|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
05-03-2008, 08:50 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 23
OS: XP SP2
|
Virus Problem!!!
Hi, I have recently reformatted my computer and a week after reinstalling everything I have a major virus/malware problem. I download files but I am always careful to scan with norton and I have spyware guard and it didn't pick anything up so I am very confused how I have gotten these things. I have also downloaded this program called PREVX CSI and found lots of problems none of my other programs found. Please HELP!!! Here is the dss file I ran and attached is the screen shot from PREVX CSI (which I have no license for so I cannot clean) and the extra.txt file. I am d/c from internet now with the exception of checking this forum for help.
Deckard's System Scanner v20071014.68 Run by Main on 2008-05-03 11:37:45 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 47: 2008-05-03 15:37:52 UTC - RP47 - Deckard's System Scanner Restore Point 46: 2008-05-03 14:43:44 UTC - RP46 - Installed Ad-Aware 2007 45: 2008-05-03 13:41:45 UTC - RP45 - Removed Prevx 2.0 Agent 44: 2008-05-03 13:23:04 UTC - RP44 - Spyware Begone! Spy Removal 43: 2008-05-03 04:32:33 UTC - RP43 - Installed Prevx 2.0 Agent -- First Restore Point -- 1: 2008-05-02 15:38:39 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Main.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:41:09 AM, on 03/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\explorer.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\PrevxCSI\PrevxCSI.exe C:\Program Files\PrevxCSI\PrevxCSI.exe C:\Documents and Settings\Main\Temporary Internet Files\Content.IE5\ODEF4TU7\dss[1].exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\HP\QuickPlay\QP.exe C:\WINDOWS\system32\igfxext.exe C:\WINDOWS\system32\igfxsrvc.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Main.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file) O2 - BHO: (no name) - {5AA74FD3-2F5B-463F-8713-44ACAF18822C} - C:\WINDOWS\system32\geBrrRjH.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {BC7D8DE8-EF3D-4F44-8B54-03759FAC1367} - C:\WINDOWS\system32\geBtQiig.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [AnyDVD] C:\DOCUME~1\Main\LOCALS~1\Temp\IXP000.TMP\ANYDVD~1.EXE O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1208807845437 O20 - Winlogon Notify: geBtQiig - C:\WINDOWS\SYSTEM32\geBtQiig.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe -- End of file - 11292 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080503-095824-177 O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe backup-20080503-095824-222 O4 - HKLM\..\Run: [BM03ba3a2a] Rundll32.exe "C:\WINDOWS\system32\btijmudt.dll",s backup-20080503-095824-305 O4 - HKLM\..\Run: [008909b6] rundll32.exe "C:\WINDOWS\system32\uxrqlllm.dll",b backup-20080503-095824-376 O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe backup-20080503-095824-397 O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe backup-20080503-095824-910 O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe backup-20080503-095900-150 O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe backup-20080503-095900-407 O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe backup-20080503-095900-835 O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe backup-20080503-095900-884 O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 pxark - c:\windows\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> R3 Ad-Watch Connect Filter (Ad-Watch Connect Kernel Filter) - c:\windows\system32\drivers\nsdriver.sys <Not Verified; Lavasoft AB; Ad-Watch Connections> R3 Ad-Watch Real-Time Scanner (AW Real-Time Scanner) - c:\windows\system32\drivers\awrtpd.sys <Not Verified; Lavasoft AB; Ad-Watch Beta> R3 Ad-Watch Registry Filter (Ad-Watch Registry Kernel Filter) - c:\windows\system32\drivers\awrtrd.sys <Not Verified; Lavasoft AB; Ad-Watch Registry Protection> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 JavaQuickStarterService (Java Quick Starter) - "c:\program files\java\jre6\bin\jqs.exe" -service -config "c:\program files\java\jre6\lib\deploy\jqs\jqs.conf" <Not Verified; Sun Microsystems, Inc.; Java(TM) Platform SE 6 U10> R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager> S? perfmons - S2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service> S2 AFinding (AFinding Service) - c:\windows\system32\afinding.exe S2 Routing (Routing Service) - c:\windows\system32\routing.exe S2 WServing (WServing Service) - c:\windows\system32\wserving.exe