|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
04-25-2008, 08:05 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 8
OS: XP SP2
|
Fear of spyware..running sluggishly lately..sorry for undetailed title
I apologise for not giving a detailed title because I'm not
sure whether the spyware is there or not Deckard's System Scanner v20071014.68 Run by azo on 2008-04-25 15:40:45 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 29: 2008-04-25 14:41:12 UTC - RP308 - Deckard's System Scanner Restore Point 28: 2008-04-25 03:39:12 UTC - RP307 - Software Distribution Service 3.0 27: 2008-04-25 03:15:29 UTC - RP306 - Restore Operation 26: 2008-04-24 23:03:15 UTC - RP305 - Software Distribution Service 3.0 25: 2008-04-24 13:11:23 UTC - RP304 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-04-06 17:32:59 UTC - RP280 - Removed Navman F Series Connection Pack Backed up registry hives. Performed disk cleanup. -- HijackThis (run as azo.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:44:09, on 25/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\system32\slrundll.exe C:\Program Files\Athan\Athan.exe C:\Program Files\Windows Defender\MSASCui.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Documents and Settings\azo\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\azo.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iiu.edu.my/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://211.25.51.9/proxy.pac R3 - Default URLSearchHook is missing O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/pro...nner371420.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5854B1E4-2870-48B0-8AFC-2813D399CA83}: NameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{E184C581-3556-4F97-9AF6-BFE735F5576E}: NameServer = 202.188.0.133,202.188.1.5 O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file) O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\ O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: PHZINLLZR - Unknown owner - C:\DOCUME~1\azo\LOCALS~1\Temp\PHZINLLZR.exe (file missing) O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: VZMGWJX - Unknown owner - C:\DOCUME~1\azo\LOCALS~1\Temp\VZMGWJX.exe (file missing) -- End of file - 6920 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu> R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 aspnet_state (ASP.NET State Service) - c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe (file missing) S3 PHZINLLZR - c:\docume~1\azo\locals~1\temp\phzinllzr.exe (file missing) S3 VZMGWJX - c:\docume~1\azo\locals~1\temp\vzmgwjx.exe (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-04-25 14:16:12 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job -- Files created between 2008-03-25 and 2008-04-25 ----------------------------- 2008-04-25 15:43:40 0 d-------- C:\Program Files\Trend Micro 2008-04-25 04:54:13 0 d-------- C:\Program Files\Panda Security 2008-04-25 04:25:51 0 dr-h----- C:\Documents and Settings\azo\Recent 2008-04-25 03:40:03 0 dr------- C:\Documents and Settings\LocalService\Favorites 2008-04-25 03:39:38 0 d-------- C:\Documents and Settings\LocalService\Application Data\Mozilla 2008-04-25 03:00:42 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-24 13:43:39 0 d-------- C:\Program Files\PDAmill 2008-04-24 13:43:26 0 d-------- C:\Program Files\Ziosoft 2008-04-23 23:56:41 0 d-------- C:\Program Files\Games 2008-04-21 19:27:02 0 d-------- C:\Program Files\Handmark(2) 2008-04-15 12:27:24 0 d-------- C:\Program Files\Astraware 2008-04-13 14:31:56 0 d-------- C:\Program Files\Navman 2008-04-12 18:55:26 0 d-------- C:\WINDOWS\WinRAR 2008-04-11 12:05:32 0 d--hs---- C:\FOUND.002 2008-04-11 00:53:11 0 d-------- C:\Program Files\PIBukhariHadith 2008-04-10 09:20:18 0 d--hs---- C:\FOUND.001 2008-04-09 21:43:12 0 d-------- C:\Program Files\Sysinternals 2008-04-08 17:04:38 0 d-------- C:\Documents and Settings\azo\Application Data\Apple Computer 2008-03-29 17:05:43 0 d-------- C:\Program Files\QuickTime 2008-03-29 17:05:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-03-27 14:32:05 0 d-------- C:\Program Files\Dnote Software -- Find3M Report --------------------------------------------------------------- 2008-04-25 05:20:46 3308 --a------ C:\WINDOWS\bthservsdp.dat 2008-04-25 04:54:16 4463 --a------ C:\WINDOWS\mozver.dat 2008-03-16 19:50:00 0 d-------- C:\Program Files\MSECache 2008-03-14 18:50:56 0 d-------- C:\Documents and Settings\azo\Application Data\AVGTOOLBAR 2008-03-14 18:17:16 0 d-------- C:\Program Files\AVG 2008-02-28 15:48:14 0 d-------- C:\Program Files\Common Files\Thomson