|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
09-10-2007, 09:41 AM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 2
OS: Windows XP
|
Popups will not cease -- Cannot catch virus
I picked up a virus that keeps opening Internet Explorer popups and somewhat slowing down my system which I thought I had gotten rid of but it seems like I haven't. I started with Trojan hunter which couldn't delete all it found, then Ad-Aware does the same and finally Ashampoo can't detect a thing. I've done the 5 steps I believe, and I need assistance if you would be so kind. Here are the logs.
|
|
     
|
|
09-12-2007, 06:27 AM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,909
OS: Vista, Ubuntu 8.04
|
Re: Popups will not cease -- Cannot catch virus
Hi Ruine
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== Additional Downloads Please download these additional files/programs. Do not run them until instructed to do so. Unless otherwise stated, they should be stored in same directory as the HiJackThis program. ================= Download this file to your desktop.- Here IMPORTANT - You must place combofix on your desktop!! Double click on combofix.exe & follow the prompts. When finished, it shall produce a log for you. Post the ComboFix.txt in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ================= Please Run a scan with HiJackThis and save the log ================= NOTE Please copy and paste your logs into the next reply In your next post, please include fresh logs from:
|
|
|
|
|
09-12-2007, 09:39 AM
|
#3 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 2
OS: Windows XP
|
Re: Popups will not cease -- Cannot catch virus
Alright, done and done. Here are the logs from both programs:
Combofix ComboFix 07-09-12.8 - "owner" 2007-09-12 11:11:02.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.130 [GMT -4:00] * Created a new restore point . ADS - system32: deleted 615 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\owner\APPLIC~1\SSEMBL~1 C:\DOCUME~1\owner\APPLIC~1\SSEMBL~1\?ssembly\ C:\DOCUME~1\owner\APPLIC~1\WinTouch C:\DOCUME~1\owner\APPLIC~1\WinTouch\wintouch.cfg C:\DOCUME~1\owner\APPLIC~1\WinTouch\WinTouch.exe C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\inetget2 C:\Program Files\winpop C:\WINDOWS\b143.exe C:\WINDOWS\b147.exe C:\WINDOWS\b148.exe C:\WINDOWS\cookies.ini C:\WINDOWS\retadpu1000520.exe C:\WINDOWS\system32\ashfswil.exe C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\ehgzzlwf.dll C:\WINDOWS\system32\racle~1 C:\WINDOWS\system32\racle~1\s?rvices.exe C:\WINDOWS\system32\ssqooop.dll C:\WINDOWS\system32\ututv.bak1 C:\WINDOWS\system32\ututv.bak2 C:\WINDOWS\system32\ututv.ini C:\WINDOWS\system32\ututv.ini2 C:\WINDOWS\system32\ututv.tmp C:\WINDOWS\system32\vtutu.dll C:\WINDOWS\system32\wapiicomsv.exe C:\WINDOWS\uninstall_nmon.vbs . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CMDSERVICE -------\LEGACY_DOMAINSERVICE -------\LEGACY_NETWORK_MONITOR -------\DomainService ((((((((((((((((((((((((( Files Created from 2007-08-12 to 2007-09-12 ))))))))))))))))))))))))))))))) . 2007-09-12 11:06 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-10 11:14 <DIR> d-------- C:\ZonedOut 2007-09-10 11:08 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-09-10 09:25 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-09-10 08:38 <DIR> d-------- C:\Deckard 2007-09-09 02:04 <DIR> d-------- C:\Program Files\Insider 2007-09-08 23:10 <DIR> d-------- C:\keygen 2007-09-08 17:06 <DIR> d--hs---- C:\WINDOWS\b3duZXI 2007-09-08 17:06 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon 2007-09-08 17:01 <DIR> d-------- C:\WINDOWS\miww 2007-09-08 17:01 <DIR> d-------- C:\Program Files\Common Files\miww 2007-09-08 09:14 <DIR> d-------- C:\DOCUME~1\owner\APPLIC~1\TrojanHunter 2007-09-08 09:13 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-09-08 08:25 <DIR> d-------- C:\TrojanHunter.v4.7.Build.932.WinAll.Cracked-CRD 2007-09-07 22:51 94,208 --a------ C:\WINDOWS\system32\dllcache\fpencode.dll 2007-09-07 22:50 <DIR> d-------- C:\DOCUME~1\owner\APPLIC~1\Microsoft Web Folders 2007-09-07 13:23 <DIR> d-------- C:\Office.Pro.2007.Permanent.Trial.KeyGen[Microsoft.MSOffice.Professional.Crack.TimeStop.nGen.Cryoptik] 2007-09-07 13:23 <DIR> d-------- C:\Microsoft.Office.Pro.2007.TimeStop.Activation.Crack[MS.Activate.MSOffice.Professional.07.With.Activator.KeyGen.RECOiL] 2007-09-07 12:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help 2007-09-01 10:44 <DIR> d-------- C:\Richard Pryor_9 Albums 2007-08-16 01:50 52,736 --a------ C:\WINDOWS\ipuninst.exe 2007-08-16 01:47 <DIR> d-------- C:\Program Files\BlackIsle . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-10 10:47 --------- d-------- C:\Program Files\Trillian 2007-09-10 09:18 --------- d-------- C:\Program Files\Common Files\aolshare 2007-09-10 09:18 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL 2007-09-10 09:15 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek 2007-09-10 09:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint 2007-09-09 08:53 --------- d-------- C:\Program Files\Nintendo DS Emulator 2007-09-08 22:51 --------- d-------- C:\DOCUME~1\owner\APPLIC~1\Azureus 2007-09-08 09:19 --------- d-------- C:\Program Files\TrojanHunter 4.2 2007-09-07 22:49 --------- d-------- C:\Program Files\msaccrt 2007-09-07 22:49 --------- d-------- C:\Program Files\microsoft frontpage 2007-09-07 13:27 --------- d-------- C:\Program Files\Azureus 2007-09-05 12:50 --------- d-------- C:\Program Files\Chattage 2007-08-15 03:27 --------- d-------- C:\Program Files\Symantec 2007-08-05 08:38 --------- d-------- C:\Program Files\Common Files\Symantec Shared 2007-08-04 23:29 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec 2007-08-03 22:56 --------- d-------- C:\Program Files\DANCE!ONLINE 2007-07-19 22:42 --------- d-------- C:\Program Files\QuickTime 2007-07-19 22:41 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-07-19 22:40 --------- d-------- C:\Program Files\Apple Software Update 2007-07-19 22:40 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple 2007-07-19 22:30 --------- d-------- C:\DOCUME~1\owner\APPLIC~1\IMVU 2007-07-18 13:46 --------- d-------- C:\DOCUME~1\owner\APPLIC~1\Corel 2007-06-13 06:23 1033216 --a------ C:\WINDOWS\explorer.exe 2005-08-16 21:12 2129920 --a------ C:\Program Files\Game.exe 2005-07-29 20:24:26 472 --sha-r C:\WINDOWS\b3duZXI\vaxRtrK.