|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-02-2008, 01:12 PM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 5
OS: windows xp home edition
|
Dss and HiJack this log, HElp please
Read thru 5 steps for posting, and could do all but the panda active scan, i download dss had hijack this and dowloaded the other file ie spy ad./zoned out. so now im just sending my dss and hijack this file.
Deckard's System Scanner v20071014.68 Run by Brian on 2008-05-02 14:55:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 79: 2008-05-02 19:55:40 UTC - RP805 - Deckard's System Scanner Restore Point 78: 2008-05-01 23:43:58 UTC - RP804 - Advanced WindowsCare RestorePoint 77: 2008-04-28 05:01:46 UTC - RP803 - Last known good configuration 76: 2008-04-28 05:00:58 UTC - RP802 - Last known good configuration 75: 2008-04-28 05:00:56 UTC - RP801 - Last known good configuration -- First Restore Point -- 1: 2008-04-28 04:59:56 UTC - RP727 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 254 MiB (512 MiB recommended). -- HijackThis (run as Brian.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:57:12 PM, on 5/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\winself.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Documents and Settings\Brian\Desktop\nick, nikki docs\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Brian.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file) O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file) O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file) O2 - BHO: (no name) - {8334A30C-49E5-489a-B63D-5B927C1EF46E} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file) O2 - BHO: (no name) - {E8824AB7-9A0C-4C16-88FF-E4797B35B8F4} - (no file) O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file) O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file) O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {1A595EDD-978A-48C7-B730-AF3B9CC64DAB} (DLManager Class) - https://vmodlms.widerthanam.com/comp...WDLManager.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.gdls.com/whalecomf6528f...0/iNotes6W.cab O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\winself.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 5664 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080428-145409-457 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 MPFIREWL - c:\windows\system32\drivers\mpfirewall.sys <Not Verified; McAfee; McAfee Personal Firewall> R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\winself.exe service R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-04-02 and 2008-05-02 ----------------------------- 2008-05-02 14:42:21 0 d-------- C:\ie-spyad_zo 2008-05-02 14:39:32 0 d-------- C:\Program Files\SpywareBlaster 2008-05-02 14:27:06 0 d-------- C:\Program Files\Panda Security 2008-05-02 14:27:03 0 d-------- C:\WINDOWS\LastGood 2008-05-01 18:43:04 0 d-------- C:\Program Files\IObit 2008-05-01 18:27:00 0 d-------- C:\Documents and Settings\Brian\Application Data\Uniblue 2008-05-01 18:08:44 0 d-------- C:\Program Files\Uniblue 2008-04-28 22:21:48 0 d-------- C:\WINDOWS\pss 2008-04-28 14:47:11 0 d-------- C:\Program Files\Trend Micro 2008-04-28 01:57:37 0 d-------- C:\Program Files\Enigma Software Group 2008-04-27 22:35:41 0 d-------- C:\Documents and Settings\Administrator\Application Data\Webroot 2008-04-27 22:33:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools 2008-04-27 22:29:05 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-04-27 22:29:05 0 d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-04-27 22:29:05 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-04-27 22:29:04 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-04-27 22:29:04 0 dr------- C:\Documents and Settings\Administrator\Favorites 2008-04-27 22:29:04 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-04-27 22:29:04 0 d---s---- C:\Documents and Settings\Administrator\Cookies 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-04-27 22:29:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-04-27 22:29:03 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-04-27 22:29:03 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-04-27 22:29:02 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2008-04-27 22:28:52 