ResearchSoft 2008-02-25 19:05:48 0 d-------- C:\Program Files\MSXML 6.0 2008-02-23 16:49:38 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-02-22 18:25:56 335 --a------ C:\WINDOWS\nsreg.dat 2008-02-18 13:48:56 2528 --a------ C:\Documents and Settings\azo\Application Data\$_hpcst$.hpc 2008-02-13 13:23:24 3447 --a------ C:\WINDOWS\unins000.dat 2008-02-13 13:21:24 691545 --a------ C:\WINDOWS\unins000.exe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 28/03/2008 01:26 2051328 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [28/03/2008 01:26 2051328] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [03/08/2004 16:56 C:\WINDOWS\system32\bthprops.cpl] "Athan"="C:\Program Files\Athan\Athan.exe" [12/09/2005 01:04] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [03/11/2006 19:20] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [28/03/2008 01:26] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [31/01/2008 23:13] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [27/02/2008 17:33] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 10:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [03/08/2004 16:56] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [13/11/2006 13:39] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [12/03/2008 20:27] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [27/08/2007 16:19] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AutorunsDisabled] Ati2evxx.dll 03/08/2005 23:04 46080 C:\WINDOWS\system32\ati2evxx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d2e2c7d-5e80-11dc-900e-0010c696891d}] - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f984aac-cf87-11dc-9132-0010c696891d}] - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dccff818-0289-11dd-91b5-8000600fe800}] -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8329 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-04-25 15:45:54 ------------ |
|
     
|
|
04-27-2008, 10:51 PM
|
#2 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Fear of spyware..running sluggishly lately..sorry for undetailed title
Hello azomas and welcome,
I do see evidence of malware. This will require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows:
Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log. |
|
|
|
|
04-30-2008, 03:44 PM
|
#3 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 8
OS: XP SP2
|
Re: Fear of spyware..running sluggishly lately..sorry for undetailed title
ComboFix 08-04-29.5 - azo 2008-04-30 23:29:57.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.174 [GMT 1:00] Running from: C:\Documents and Settings\azo\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\azo\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 -------\Legacy_IPRIP -------\Service_6to4 -------\Service_Iprip ((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 ))))))))))))))))))))))))))))))) . 2008-04-30 23:23 . 2008-04-30 23:23 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-04-27 17:15 . 2008-04-27 17:15 <DIR> d-------- C:\Program Files\HeroCraft 2008-04-27 14:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-04-27 14:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-04-27 14:07 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-04-27 14:07 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll 2008-04-27 14:07 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-04-27 14:07 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-04-26 09:14 . 2008-04-26 09:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-26 09:14 . 2008-04-26 09:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-25 15:43 . 2008-04-25 15:43 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-25 15:40 . 2008-04-25 15:40 <DIR> d-------- C:\Deckard 2008-04-25 04:54 . 2008-04-25 04:54 <DIR> d-------- C:\Program Files\Panda Security 2008-04-25 03:00 . 2008-04-25 03:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-24 13:43 . 2008-04-24 13:43 <DIR> d-------- C:\Program Files\Ziosoft 2008-04-24 13:43 . 2008-04-24 13:43 <DIR> d-------- C:\Program Files\PDAmill 2008-04-23 23:56 . 2008-04-23 23:56 <DIR> d-------- C:\Program Files\Games 2008-04-21 19:27 . 2008-04-21 19:27 <DIR> d-------- C:\Program Files\Handmark(2) 2008-04-15 15:00 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-04-15 12:27 . 2008-04-15 12:27 <DIR> d-------- C:\Program Files\Astraware 2008-04-13 14:31 . 2008-04-13 14:31 <DIR> d-------- C:\Program Files\Navman 2008-04-12 18:55 . 2008-04-12 18:55 <DIR> d-------- C:\WINDOWS\WinRAR 2008-04-11 12:05 . 2008-04-11 12:05 <DIR> d--hs---- C:\FOUND.002 2008-04-11 00:53 . 