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B27CC68-110C-46a9-80D3-F3107DE6EB98}] C:\Program Files\ISM\BndDrive3.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 C:\WINDOWS\stsystra.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-29 22:05] "IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43] "HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 22:00] "HydraVisionViewport"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe" [2003-09-15 22:00] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 06:33] "AGEIA PhysX SysTray"="C:\Program Files\AGEIA Technologies\TrayIcon.exe" [2006-08-16 10:56] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-21 13:45] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 08:23] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-11 09:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-05 17:57] "NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2007-04-11 21:43] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00] "Insider"="C:\Program Files\Insider\Insider.exe" [2007-09-09 02:04] "ISMModule3"="C:\Program Files\ISM\ISMModule3.exe" [] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56] C:\DOCUME~1\owner\STARTM~1\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] PowerReg Scheduler V3.exe [2006-08-11 10:45:09] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\vtutu [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] C:\Program Files\Common Files\AOL\1134709473\ee\AOLSoftware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate] C:\Program Files\Plaxo\2.5.10.17\PlaxoHelper.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot R2 NvNdis;NVIDIA NDIS IO Control Driver;\??\C:\WINDOWS\system32\Drivers\NvNdis.sys S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\owner\LOCALS~1\Temp\Amsmpu4p.sys S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F10681B5-CDB1-7ABD-813B-C0E3DA747CF6}] C:\WINDOWS\system32:WoW.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FB04E60F-EF10-ABD6-F03F-D50700DD3749}] C:\WINDOWS\system32\svchost2.exe . Contents of the 'Scheduled Tasks' folder "2007-09-08 17:17:55 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-12 11:29:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-12 11:32:40 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-12 11:32 . --- E O F --- ------------------------------------------------------------------- HijackThis Logfile of HijackThis v1.99.1 Scan saved at 11:35:23 AM, on 9/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\AGEIA Technologies\TrayIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\QuickTime\QTTask.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\NCLAUNCH.EXe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Insider\Insider.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\owner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://securityresponse.symantec.com...ober.x@mm.html R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: BndDrive2 BHO Class - {8B27CC68-110C-46a9-80D3-F3107DE6EB98} - C:\Program Files\ISM\BndDrive3.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe O4 - HKCU\..\Run: [ISMModule3] "C:\Program Files\ISM\ISMModule3.exe" O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\owner\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://gameadvisor.futuremark.com/global/msc3121.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6A1076B8-8237-46BE-B14D-0BB479A76CF1}: NameServer = 206.141.193.55,66.73.20.40 O20 - Winlogon Notify: WB - C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -------------------------------------------- When the computer was restarted from ComboFix, AVG said there was another virus and sent it to the vault. So far since then however, the popups haven't continued. So hopefully its fixed? If so then thank you very much. Last edited by Ruine : 09-12-2007 at 09:43 AM. |
|
|
|
|
09-13-2007, 12:29 AM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,909
OS: Vista, Ubuntu 8.04
|
Re: Popups will not cease -- Cannot catch virus
Hi Ruine
We are not here to judge but the downloading and installation of cracked software often leads to infection as most cracked programs come with viruses Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== From Control Panel->Add/Remove Programs, uninstall the following programs, if present, :
================= Run a scan with HiJackThis & select/tick the following & click "Fix checked" : R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) Please remember to close all other windows, including browsers then click Fix checked. =============================================== Open Notepad and copy/paste the text in the code box below into it: Code:
File::
C:\Program Files\Game.exe
C:\WINDOWS\system32\iuqvltcl.dll
Folder:
C:\WINDOWS\b3duZXI
C:\Program Files\Insider
C:\Program Files\ISM
C:\Microsoft.Office.Pro.2007.TimeStop.Activation.Crack
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B27CC68-110C-46a9-80D3-F3107DE6EB98}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Insider"=-
"ISMModule3"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=-
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ============================================= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
|
|
|
|
| Thread Tools | |
|
|