S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-03 02:15:42 440 --a------ C:\WINDOWS\Tasks\SpyHunter Scanner.job 2008-04-28 20:00:00 620 --a------ C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Main.job -- Files created between 2008-04-03 and 2008-05-03 ----------------------------- 2008-05-03 11:31:45 10880 --a------ C:\WINDOWS\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> 2008-05-03 11:31:45 0 d-------- C:\Program Files\PrevxCSI 2008-05-03 11:31:41 0 d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI 2008-05-03 10:43:50 0 d-------- C:\Program Files\Lavasoft 2008-05-03 10:43:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-03 10:43:15 43520 --a------ C:\WINDOWS\system32\urqonNDT.dll 2008-05-03 09:58:03 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-03 09:57:49 0 d-------- C:\Program Files\Spyware Doctor 2008-05-03 09:57:49 0 d-------- C:\Documents and Settings\Main\Application Data\PC Tools 2008-05-03 09:55:59 0 d-------- C:\Program Files\Trend Micro 2008-05-03 01:44:38 724992 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-05-03 01:44:37 0 d-------- C:\spywarebegone 2008-05-03 01:31:05 0 d-------- C:\Program Files\XoftSpySE 2008-05-02 23:47:30 96320 --a------ C:\WINDOWS\system32\uxrqlllm.dll 2008-05-02 23:44:30 105536 --a------ C:\WINDOWS\system32\eadpesyy.dll 2008-05-02 23:41:29 105536 --a------ C:\WINDOWS\system32\btijmudt.dll 2008-05-02 12:02:14 41984 --a------ C:\WINDOWS\system32\vtUnMFVL.dll 2008-05-02 11:38:29 315156 --ahs---- C:\WINDOWS\system32\HjRrrBeg.ini2 2008-05-02 11:38:26 280576 --a------ C:\WINDOWS\system32\geBrrRjH.dll 2008-05-02 11:28:29 41984 --a------ C:\WINDOWS\system32\xxyyvUMD.dll 2008-05-02 11:27:48 41984 --a------ C:\WINDOWS\system32\geBtQiig.dll 2008-05-02 11:25:39 0 dr-h----- C:\Documents and Settings\Main\Recent 2008-05-02 01:45:55 0 d-------- C:\Documents and Settings\All Users\Application Data\SlySoft 2008-05-02 01:45:37 0 d-------- C:\Program Files\SlySoft 2008-05-02 01:42:31 0 d-------- C:\RATATOUILLE 2008-05-01 17:29:16 0 d-------- C:\bin 2008-05-01 17:19:34 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-05-01 15:33:32 11634 --a------ C:\WINDOWS\hpomdl11.dat 2008-05-01 12  11 117089 --a------ C:\WINDOWS\hpoins11.dat2008-05-01 11:29:49 98304 --a------ C:\WINDOWS\system32\hpzjsn01.dll <Not Verified; Hewlett Packard Company; HPJZSN01 Dynamic Link Library> 2008-05-01 02:49:18 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-01 02:38:34 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-05-01 01:49:22 0 d-------- C:\WINDOWS\system32\drivers\security 2008-04-30 22:29:07 0 d-------- C:\Documents and Settings\All Users\Application Data\TechSmith 2008-04-30 13:29:06 0 d-------- C:\WINDOWS\system32\QuickTime 2008-04-30 13:28:47 0 d-------- C:\Program Files\Common Files\TechSmith Shared 2008-04-30 13:28:45 0 d-------- C:\Program Files\TechSmith 2008-04-30 11:53:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-04-30 11:53:09 0 d-------- C:\Program Files\Viewpoint 2008-04-30 11:53:01 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL 2008-04-30 11:53:01 0 d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-04-30 11:52:45 0 d-------- C:\Program Files\Common Files\AOL 2008-04-30 01:46:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-04-30 01:45:50 0 d-------- C:\Program Files\Yahoo! 2008-04-30 00:34:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe 2008-04-29 10:56:10 0 d-------- C:\Documents and Settings\Main\Application Data\EndNote 2008-04-28 17:19:05 0 d-------- C:\Program Files\GPLGS 2008-04-28 17:18:35 0 d-------- C:\Program Files\Acro Software 2008-04-25 19:04:46 1867776 --a------ C:\WINDOWS\system32\python24.dll <Not Verified; Python Software Foundation; Python> 2008-04-25 19:03:42 0 d-------- C:\Program Files\ESRI 2008-04-25 19:03:07 0 d-------- C:\Documents and Settings\Main\Application Data\ESRI 2008-04-25 18:43:31 0 d-------- C:\Documents and Settings\All Users\Application Data\ESRI 2008-04-25 18:42:01 0 d-------- C:\Program Files\Common Files\ESRI 2008-04-25 18:41:41 0 d-------- C:\Program Files\Leica Geosystems 2008-04-25 18:37:32 0 d-------- C:\Program Files\Common Files\AnswerWorks 4.0 2008-04-25 18:36:14 0 d-------- C:\Python24 2008-04-25 18:36:14 0 d-------- C:\Program Files\ArcGIS 2008-04-25 17:59:02 0 d-------- C:\Program Files\Norton Internet Security 2008-04-25 17:57:47 0 d-------- C:\Program Files\Symantec 2008-04-25 17:57:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-04-25 09:28:09 0 d-------- C:\Program Files\DVD Decrypter 2008-04-24 21:59:45 0 d-------- C:\Documents and