2008-04-11 00:53 <DIR> d-------- C:\Program Files\PIBukhariHadith 2008-04-11 00:29 . 2008-04-11 00:29 <DIR> d-------- C:\Program Files\Unlocker 2008-04-10 09:20 . 2008-04-10 09:20 <DIR> d--hs---- C:\FOUND.001 2008-04-09 21:54 . 2008-04-09 21:58 4,096,054 --a------ C:\WINDOWS\BGInfo.bmp 2008-04-09 21:43 . 2008-04-09 21:43 <DIR> d-------- C:\Program Files\Sysinternals 2008-04-08 17:04 . 2008-04-08 17:04 <DIR> d-------- C:\Documents and Settings\azo\Application Data\Apple Computer 2008-03-29 17:05 . 2008-03-29 17:05 <DIR> d-------- C:\Program Files\QuickTime 2008-03-29 17:05 . 2008-03-29 17:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-03-27 14:32 . 2008-03-27 14:32 <DIR> d-------- C:\Program Files\Dnote Software 2008-03-16 19:49 . 2008-03-16 19:50 <DIR> d-------- C:\Program Files\MSECache 2008-03-14 20:55 . 2008-03-14 20:55 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-03-14 18:51 . 2008-03-19 10:37 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-03-14 18:51 . 2008-03-14 18:51 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys 2008-03-14 18:51 . 2008-03-14 18:51 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-03-14 18:50 . 2008-03-14 18:50 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-03-14 18:50 . 2008-03-14 18:50 <DIR> d-------- C:\Documents and Settings\azo\Application Data\AVGTOOLBAR 2008-03-14 18:50 . 2008-03-14 18:51 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-03-14 18:17 . 2008-03-14 18:17 <DIR> d-------- C:\Program Files\AVG . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 17:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-28 16:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-02-28 14:48 --------- d-----w C:\Program Files\Common Files\Thomson ResearchSoft 2008-02-23 15:49 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-02-13 12:21 691,545 ----a-w C:\WINDOWS\unins000.exe 2007-09-11 22:19 241,664 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER(3).DAT 2007-09-09 22:32 237,568 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER(2).DAT . ------- Sigcheck ------- 2007-12-26 12:27 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\system32\drivers\tcpip.sys 2007-12-26 12:27 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\system32\dllcache\tcpip.sys 2006-04-20 20:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2007-08-27 16:12 359040 3bb4b08619c111c7be8bda07aa0de6a2 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 2008-03-28 01:26 2051328 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-03-28 01:26 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-03-28 01:26 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 16:56 15360] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-03-12 20:27 1481968] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-27 16:19 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 16:56 110592 C:\WINDOWS\system32\bthprops.cpl] "Athan"="C:\Program Files\Athan\Athan.exe" [2005-09-12 01:04 937984] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-03-28 01:26 1177368] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-27 17:33 15872] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 16:56 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AutorunsDisabled] Ati2evxx.dll 2005-08-03 23:04 46080 C:\WINDOWS\system32\ati2evxx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "VIDC.YV12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\WINDOWS\\System32\\fxsclnt.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\3D Home Architect\\Home Design Deluxe 6\\Bin\\3DHA60.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\SmartST_Desktop(English_UK).exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\MapInstaller.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\RegisterProduct.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\smartst_setup_uk.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-03-14 18:51] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-03-14 18:51] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-03-14 18:50] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-03-14 18:50] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-03-19 10:37] S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 PHZINLLZR;PHZINLLZR;C:\DOCUME~1\azo\LOCALS~1\Temp\PHZINLLZR.exe [] S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 VZMGWJX;VZMGWJX;C:\DOCUME~1\azo\LOCALS~1\Temp\VZMGWJX.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d2e2c7d-5e80-11dc-900e-0010c696891d}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dccff818-0289-11dd-91b5-8000600fe800}] \Shell\AutoRun\command - H:\InstallTomTomHOME.