|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-02-2008, 01:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 1
OS: XP
|
Can't get rid of popups on XP. 5 steps complete
I have a XP laptop that just is riddled with popups. I've never encountered this before so, I am stumped. I am a new user to this forum and I have completed the 5 steps, as recommended. Here are the logs:
;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-05-01 18:44:05 PROTECTIONS: 2 MALWARE: 49 SUSPECTS: 3 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== No Yes McAfee VirusScan Enterprise 8.5.0.781 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@trafficmp[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@atdmt[1].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@247realmedia[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@tribalfusion[2].txt 00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@findwhat[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@com[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@serving-sys[2].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@bs.serving-sys[2].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@ads.pointroll[1].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@realmedia[1].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@questionmarket[2].txt 00217975 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028807.DLL 00241796 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028806.DLL 00241834 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028809.DLL 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@atwola[1].txt 00268257 Application/FunWeb HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028793.DLL 00288091 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028790.DLL 00289207 Application/FunWeb HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028792.DLL 00293884 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028843.DLL 00293884 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028863.dll 00295795 Application/FunWeb HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028795.DLL 00295810 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028845.DLL 00298152 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028846.DLL 00305983 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028842.DLL 00314348 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028802.DLL 00314349 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028799.DLL 00319220 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP153\A0020460.exe 00513868 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP153\A0020458.exe 00675193 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP153\A0020466.dll 00675194 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP153\A0020465.dll 01048695 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028788.DLL 01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie Webster\Cookies\eddie_webster@enhance[2].txt 01279072 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028821.exe 01304767 Adware/IST Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028812.dll 01313177 Generic Malware Virus/Trojan No 0 Yes No C:\Program Files\WildTangent\Components\wtPropertyBag0200.dll 01319415 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028847.dll 01319416 Adware/IST Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028813.dll 01319417 Adware/IST Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028810.dll 01895084 Adware/Zango Adware No 0 No No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028824.exe[²ÜÇ\Install.dll] 01895085 Adware/Zango Adware No 0 No No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028824.exe[Resource.dll] 02125057 Adware/Zango Adware No 0 No No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028824.exe[LaunchHelp.dll] 02134732 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028814.exe 02207436 Adware/Zango Adware No 0 No No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP153\A0020459.exe[²ÖÇ\ZangoTBUninstaller.exe] 02564186 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028822.dll 02915475 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP187\A0028049.dll 02916290 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP189\A0028815.dll 02918143 Spyware/Virtumonde Spyware No 1 Yes No C:\DOCUMENTS AND SETTINGS\EDDIE WEBSTER\LOCAL SETTINGS\TEMP\_A00F36D6F1B.EXE 02918143 Spyware/Virtumonde Spyware No 1 Yes No C:\Documents and Settings\Eddie Webster\Local Settings\Temp\cd142\i2.exe 02919800 Adware/Zango Adware No 0 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP190\A0028848.dll 02932859 Adware/MalwareAlarm Adware No 1 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP195\A0029009.exe 02932859 Adware/MalwareAlarm Adware No 1 Yes No C:\Documents and Settings\Eddie Webster\Local Settings\Temp\install_3446.exe 02932859 Adware/MalwareAlarm Adware No 1 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP194\A0028990.exe 02932859 Adware/MalwareAlarm Adware No 1 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP187\A0028065.exe 02935148 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\Temp\NT20CEF32.exe 02935148 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP187\A0028050.exe ;=================================================================================================================================================================================== SUSPECTS Sent Location | ;=================================================================================================================================================================================== No C:\WINDOWS\SYSTEM32\__C0060CE6.DAT | No C:\Documents and Settings\Eddie Webster\Local Settings\Temporary Internet Files\Content.IE5\6ALX4CT7\ib[1].exe