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2008-04-27 20:15:57 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-27 20:15:27 0 d-------- C:\Program Files\Common Files\PC Tools 2008-04-27 18:08:27 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-04-27 18:07:58 0 d-------- C:\Program Files\Webroot 2008-04-27 18:07:58 0 d-------- C:\Documents and Settings\Brian\Application Data\Webroot 2008-04-27 18:07:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-04-27 18  53 164 --a------ C:\install.dat2008-04-27 13:26:37 12288 --a------ C:\WINDOWS\voiceip.dll 2008-04-27 13:26:37 20992 --a------ C:\WINDOWS\swin32.dll 2008-04-27 13:26:37 11008 --a------ C:\WINDOWS\mssvr.exe 2008-04-27 13:26:37 14592 --a------ C:\WINDOWS\mspphe.dll 2008-04-27 13:26:37 8448 --a------ C:\WINDOWS\cdsm32.dll 2008-04-27 13:26:37 17152 --a------ C:\WINDOWS\bokja.exe 2008-04-27 13:26:36 29696 --a------ C:\WINDOWS\2020search2.dll 2008-04-27 13:26:35 23040 --a------ C:\WINDOWS\2020search.dll 2008-04-27 13:26:29 21760 --a------ C:\WINDOWS\saiemod.dll 2008-04-27 13:26:27 32256 --a------ C:\WINDOWS\msapasrc.dll 2008-04-27 13:26:26 16896 --a------ C:\WINDOWS\msa64chk.dll 2008-04-27 13:26:25 27392 --a------ C:\WINDOWS\shdocpl.dll 2008-04-27 13:26:23 29696 --a------ C:\WINDOWS\shdocpe.dll 2008-04-27 13:26:23 14848 --a------ C:\WINDOWS\ntnut.exe 2008-04-27 13:26:22 13568 --a------ C:\WINDOWS\winsb.dll 2008-04-27 13:26:21 22528 --a------ C:\WINDOWS\browserad.dll 2008-04-27 13:26:21 12288 --a------ C:\WINDOWS\aviwrap32.dll 2008-04-27 13:26:21 11264 --a------ C:\WINDOWS\avisynthex32.dll 2008-04-27 13:26:21 16384 --a------ C:\WINDOWS\avifile32.dll 2008-04-27 13:26:21 30464 --a------ C:\WINDOWS\autodisc32.dll 2008-04-27 13:26:20 22784 --a------ C:\WINDOWS\audiosrv32.dll 2008-04-27 13:26:20 15360 --a------ C:\WINDOWS\ati2dvag32.dll 2008-04-27 13:26:20 28672 --a------ C:\WINDOWS\ati2dvaa32.dll 2008-04-27 13:26:19 14080 --a------ C:\WINDOWS\athprxy32.dll 2008-04-27 13:26:19 12032 --a------ C:\WINDOWS\asycfilt32.dll 2008-04-27 13:26:19 13312 --a------ C:\WINDOWS\asferror32.dll 2008-04-27 13:26:19 24320 --a------ C:\WINDOWS\apphelp32.dll 2008-04-27 13:26:18 15360 --a------ C:\WINDOWS\changeurl_30.dll 2008-04-27 13:16:25 7784 --ahs---- C:\WINDOWS\system32\MSBIlUtv.ini2 2008-04-27 13:11:10 4 --a------ C:\WINDOWS\system32\winfrun32.bin 2008-04-27 13:11:07 88491 --a------ C:\WINDOWS\system32\wmsdkns.exe <Not Verified; Microsoft; XML Media> 2008-04-27 13:11:07 88491 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media> 2008-04-27 13:10:33 29696 --a------ C:\WINDOWS\winself.exe 2008-04-27 07:22:35 270709 --a------ C:\WINDOWS\system32\000080.exe 2008-04-15 23:10:49 0 d-------- C:\Documents and Settings\Brian\Application Data\Smith Micro 2008-04-11 13:44:58 229526 --a------ C:\WINDOWS\system32\000070.exe 2008-04-03 21:54:55 0 d--hs---- C:\WINDOWS\ftpcache 2008-04-03 21:46:41 0 d-------- C:\temp 2008-04-03 21:44:20 0 d-------- C:\Program Files\Samsung 2008-04-03 21:43:15 532480 --a------ C:\WINDOWS\system32\VZWDownManager.exe <Not Verified; Verizon; VZWDownManager Application> 2008-04-03 21:43:15 49152 --a------ C:\WINDOWS\system32\VZWDLManager.dll <Not Verified; ; VZWDLManager Module> -- Find3M Report --------------------------------------------------------------- 2008-04-27 20:15:27 0 d-------- C:\Program Files\Common Files 2008-04-27 15:19:40 13 --a------ C:\WINDOWS\C6E9-06F1-D409-40FA.dat 2008-04-09 15:01:40 0 d-------- C:\Program Files\eSoftware 2008-04-09 03:04:05 0 d-------- C:\Program Files\DellSupport 2008-04-09 03:04:01 0 d-------- C:\Program Files\QuickTime 2008-04-09 03:04:01 0 d-------- C:\Program Files\Messenger 2008-04-03 21:43:08 0 d-------- C:\Program Files\Verizon Wireless 2008-03-10 15:26:07 0 d-------- C:\Documents and Settings\Brian\Application Data\MySpace 2008-03-04 22:33:17 0 d-------- C:\Program Files\Java 2008-03-04 22:32:12 0 d-------- C:\Program Files\Common Files\Java -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8334A30C-49E5-489a-B63D-5B927C1EF46E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E8824AB7-9A0C-4C16-88FF-E4797B35B8F4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [03/01/2008 12:10 AM] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] C:\Documents and Settings\Brian\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 2:04:12 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 2:04:12 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) "LinkResolveIgnoreLinkInfo"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "WebProxy"= {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll [ ] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtUlIBSM [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^V CAST Music Monitor.lnk] path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\V CAST Music Monitor.lnk backup=C:\WINDOWS\pss\V CAST Music Monitor.