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-30 23:33:31 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Unlocker\UnlockerHook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE C:\PROGRAM FILES\AVG\AVG8\AVGWDSVC.EXE C:\WINDOWS\SYSTEM32\TCPSVCS.EXE C:\WINDOWS\SYSTEM32\WDFMGR.EXE C:\WINDOWS\SYSTEM32\FXSSVC.EXE C:\WINDOWS\SYSTEM32\SLRUNDLL.EXE C:\PROGRAM FILES\AVG\AVG8\AVGAM.EXE C:\PROGRAM FILES\AVG\AVG8\AVGNSX.EXE C:\PROGRAM FILES\AVG\AVG8\AVGTRAY.EXE C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\RAPIMGR.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AVG\AVG8\AVGRSX.EXE . ************************************************************************** . Completion time: 2008-04-30 23:35:18 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-30 22:35:10 Pre-Run: 4,413,980,672 bytes free Post-Run: 4,319,272,960 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 221 --- E O F --- 2008-04-18 14:51:54 |
|
|
|
|
04-30-2008, 03:54 PM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 8
OS: XP SP2
|
Re: Fear of spyware..running sluggishly lately..sorry for undetailed title
Sorry...This is from log.txt
ComboFix 08-04-29.5 - azo 2008-04-30 23:29:57.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.174 [GMT 1:00] Running from: C:\Documents and Settings\azo\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\azo\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 -------\Legacy_IPRIP -------\Service_6to4 -------\Service_Iprip ((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 ))))))))))))))))))))))))))))))) . 2008-04-30 23:23 . 2008-04-30 23:23 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-04-27 17:15 . 2008-04-27 17:15 <DIR> d-------- C:\Program Files\HeroCraft 2008-04-27 14:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-04-27 14:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-04-27 14:07 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-04-27 14:07 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll 2008-04-27 14:07 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-04-27 14:07 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-04-26 09:14 . 2008-04-26 09:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-26 09:14 . 2008-04-26 09:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-25 15:43 . 2008-04-25 15:43 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-25 15:40 . 2008-04-25 15:40 <DIR> d-------- C:\Deckard 2008-04-25 04:54 . 2008-04-25 04:54 <DIR> d-------- C:\Program Files\Panda Security 2008-04-25 03:00 . 2008-04-25 03:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-24 13:43 . 2008-04-24 13:43 <DIR> d-------- C:\Program Files\Ziosoft 2008-04-24 13:43 . 2008-04-24 13:43 <DIR> d-------- C:\Program Files\PDAmill 2008-04-23 23:56 . 2008-04-23 23:56 <DIR> d-------- C:\Program Files\Games 2008-04-21 19:27 . 2008-04-21 19:27 <DIR> d-------- C:\Program Files\Handmark(2) 2008-04-15 15:00 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-04-15 12:27 . 2008-04-15 12:27 <DIR> d-------- C:\Program Files\Astraware 2008-04-13 14:31 . 2008-04-13 14:31 <DIR> d-------- C:\Program Files\Navman 2008-04-12 18:55 . 2008-04-12 18:55 <DIR> d-------- C:\WINDOWS\WinRAR 2008-04-11 12:05 . 2008-04-11 12:05 <DIR> d--hs---- C:\FOUND.002 2008-04-11 00:53 . 2008-04-11 00:53 <DIR> d-------- C:\Program Files\PIBukhariHadith 2008-04-11 00:29 . 2008-04-11 00:29 <DIR> d-------- C:\Program Files\Unlocker 2008-04-10 09:20 . 2008-04-10 09:20 <DIR> d--hs---- C:\FOUND.001 2008-04-09 21:54 . 2008-04-09 21:58 4,096,054 --a------ C:\WINDOWS\BGInfo.bmp 2008-04-09 21:43 . 2008-04-09 21:43 <DIR> d-------- C:\Program Files\Sysinternals 2008-04-08 17:04 . 2008-04-08 17:04 <DIR> d-------- C:\Documents and Settings\azo\Application Data\Apple Computer 2008-03-29 17:05 . 2008-03-29 17:05 <DIR> d-------- C:\Program Files\QuickTime 2008-03-29 17:05 . 2008-03-29 17:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-03-27 14:32 . 2008-03-27 14:32 <DIR> d-------- C:\Program Files\Dnote Software 2008-03-16 19:49 . 2008-03-16 19:50 <DIR> d-------- C:\Program Files\MSECache 2008-03-14 20:55 . 2008-03-14 20:55 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-03-14 18:51 . 2008-03-19 10:37 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-03-14 18:51 . 2008-03-14 18:51 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys 2008-03-14 18:51 . 2008-03-14 18:51 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-03-14 18:50 . 