2007-09-10 0:03:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.787 [GMT -4:00] * Created a new restore point FILE:: C:\WINDOWS\system32\fedcfeeecf.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Internet Explorer\hosycasyn22011.exe C:\Program Files\Viewpoint C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Common\VistaBoot.sdll C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_0305001C.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo2.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownLoadHist.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe C:\Program Files\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt C:\Program Files\Viewpoint\Viewpoint Manager\CPtask.xml C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPexe.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\eula.txt C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\Uninstaller.exe C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarSystemInfo.dll C:\WINDOWS\system32\fedcfeeecf.dll C:\WINDOWS\tk58.exe ((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 ))))))))))))))))))))))))))))))) . 2007-09-09 11:31 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-07 09:13 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-09-05 16:14 <DIR> d-------- C:\Program Files\Trend Micro 2007-09-05 13:37 <DIR> d-------- C:\Program Files\BitTorrent 2007-09-04 10:54 <DIR> d-------- C:\Program Files\Sierra 2007-09-04 01:42 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-09-04 01:42 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\SUPERAntiSpyware.com 2007-09-04 01:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com 2007-09-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Viewpoint 2007-08-23 21:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WEBREG 2007-08-23 21:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HPSSUPPLY 2007-08-23 20:56 <DIR> d-------- C:\Program Files\Common Files\HP 2007-08-23 20:52 117,760 --a------ C:\WINDOWS\system32\hpzll4v2.dll 2007-08-23 20:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard 2007-08-23 20:50 <DIR> d-------- C:\Program Files\HP 2007-08-23 20:45 2,977 --------- C:\WINDOWS\hphmdl13.dat 2007-08-23 20:45 130,492 --a------ C:\WINDOWS\HPHins13.dat 2007-08-21 10:47 <DIR> d-------- C:\Program Files\id Software 2007-08-21 10:44 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-08-21 00:15 <DIR> d-------- C:\Program Files\PowerISO 2007-08-16 08:31 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\Quake3 2007-08-16 08:30 <DIR> d-------- C:\Program Files\ioquake3 2007-08-15 18:03 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-08-15 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-08-14 09:28 <DIR> d-------- C:\Program Files\iPod Access for Windows 2007-08-14 09:24 <DIR> d-------- C:\Program Files\QuickTime 2007-08-14 09:16 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\WinRAR 2007-08-13 23:10 <DIR> d-------- C:\WINDOWS\system32\checkdll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-09 23:12 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\BitTorrent 2007-09-09 13:56 --------- d-------- C:\Program Files\CONEXANT 2007-09-09 13:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-05 09:43 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\AdobeUM 2007-09-03 15:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint 2007-09-01 10:18 --------- d-------- C:\Program Files\LimeWire 2007-08-23 21:17 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Azureus 2007-08-23 20:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP 2007-08-19 14:53 --------- d-------- C:\Program Files\Hewlett-Packard 2007-08-14 12:16 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Apple Computer 2007-08-13 21:03 --------- d-------- C:\Program Files\Windows Media Connect 2 2007-08-13 21:03 --------- d-------- C:\Program Files\DivX 2007-08-08 10:49 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\DivX 2007-08-07 21:50 --------- d-------- C:\Program Files\iTunes 2007-08-07 21:50 --------- d-------- C:\Program Files\iPod 2007-08-04 11:54 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\HP 2007-07-28 00:54 --------- d-------- C:\Program Files\7-Zip 2007-07-27 13:52 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\Ahead 2007-07-27 13:05 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-27 13:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero 2007-07-27 13:01 --------- d-------- C:\Program Files\Nero 2007-07-27 12:48 --------- d-------- C:\Program Files\Ahead 2007-07-23 21:19 --------- d-------- C:\Program Files\Western Digital Technologies 2007-07-19 10:08 --------- d-------- C:\Program Files\Lavasoft 2007-07-16 20:55 --------- d-------- C:\Program Files\Apple Software Update 2007-07-16 20:51 --------- d-------- C:\Program Files\Common Files\Apple 2007-07-16 20:51 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple 2007-07-16 20:15 --------- d-------- C:\Program Files\Quake III Arena 2007-06-13 06:23 1033216 --a------ C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((( snapshot_2007-09-09_114300.53 ))))))))))))))))))))))))))))))))))))))))) . ----atw 16,384 2007-09-09 17:55:14 C:\WINDOWS\Temp\Perflib_Perfdata_1f8.dat ----atw 16,384 2007-09-10 04:09:26 C:\WINDOWS\Temp\Perflib_Perfdata_5ec.dat ----atw 16,384 2007-09-09 17:55:35 C:\WINDOWS\Temp\Perflib_Perfdata_7fc.dat -c--a-w 16,384 2007-09-10 04:08:52 C:\WINDOWS\Temp\Cookies\index.dat -c--a-w 16,384 2007-09-10 04:08:52 C:\WINDOWS\Temp\History\History.IE5\index.dat -c--a-w 32,768 2007-09-10 04:08:52 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat . ----atw 16,384 2007-09-09 15:39:20 C:\WINDOWS\Temp\Perflib_Perfdata_1f8.dat -c--atw 16,384 2007-03-09 05:04:59 C:\WINDOWS\Temp\Perflib_Perfdata_7fc.dat -c--a-w 16,384 2007-09-09 15:38:43 C:\WINDOWS\Temp\Cookies\index.dat -c--a-w 16,384 2007-09-09 15:38:43 C:\WINDOWS\Temp\History\History.IE5\index.dat -c--a-w 32,768 2007-09-09 15:38:43 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF2597AB-764F-4BDD-A9A4-3222882FF894}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9C1E812-CC1E-4558-9615-1133F77FD383}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 13:41] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2006-11-10 16:19] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] "Aim6"="" [] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyvwu] cbxyvwu.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fedcfeeecf] C:\WINDOWS\system32\fedcfeeecf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nifonati] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkjg] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrs] R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys S2 clr_optimization_v2.0.50727_32winmgmt;.NET Runtime Optimization Service v2.0.50727_X86 clr_optimization_v2.0.50727_32winmgmt;C:\WINDOWS\system32\acelpdecb.exe srv S3 EMCFILT;Alcor Micro Corp for Emachine- 9361;\??\C:\WINDOWS\System32\Drivers\EMcFilt.sys S3 jswmidin;jswmidin;\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\jswmidin.sys S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder "2007-09-05 00:55:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-10 00:10:49 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-09-10 0:13:39 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-10 00:13 C:\ComboFix2.txt ... 2007-09-09 11:43 . --- E O F ---
__________________
Whoever appeals to the law against his fellow man is either a fool or a coward. Whoever cannot take care of himself without that law is both. For a wounded man shall say to his assailant, "If I live, I will kill you. If I die, you are forgiven." Such is the rule of honor.
|
|
|
|
|
09-09-2007, 10:18 PM
|
#7 (permalink) |
|
Registered User
Join Date: Sep 2007
Location: Texas
Posts: 24
OS: XP
|
Re: Here's my log! Help!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:48 AM, on 9/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\iPod Access for Windows\iPAHelper.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {CF2597AB-764F-4BDD-A9A4-3222882FF894} - (no file) O2 - BHO: (no name) - {E9C1E812-CC1E-4558-9615-1133F77FD383} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143232203531 O20 - Winlogon Notify: cbxyvwu - cbxyvwu.dll (file missing) O20 - Winlogon Notify: fedcfeeecf - C:\WINDOWS\system32\fedcfeeecf.dll (file missing) O20 - Winlogon Notify: nifonati - C:\WINDOWS\ O20 - Winlogon Notify: pmkjg - C:\WINDOWS\ O20 - Winlogon Notify: ssqrs - C:\WINDOWS\ O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 clr_optimization_v2.0.50727_32winmgmt (clr_optimization_v2.0.50727_32winmgmt) - Unknown owner - C:\WINDOWS\system32\acelpdecb.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 7322 bytes
__________________
Whoever appeals to the law against his fellow man is either a fool or a coward. Whoever cannot take care of himself without that law is both. For a wounded man shall say to his assailant, "If I live, I will kill you. If I die, you are forgiven." Such is the rule of honor.
|
|
|
|
|
09-10-2007, 08:37 PM
|
#8 (permalink) |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Here's my log! Help!
Well, my brain had a 'senior moment'!! Sorry about that.
 ~~~~ Please open Notepad once again (Start > Run > in the Open field type: notepad) Click: OK Copy/paste the blue text below to Notepad: Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF2597AB-764F-4BDD-A9A4-3222882FF894}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9C1E812-CC1E-4558-9615-1133F77FD383}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyvwu] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fedcfeeecf] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nifonati] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkjg] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrs] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Viewpoint Manager Service] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page] [-HKEY_CLASSES_ROOT\CLSID\{F8AD5AA5-D966-4667-9DAF-2561D68B2012}] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar "{F8AD5AA5-D966-4667-9DAF-2561D68B2012}"=- Save as CFScript.txt <-Important!! Change the Save as type to: All Files Save it to the Desktop. Referring to the screenshot above, drag CFScript.txt >>> into >>> ComboFix.exe ComboFix runs a scan on your system, and may reboot when it finishes. This is normal. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced: ComboFix.txt ~~~~ Also update your version of Java! There are vulnerabilities in older versions. Go to Start > Control Panel > Add/Remove Programs In the list of Currently Installed Programs, look for all previous versions of Java: J2SE Runtime Environment number x, etc. Select the entry and then Remove Next, download and install the newest version: Java Runtime Environment (JRE) 6 Update 2 ~~~~ Run HijackThis once again to obtain a new log. ~~~~ Please provide the contents of the new ComboFix log , and the new HijackThis log in your reply.[/quote]
__________________
|
|
|
|
|
09-10-2007, 09:01 PM
|
# |