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule -- End of Deckard's System Scanner: finished at 2008-05-02 14:59:00 ------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:08:46 PM, on 5/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\winself.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file) O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file) O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file) O2 - BHO: (no name) - {8334A30C-49E5-489a-B63D-5B927C1EF46E} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file) O2 - BHO: (no name) - {E8824AB7-9A0C-4C16-88FF-E4797B35B8F4} - (no file) O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file) O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file) O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {1A595EDD-978A-48C7-B730-AF3B9CC64DAB} (DLManager Class) - https://vmodlms.widerthanam.com/comp...WDLManager.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.gdls.com/whalecomf6528f...0/iNotes6W.cab O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\winself.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 5710 bytes any help would be appreciated. |
|
     
|
|
05-03-2008, 10:51 AM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Oct 2007
Posts: 1,362
OS: XP SP3
|
Re: Dss and HiJack this log, HElp please
Hello and Welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please be patient with me during this time. |
|
|
|
|
05-03-2008, 05:59 PM
|
#3 (permalink) | ||
|
Analyst, Security Team
Join Date: Oct 2007
Posts: 1,362
OS: XP SP3
|
Re: Dss and HiJack this log, HElp please
Please save this page to Notepad in order to assist you when carrying out the following instructions.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Although McAfee Security Center is showing in your Add or Remove Programs Panel, it appears that you have no antivirus program running. Please inform us of your current state of antivirus protection. ------------------------------------------------------ Quote:
------------------------------------------------------ If your system seems sluggish, it is most likely due to low RAM. Quote:
Please visit Crucial where you can either input your model number or download a small application that will tell you exactly the type of RAM you need. ------------------------------------------------------ I see you have SpyHunter installed on your system. This application was previously listed as a rogue program because of deceptive advertising. Please read here Although no longer listed as such, we recommend uninstalling it via Add or Remove Programs in your control panel and downloading antispyware programs that have proven themselves tried and true. See here for a list of trustworthy antispyware products. If you decide to uninstall it, also delete this Folder if it still exists: C:\Program Files\Enigma Software Group ------------------------------------------------------ Please uninstall the following via the Add or Remove Panel (Start->(or My Computer)->Control Panel->Add or Remove Programs) if they exist: Viewpoint Media Player<<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here ------------------------------------------------------ Please visit this webpage for instructions on downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed.  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. Last edited by chemist : 05-03-2008 at 06:16 PM. |
||
|
|
|
|
05-04-2008, 03:52 PM
|
#4 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 5
OS: windows xp home edition
|
Re: Dss and HiJack this log, HElp please
I dont have a virus program,, i was wondering if you could make a suggestion for a good,small, and free program.