2008-03-14 18:50 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-03-14 18:50 . 2008-03-14 18:50 <DIR> d-------- C:\Documents and Settings\azo\Application Data\AVGTOOLBAR 2008-03-14 18:50 . 2008-03-14 18:51 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-03-14 18:17 . 2008-03-14 18:17 <DIR> d-------- C:\Program Files\AVG . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 17:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-28 16:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-02-28 14:48 --------- d-----w C:\Program Files\Common Files\Thomson ResearchSoft 2008-02-23 15:49 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-02-13 12:21 691,545 ----a-w C:\WINDOWS\unins000.exe 2007-09-11 22:19 241,664 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER(3).DAT 2007-09-09 22:32 237,568 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER(2).DAT . ------- Sigcheck ------- 2007-12-26 12:27 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\system32\drivers\tcpip.sys 2007-12-26 12:27 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\system32\dllcache\tcpip.sys 2006-04-20 20:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2007-08-27 16:12 359040 3bb4b08619c111c7be8bda07aa0de6a2 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 2008-03-28 01:26 2051328 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-03-28 01:26 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-03-28 01:26 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 16:56 15360] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-03-12 20:27 1481968] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-27 16:19 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 16:56 110592 C:\WINDOWS\system32\bthprops.cpl] "Athan"="C:\Program Files\Athan\Athan.exe" [2005-09-12 01:04 937984] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-03-28 01:26 1177368] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-27 17:33 15872] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 16:56 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AutorunsDisabled] Ati2evxx.dll 2005-08-03 23:04 46080 C:\WINDOWS\system32\ati2evxx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "VIDC.YV12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\WINDOWS\\System32\\fxsclnt.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\3D Home Architect\\Home Design Deluxe 6\\Bin\\3DHA60.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\SmartST_Desktop(English_UK).exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\MapInstaller.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\RegisterProduct.exe"= "C:\\Program Files\\Navman\\Navman SmartST Version 2 Desktop\\smartst_setup_uk.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-03-14 18:51] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-03-14 18:51] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-03-14 18:50] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-03-14 18:50] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-03-19 10:37] S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 PHZINLLZR;PHZINLLZR;C:\DOCUME~1\azo\LOCALS~1\Temp\PHZINLLZR.exe [] S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 16:56] S3 VZMGWJX;VZMGWJX;C:\DOCUME~1\azo\LOCALS~1\Temp\VZMGWJX.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d2e2c7d-5e80-11dc-900e-0010c696891d}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dccff818-0289-11dd-91b5-8000600fe800}] \Shell\AutoRun\command - H:\InstallTomTomHOME.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-30 23:33:31 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Unlocker\UnlockerHook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE C:\PROGRAM FILES\AVG\AVG8\AVGWDSVC.EXE C:\WINDOWS\SYSTEM32\TCPSVCS.EXE C:\WINDOWS\SYSTEM32\WDFMGR.EXE C:\WINDOWS\SYSTEM32\FXSSVC.EXE C:\WINDOWS\SYSTEM32\SLRUNDLL.EXE C:\PROGRAM FILES\AVG\AVG8\AVGAM.EXE C:\PROGRAM FILES\AVG\AVG8\AVGNSX.EXE C:\PROGRAM FILES\AVG\AVG8\AVGTRAY.EXE C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\RAPIMGR.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\AVG\AVG8\AVGRSX.EXE . ************************************************************************** . Completion time: 2008-04-30 23:35:18 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-30 22:35:10 Pre-Run: 4,413,980,672 bytes free Post-Run: 4,319,272,960 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 221 --- E O F --- 2008-04-18 14:51:54 |
|
|
|
|
04-30-2008, 08:46 PM
|
#5 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Fear of spyware..running sluggishly lately..sorry for undetailed title