No C:\WINDOWS\system32\__c00F739A.exe | ;=================================================================================================================================================================================== VULNERABILITIES Id Severity Description | Deckard's System Scanner v20071014.68 Run by Eddie Webster on 2008-05-02 10:58:06 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 55: 2008-05-02 15:58:13 UTC - RP200 - Deckard's System Scanner Restore Point 54: 2008-05-02 15:07:25 UTC - RP199 - Windows Defender Checkpoint 53: 2008-05-01 21:22:29 UTC - RP198 - Removed Ad-Aware 2007 52: 2008-05-01 19:39:45 UTC - RP197 - Software Distribution Service 3.0 51: 2008-05-01 15:45:13 UTC - RP196 - System Checkpoint -- First Restore Point -- 1: 2008-04-12 03:35:10 UTC - RP146 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-02 11:00:35 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\WLTRYSVC.EXE C:\WINDOWS\system32\BCMWLTRY.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\common\DataServer.exe C:\NOKIAMGR\SYSTEM32\GCSServer.exe C:\NOKIAMGR\SYSTEM32\gcssync.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\WINDOWS\explorer.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe C:\Program Files\Dell\QuickSet\NicConfigSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\system32\WLTRAY.EXE C:\WINDOWS\stsystra.exe C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Lexmark 4300 Series\lxcemon.exe C:\Program Files\Lexmark 4300 Series\ezprint.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\NetWaiting\netwaiting.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Location Finder\LocationFinder.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\McAfee\Common Framework\Mctray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\Apoint\hidfind.exe C:\Program Files\Apoint\ApntEx.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\lxcecoms.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Documents and Settings\Eddie Webster\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {492CD742-1AF6-4221-9C71-076AF8B3EB8A} - C:\WINDOWS\system32\vtUmMDTm.dll (file missing) O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\ScriptCl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe" O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16 O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [A00F36D6F1B.exe] C:\DOCUME~1\EDDIEW~1\LOCALS~1\Temp\_A00F36D6F1B.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1209587756718 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O18 - Protocol: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - AppInit_DLLs: wxvault.dll O20 - Winlogon Notify: __c0060CE6 - C:\WINDOWS\system32\__c0060CE6.dat O20 - Winlogon Notify: __c00E8BBD - C:\WINDOWS\system32\__c00E8BBD.dat (file missing) O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\common\DataServer.exe O23 - Service: Nokia GCS (GCSR4) - Nokia - C:\NOKIAMGR\SYSTEM32\GCSServer.exe O23 - Service: Nokia GCS Sync (GCSSYNC) - Nokia - C:\NOKIAMGR\SYSTEM32\gcssync.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\system32\WLTRYSVC.EXE -- End of file - 12954 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 PBADRV - c:\windows\system32\drivers\pbadrv.sys <Not Verified; Dell Inc; PBA Driver> R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver> R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver> S3 grmnusb - c:\windows\system32\drivers\grmnusb.sys <Not Verified; GARMIN Corp.; Garmin USB GPS> S3 pwi_bus (Curitel PC Card Composite Device driver (WDM)) - c:\windows\system32\drivers\pwi_bus.sys (file missing) S3 pwi_mdfl (Curitel PC Card Filter) - c:\windows\system32\drivers\pwi_mdfl.sys (file missing) S3 pwi_mdm (Curitel PC Card Drivers) - c:\windows\system32\drivers\pwi_mdm.sys (file missing) S3 pwi_oflt (Curitel PC Card OHCI Filter) - c:\windows\system32\drivers\pwi_oflt.sys (file missing) S3 pwi_serd (Curitel PC Card Diagnostic Serial Port (WDM)) - c:\windows\system32\drivers\pwi_serd.sys (file missing) S3 SMNDIS5 (SMNDIS5 NDIS Protocol Driver) - c:\program files\verizon wireless\vzaccess manager\smndis5.sys <Not Verified; Smith Micro Software, Inc.; QuickLink Wi-Fi> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 DataSvr2 - "c:\program files\wave systems corp\common\dataserver.exe" <Not Verified; Wave Systems Corp.; Authentication Manager> R2 GCSR4 (Nokia GCS) - c:\nokiamgr\system32\gcsserver.exe <Not Verified; Nokia; GCS R4 Communication Service> R2 GCSSYNC (Nokia GCS Sync) - c:\nokiamgr\system32\gcssync.exe <Not Verified; Nokia; GCS R4 Communication Service> R2 NICCONFIGSVC - c:\program files\dell\quickset\nicconfigsvc.exe <Not Verified; Dell Inc.; NicConfigSvc> R2 tcsd_win32.exe (NTRU Hybrid TSS v2.0.7 TCS) - "c:\program files\ntru cryptosystems\ntru hybrid tss v2.0.7\bin\tcsd_win32.exe" -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-02 10:02:29 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job -- Files created between 2008-04-02 and 2008-05-02 ----------------------------- 2008-05-02 10:41:21 0 d-------- C:\ie-spyad_zo 2008-05-01 19:49:45 0 d-------- C:\Program Files\ZonedOut 2008-05-01 19:26:17 21312 --a------ C:\WINDOWS\choice.exe 2008-05-01 19  10 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP2008-05-01 19 02 0 d-------- C:\Program Files\SpywareBlaster2008-05-01 16:56:16 0 d-------- C:\Program Files\Panda Security 2008-05-01 16:22:44 0 d-------- C:\WINDOWS\system32\appmgmt 2008-05-01 14:41:26 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-05-01 13:59:40 0 d-------- C:\WINDOWS\pss 2008-05-01 13:53:17 0 d-------- C:\!KillBox 2008-05-01 13:27:42 0 d-------- C:\Program Files\CURITEL 2008-04-30 15:30:05 3840 --a------ C:\WINDOWS\system32\drivers\BANTExt.sys 2008-04-30 15:30:05 0 d-------- C:\Program