ComboFix 08-05-01.3 - Brian 2008-05-04 17:27:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.98 [GMT -5:00] Running from: C:\Documents and Settings\Brian\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Brian\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\B.tmp C:\Program Files\WinBudget C:\Program Files\WinBudget\bin\matrix.dll C:\WINDOWS\123messenger.per C:\WINDOWS\2020search.dll C:\WINDOWS\2020search2.dll C:\WINDOWS\apphelp32.dll C:\WINDOWS\asferror32.dll C:\WINDOWS\asycfilt32.dll C:\WINDOWS\athprxy32.dll C:\WINDOWS\ati2dvaa32.dll C:\WINDOWS\ati2dvag32.dll C:\WINDOWS\audiosrv32.dll C:\WINDOWS\autodisc32.dll C:\WINDOWS\avifile32.dll C:\WINDOWS\avisynthex32.dll C:\WINDOWS\aviwrap32.dll C:\WINDOWS\bokja.exe C:\WINDOWS\browserad.dll C:\WINDOWS\cdsm32.dll C:\WINDOWS\changeurl_30.dll C:\WINDOWS\default.htm C:\WINDOWS\didduid.ini C:\WINDOWS\lfn.exe C:\WINDOWS\licencia.txt C:\WINDOWS\mainms.vpi C:\WINDOWS\megavid.cdt C:\WINDOWS\msa64chk.dll C:\WINDOWS\msapasrc.dll C:\WINDOWS\mspphe.dll C:\WINDOWS\mssvr.exe C:\WINDOWS\muotr.so C:\WINDOWS\ntnut.exe C:\WINDOWS\saiemod.dll C:\WINDOWS\shdocpe.dll C:\WINDOWS\shdocpl.dll C:\WINDOWS\swin32.dll C:\WINDOWS\SYSTEM32\000070.exe C:\WINDOWS\SYSTEM32\000080.exe C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\SYSTEM32\MSBIlUtv.ini C:\WINDOWS\SYSTEM32\MSBIlUtv.ini2 C:\WINDOWS\system32\sft.res C:\WINDOWS\system32\winfrun32.bin C:\WINDOWS\telefonos.txt C:\WINDOWS\textos.txt C:\WINDOWS\voiceip.dll C:\WINDOWS\winsb.dll C:\WINDOWS\winself.exe C:\WINDOWS\wintst32.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MSSECURITY1.209.4 -------\Service_MsSecurity1.209.4 ((((((((((((((((((((((((( Files Created from 2008-04-04 to 2008-05-04 ))))))))))))))))))))))))))))))) . 2008-05-02 14:54 . 2008-05-02 14:54 <DIR> d-------- C:\Deckard 2008-05-02 14:42 . 2008-05-02 14:42 <DIR> d-------- C:\ie-spyad_zo 2008-05-02 14:39 . 2008-05-02 15:53 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-02 14:39 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-05-02 14:27 . 2008-05-04 17:09 <DIR> d-------- C:\Program Files\Panda Security 2008-05-01 18:43 . 2008-05-01 18:43 <DIR> d-------- C:\Program Files\IObit 2008-05-01 18:27 . 2008-05-01 18:27 <DIR> d-------- C:\Documents and Settings\Brian\Application Data\Uniblue 2008-05-01 18:08 . 2008-05-01 18:33 <DIR> d-------- C:\Program Files\Uniblue 2008-04-28 14:47 . 2008-04-28 14:47 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-28 00:55 . 2008-04-28 00:57 <DIR> d-------- C:\Program Files\Unlocker 2008-04-27 22:35 . 2008-04-27 22:35 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Webroot 2008-04-27 22:33 . 2008-04-27 22:33 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools 2008-04-27 22:29 . 2005-02-24 14:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-04-27 22:29 . 2008-04-27 22:29 <DIR> d-------- C:\Documents and Settings\Administrator 2008-04-27 22:29 . 2008-05-04 17:26 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG 2008-04-27 22:28 . 2008-04-27 22:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2008-04-27 20:15 . 2008-04-27 20:15 <DIR> d-------- C:\Program Files\Common Files\PC Tools 2008-04-27 20:15 . 2008-05-04 17:23 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-27 18:08 . 2008-04-27 18:08 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-04-27 18:08 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys 2008-04-27 18:08 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys 2008-04-27 18:08 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys 2008-04-27 18:08 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys 2008-04-27 18:07 . 2008-04-27 18:07 <DIR> d-------- C:\Program Files\Webroot 2008-04-27 18:07 . 2008-04-27 18:07 <DIR> d-------- C:\Documents and Settings\Brian\Application Data\Webroot 2008-04-27 18:07 . 2008-04-27 18:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-04-27 18:07 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-04-27 18:06 . 2008-04-27 18:06 164 --a------ C:\install.dat 2008-04-27 15:20 . 2008-04-27 15:20 9,662 --a------ C:\WINDOWS\SYSTEM32\ZoneAlarmIconUS.ico 2008-04-27 15:19 . 2008-04-27 15:19 9,662 --a------ C:\WINDOWS\SYSTEM32\ZoneAlarmIconUK.ico 2008-04-27 15:19 . 2008-04-27 15:19 9,662 --a------ C:\WINDOWS\SYSTEM32\ZoneAlarmIconFR.ico 2008-04-27 15:11 . 2008-04-27 15:11 57,546 --a------ C:\WINDOWS\promogif3.gif 2008-04-27 15:11 . 2008-04-27 15:11 24,351 --a------ C:\WINDOWS\promogif1.gif 2008-04-27 15:11 . 2008-04-27 15:11 24,066 --a------ C:\WINDOWS\promogif2.gif 2008-04-27 13:11 . 2004-08-04 06:00 4,224 --a------ C:\WINDOWS\SYSTEM32\beep.sys 2008-04-15 23:10 . 