Hi azomas,
It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
--------------------------------------------------------------- Run a new scan with HijackThis.exe and save the log. --------------------------------------------------------------- Please include the following in your next reply: Kaspersky results New HijackThis log Update on system behavior |
|
|
|
|
05-01-2008, 09:33 AM
|
#6 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 8
OS: XP SP2
|
Re: Fear of spyware..running sluggishly lately..sorry for undetailed title
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT Thursday, May 01, 2008 5:12:17 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 1/05/2008 Kaspersky Anti-Virus database records: 734176 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 63153 Number of viruses found: 1 Number of infected objects: 1 Number of suspicious objects: 0 Duration of the scan process: 01:09:11 Infected Object Name / Virus Name / Last Action C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\ModemLog_Smart Link 56K Voice Modem.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-12282007-035815.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwdsvc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwd.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgns.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgam.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsched.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\emc\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\AvgAm\avgam.lck Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\azo\NTUSER.DAT Object is locked skipped C:\Documents and Settings\azo\Local Settings\Temp\~DF6240.tmp Object is locked skipped C:\Documents and Settings\azo\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\azo\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\azo\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\azo\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\azo\Local Settings\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\azo\Cookies\index.dat Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\flashgot.log Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\history.dat Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\cert8.db Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\key3.db Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\parent.lock Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\search.sqlite Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\azo\Application Data\Mozilla\Firefox\Profiles\e0xdvwyi.default\formhistory.dat Object is locked skipped C:\Documents and Settings\azo\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-5-1-2008( 7-48-35 ).LOG Object is locked skipped C:\Documents and Settings\azo\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\azo\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\_restore{5D59D744-2DD3-4C0F-B4B0-5141C33581A4}\RP311\A0086577.rbf Infected: not-a-virus:AdWare.Win32.Mostofate.dt skipped C:\System Volume Information\_restore{5D59D744-2DD3-4C0F-B4B0-5141C33581A4}\RP317\change.log Object is locked skipped Scan process completed. ---------------------------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:14:04, on 01/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\slrundll.exe C:\Program Files\Athan\Athan.exe C:\Program Files\Windows Defender\MSASCui.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iiu.edu.my/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://211.25.51.9/proxy.pac O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - http://download.zonelabs.com/bin/pro...nner371420.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5854B1E4-2870-48B0-8AFC-2813D399CA83}: NameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{E184C581-3556-4F97-9AF6-BFE735F5576E}: NameServer = 202.188.0.133,202.188.1.5 O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file) O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\ O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: PHZINLLZR - Unknown owner - C:\DOCUME~1\azo\LOCALS~1\Temp\PHZINLLZR.exe (file missing) O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: VZMGWJX - Unknown owner - C:\DOCUME~1\azo\LOCALS~1\Temp\VZMGWJX.exe (file missing) -- End of file - 7045 bytes ------------------------------------------------------------------------------------------------ I'm sorry, I don't know what you mean by "update of system behavior". But I feel that it's pretty much the same, still rather sluggish. |
|
|
|