Files\Belarc 2008-04-30 11:02:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-04-30 09:24:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2008-04-29 18:00:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-29 14:23:12 0 d-------- C:\Program Files\Windows Defender 2008-04-23 08:33:04 6489 --ahs---- C:\WINDOWS\system32\jkUBcJjl.ini2 2008-04-23 06:55:34 249344 --a------ C:\WINDOWS\system32\efommvxp(2).dll 2008-04-22 10:27:59 6551 --ahs---- C:\WINDOWS\system32\gPAHhRqr.ini2 2008-04-22 00:30:17 0 d-------- C:\Program Files\LiveAntispy 2008-04-22 00:29:54 1219418 --a------ C:\Documents and Settings\Eddie Webster\Application Data\Install.dat 2008-04-21 15:26:11 6513 --ahs---- C:\WINDOWS\system32\jSrAdMoq.ini2 2008-04-19 17:13:37 6881 --ahs---- C:\WINDOWS\system32\GOYccMoq.ini2 2008-04-18 13:26:38 6745 --ahs---- C:\WINDOWS\system32\BIilSvut.ini2 2008-04-11 22:35:00 6853 --ahs---- C:\WINDOWS\system32\mTDMmUtv.ini2 2008-04-11 14:26:24 37888 --a------ C:\WINDOWS\system32\__c0060CE6.dat 2008-04-04 21:33:17 309 --a------ C:\xcrashdump.dat -- Find3M Report --------------------------------------------------------------- 2008-05-02 09:42:43 0 d-------- C:\Program Files\Lx_cats 2008-05-01 19:21:59 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-01 19:21:58 0 d-------- C:\Program Files\Modem Helper 2008-05-01 19:21:58 0 d-------- C:\Program Files\Microsoft Location Finder 2008-05-01 19:21:58 0 d-------- C:\Program Files\Messenger 2008-05-01 19:21:58 0 d-------- C:\Program Files\Apoint 2008-05-01 19:21:57 0 d-------- C:\Program Files\NetWaiting 2008-05-01 13:27:41 0 d-------- C:\Program Files\Verizon Wireless 2008-04-30 10:02:14 0 d-------- C:\Documents and Settings\Eddie Webster\Application Data\Google 2008-04-30 09:24:05 0 d-------- C:\Program Files\Google 2008-04-29 17:59:18 0 d-------- C:\Program Files\Common Files 2008-04-29 13:02:34 0 d-------- C:\Program Files\Common Files\Adobe 2008-04-29 13:01:04 0 d-------- C:\Documents and Settings\Eddie Webster\Application Data\HP 2008-03-13 00:33:07 0 d-------- C:\Documents and Settings\Eddie Webster\Application Data\AdobeUM 2008-03-03 15:58:37 0 d-------- C:\Documents and Settings\Eddie Webster\Application Data\U3 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{492CD742-1AF6-4221-9C71-076AF8B3EB8A}] C:\WINDOWS\system32\vtUmMDTm.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [10/07/2005 12:13 PM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [12/13/2005 04:44 PM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [12/13/2005 04:41 PM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [12/13/2005 04:45 PM] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [11/19/2003 05:48 PM] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [12/19/2005 08:08 AM] "SigmatelSysTrayApp"="stsystra.exe" [03/24/2006 04:30 PM C:\WINDOWS\stsystra.exe] "Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [03/09/2006 12:26 PM] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [12/09/2005 08:29 PM] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [04/06/2006 02:58 PM] "lxcemon.exe"="C:\Program Files\Lexmark 4300 Series\lxcemon.exe" [03/22/2005 12:25 PM] "EzPrint"="C:\Program Files\Lexmark 4300 Series\ezprint.exe" [02/15/2005 05:07 AM] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [03/16/2005 04:10 AM] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [02/19/2006 02:41 AM] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [06/08/2007 09:59 AM] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [07/12/2005 07:05 PM] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [02/22/2007 09:50 PM] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [12/19/2006 12:27 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 07:20 PM] "LXCECATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [03/22/2005 05:45 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [09/10/2003 02:24 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM] "Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [08/24/2005 06:25 PM] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [06/08/2007 09:59 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [12/30/2007 06:23 PM] "A00F36D6F1B.exe"="C:\DOCUME~1\EDDIEW~1\LOCALS~1\Temp\_A00F36D6F1B.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [5/15/2003 1:19:50 AM] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [7/22/2006 2:01:31 AM] EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [11/30/2005 9:39:02 AM] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [12/30/2007 6:23:19 PM] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2/19/2006 4:21:22 AM] HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2/10/2006 7:56:20 AM] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [5/3/2005 10:07:32 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c0060CE6] C:\WINDOWS\system32\__c0060CE6.dat 05/01/2008 02:37 PM 37888 C:\WINDOWS\system32\__c0060CE6.dat [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00E8BBD] C:\WINDOWS\system32\__c00E8BBD.dat [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wxvault.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 wvauth C:\WINDOWS\system32\vtUmMDTm.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a861e20-5f77-11dc-9d28-0016ce8eafae}] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e275fc98-6e66-11dc-9d4b-0016ce8eafae}] AutoRun\command- wd_windows_tools\setup.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8300 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-05-02 11:01:58 ------------ |
|
     
|
|
05-03-2008, 09:38 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 24,442
OS: 2000 Pro; XP Pro; XP Home
|
Re: Can't get rid of popups on XP. 5 steps complete
Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. |
|
|
|
|
| Thread Tools | |
|
|