2008-04-15 23:10 <DIR> d-------- C:\Documents and Settings\Brian\Application Data\Smith Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-09 20:01 --------- d-----w C:\Program Files\eSoftware 2008-04-09 08:04 --------- d-----w C:\Program Files\QuickTime 2008-04-09 08:04 --------- d-----w C:\Program Files\DellSupport 2008-04-04 02:44 --------- d-----w C:\Program Files\Samsung 2008-04-04 02:43 --------- d-----w C:\Program Files\Verizon Wireless 2008-03-10 20:26 --------- d-----w C:\Documents and Settings\Brian\Application Data\MySpace 2008-03-05 03:33 --------- d-----w C:\Program Files\Java 2008-03-05 03:32 --------- d-----w C:\Program Files\Common Files\Java 2007-12-08 20:04 39,504 ----a-w C:\Documents and Settings\Brian\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 00:10 15872] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 20:56 5367664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 20:56 5367664] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "WebProxy"= {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll [ ] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys] @="driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^V CAST Music Monitor.lnk] path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\V CAST Music Monitor.lnk backup=C:\WINDOWS\pss\V CAST Music Monitor.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\America Online 9.0\\waol.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-04 17:33:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... C:\WINDOWS\explorer.exe [1500] 0xFF955DA0 scanning hidden autostart entries ... scanning hidden files ... folder error: C:\DOCUME~1\Brian\LOCALS~1\Temp\ scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\McAfee.com\Agent\Mcdetect.exe C:\PROGRA~1\McAfee.com\Agent\McTskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe . ************************************************************************** . Completion time: 2008-05-04 17:39:47 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-04 22:39:40 Pre-Run: 27,311,087,616 bytes free Post-Run: 27,584,159,744 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 190 --- E O F --- 2008-05-04 05:30:20 new hijack this log Deckard's System Scanner v20071014.68 Run by Brian on 2008-05-04 17:45:38 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 254 MiB (512 MiB recommended). -- HijackThis (run as Brian.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:46:03 PM, on 5/4/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Brian\Desktop\nick, nikki docs\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Brian.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {1A595EDD-978A-48C7-B730-AF3B9CC64DAB} (DLManager Class) - https://vmodlms.widerthanam.com/comp...WDLManager.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.gdls.com/whalecomf6528f...0/iNotes6W.cab O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 4308 bytes -- Files created between 2008-04-04 and 2008-05-04 ----------------------------- 2008-05-04 17:26:59 0 d-------- C:\cmdcons 2008-05-04 17:25:58 68096 --a------ C:\WINDOWS\zip.exe 2008-05-04 17:25:58 49152 --a------ C:\WINDOWS\VFind.exe 2008-05-04 17:25:58 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-05-04 17:25:58 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-05-04 17:25:58 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-05-04 17:25:58 98816 --a------ C:\WINDOWS\sed.exe 2008-05-04 17:25:58 80412 --a------ C:\WINDOWS\grep.exe 2008-05-04 17:25:58 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-05-02 14:42:21 0 d-------- C:\ie-spyad_zo 2008-05-02 14:39:32 0 d-------- C:\Program Files\SpywareBlaster 2008-05-02 14:27:06 0 d-------- C:\Program Files\Panda Security 2008-05-01 18:43:04 0 d-------- C:\Program Files\IObit 2008-05-01 18:27:00 0 d-------- C:\Documents and Settings\Brian\Application Data\Uniblue 2008-05-01 18:08:44 0 d-------- C:\Program Files\Uniblue 2008-04-28 22:21:48 0 d-------- C:\WINDOWS\pss 2008-04-28 14:47:11 0 d-------- C:\Program Files\Trend Micro 2008-04-27 22:35:41 0 d-------- C:\Documents and Settings\Administrator\Application Data\Webroot 2008-04-27 22:33:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools 2008-04-27 22:29:05 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-04-27 22:29:05 0 d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-04-27 22:29:05 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-04-27 22:29:04 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-04-27 22:29:04 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-04-27 22:29:04 0 dr------- C:\Documents and Settings\Administrator\Favorites 2008-04-27 22:29:04 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-04-27 22:29:04 0 d---s---- C:\Documents and Settings\Administrator\Cookies 2008-04-27 22:29:04 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-04-27 22:29:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-04-27 22:29:03 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-04-27 22:29:03 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-04-27 22:29:02 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2008-04-27 22:28:52 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2008-04-27 20:15:57 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-27 20:15:27 0 d-------- C:\Program Files\Common Files\PC Tools 2008-04-27 18:08:27 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-04-27 18:07:58 0 d-------- C:\Program Files\Webroot 2008-04-27 18:07:58 0 d-------- C:\Documents and Settings\Brian\Application Data\Webroot 2008-04-27 18:07:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-04-27 18 53 164 --a------ C:\install.dat2008-04-15 23:10:49 0 d-------- C:\Documents and Settings\Brian\Application Data\Smith Micro -- Find3M Report --------------------------------------------------------------- 2008-04-27 20:15:27 0 d-------- C:\Program Files\Common Files 2008-04-27 15:19:40 13 --a------ C:\WINDOWS\C6E9-06F1-D409-40FA.dat 2008-04-09 15:01:40 0 d-------- C:\Program Files\eSoftware 2008-04-09 03:04:05 0 d-------- C:\Program Files\DellSupport 2008-04-09 03:04:01 0 d-------- C:\Program Files\QuickTime 2008-04-09 03:04:01 0 d-------- C:\Program Files\Messenger 2008-04-03 21:44:20 0 d-------- C:\Program Files\Samsung 2008-04-03 21:43:08 0 d-------- C:\Program Files\Verizon Wireless 2008-03-10 15:26:07 0 d-------- C:\Documents and Settings\Brian\Application Data\MySpace 2008-03-04 22:33:17 0 d-------- C:\Program Files\Java 2008-03-04 22:32:12 0 d-------- C:\Program Files\Common Files\Java -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [03/01/2008 12:10 AM] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] C:\Documents and Settings\Brian\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 2:04:12 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 2:04:12 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "WebProxy"= {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll [ ] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys] @="driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Brian^Start Menu^Programs^Startup^V CAST Music Monitor.lnk] path=C:\Documents and Settings\Brian\Start Menu\Programs\Startup\V CAST Music Monitor.lnk backup=C:\WINDOWS\pss\V CAST Music Monitor.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule -- End of Deckard's System Scanner: finished at 2008-05-04 17:46:35 ------------ Last edited by tetonbob : 05-04-2008 at 06:32 PM. |
|
|
|
|
05-05-2008, 08:56 AM
|
#5 (permalink) | |
|
Analyst, Security Team
Join Date: Oct 2007
Posts: 1,362
OS: XP SP3
|
Re: Dss and HiJack this log, HElp please
Hello again, nimaste7. Please tell us how your system is behaving.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Quote:
Uninstall the following via Add or Remove Programs in your Control Panel if they still exist: McAfee Personal Firewall Plus McAfee SecurityCenter Please download the McAfee Removal Tool MCPR.exe and Save it to your Desktop.
It is imperative that you have an AntiVirus program running on your computer. Connecting to the internet without an AntiVirus program is an open invitation for infection. Here are a few very good free Antivirus products which are available: Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan. Do not install more than one AntiVirus program as they will conflict with each other. Using a third-party Firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one Firewall program as they will conflict with each other.------------------------------------------------------ Please go to: VirusTotal
Please download the Suspicious File Packer http://www.safer-networking.org/files/sfp.zip and Save it to your Desktop.
Open HijackThis by double-clicking on the HijackThis shortcut on your desktop and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Open Notepad and copy/paste the entire text in the code box below into it: (don't forget to copy and paste REGEDIT4) Code:
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}]
[-hkey_classes_root\clsid\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}]
[-hkey_classes_root\clsid\{66186F05-BBBB-4a39-864F-72D84615C679}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebProxy"=-
It should look like this:  Double-click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: VirusTotal results Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