Settings\Main\Application Data\CyberLink 2008-04-24 21:59:19 0 d-------- C:\Documents and Settings\Main\Application Data\HP 2008-04-24 09:38:04 0 d-------- C:\Documents and Settings\Main\MapCache 2008-04-23 17:25:38 0 d-------- C:\Program Files\MSXML 6.0 2008-04-23 15:48:48 0 d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-04-23 15:48:46 0 d-------- C:\Program Files\DVD Shrink 2008-04-23 15:10:42 0 d-------- C:\Documents and Settings\Main\Application Data\Ahead 2008-04-23 15:10:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Ahead 2008-04-23 15:09:54 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-04-23 15:08:21 0 d---s---- C:\Documents and Settings\LocalService\UserData 2008-04-23 15:04:03 40 --a------ C:\WINDOWS\system32\drmgs.sys 2008-04-23 15:03:22 264192 --a------ C:\WINDOWS\system32\andt.sys 2008-04-23 15:02:22 0 d-------- C:\Program Files\Nero 2008-04-23 15:02:22 0 d-------- C:\Program Files\Common Files\Ahead 2008-04-23 15:02:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-04-23 11:33:15 0 d-------- C:\Program Files\Sun 2008-04-23 11:26:44 0 d-------- C:\Documents and Settings\Main\Application Data\WinRAR 2008-04-23 11:26:20 256 --a------ C:\Documents and Settings\Main\pool.bin 2008-04-22 14:44:27 0 d-------- C:\Documents and Settings\Main\Application Data\AdobeUM 2008-04-22 14:44:18 0 d-------- C:\Program Files\Common Files\Adobe 2008-04-22 13:54:24 0 d-------- C:\Documents and Settings\Main\Application Data\DivX 2008-04-22 12:13:20 256 --a------ C:\WINDOWS\system32\pool.bin 2008-04-22 12:13:18 0 d-------- C:\Documents and Settings\Main\Application Data\Research In Motion 2008-04-22 12:04:51 0 d-------- C:\Program Files\Common Files\Research In Motion 2008-04-22 12:04:50 0 d-------- C:\Program Files\Research In Motion 2008-04-22 12:01:20 0 d-------- C:\Program Files\Common Files\Risxtd 2008-04-22 12:00:26 0 d-------- C:\Program Files\EndNote X 2008-04-22 12:00:03 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-04-22 11:35:38 0 d-------- C:\Program Files\uTorrent 2008-04-22 11:35:33 0 d-------- C:\Documents and Settings\Main\Application Data\uTorrent 2008-04-22 10:48:09 0 d-------- C:\Program Files\DivX 2008-04-22 09:36:18 0 d-------- C:\Documents and Settings\Main\Contacts 2008-04-22 09:32:55 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-22 09:32:50 0 d-------- C:\Program Files\Windows Live 2008-04-22 09:32:40 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-04-22 09:31:40 0 d-------- C:\WINDOWS\Sun 2008-04-22 09:31:40 0 d-------- C:\Documents and Settings\Main\Application Data\Sun 2008-04-21 17:00:19 0 d-------- C:\Program Files\Microsoft Works 2008-04-21 17:00:13 0 d-------- C:\Program Files\MSBuild 2008-04-21 16:59:33 0 d-------- C:\Program Files\Microsoft.NET 2008-04-21 16:55:56 0 d-------- C:\WINDOWS\SHELLNEW 2008-04-21 16:54:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-04-21 16:53:20 0 dr-h----- C:\MSOCache 2008-04-21 16:29:01 0 d-------- C:\Program Files\MSXML 4.0 2008-04-21 16:08:58 0 d-------- C:\Documents and Settings\Main\Application Data\Macromedia 2008-04-21 16:08:58 0 d-------- C:\Documents and Settings\Main\Application Data\Adobe 2008-04-21 16:05:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2008-04-21 16:03:41 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 5 2008-04-21 16:03:09 0 d-------- C:\WINDOWS\system32\PreInstall 2008-04-21 15:58:01 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-04-21 15:57:10 0 d---s---- C:\Documents and Settings\Main\UserData 2008-04-21 15:11:24 0 d-------- C:\Program Files\Enigma Software Group 2008-04-21 15:10:23 0 d-------- C:\Documents and Settings\Main\Bluetooth Software 2008-04-21 15:10:10 0 d-------- C:\Program Files\SpywareGuard 2008-04-21 15:09:51 0 d-------- C:\Program Files\WIDCOMM 2008-04-21 15:08:15 0 d---s---- C:\Documents and Settings\Main\Temporary Internet Files 2008-04-21 15:08:15 0 d---s---- C:\Documents and Settings\Main\History 2008-04-21 15:07:20 0 d--h----- C:\Documents and Settings\Main\Templates 2008-04-21 15:07:20 0 dr------- C:\Documents and Settings\Main\Start Menu 2008-04-21 15:07:20 0 dr-h----- C:\Documents and Settings\Main\SendTo 2008-04-21 15:07:20 0 d--h----- C:\Documents and Settings\Main\PrintHood 2008-04-21 15:07:20 0 d--h----- C:\Documents and Settings\Main\NetHood 2008-04-21 15:07:20 0 dr------- C:\Documents and Settings\Main\My Documents 2008-04-21 15:07:20 0 d--h----- C:\Documents and Settings\Main\Local Settings 2008-04-21 15:07:20 0 dr------- C:\Documents and Settings\Main\Favorites 2008-04-21 15:07:20 0 d-------- C:\Documents and Settings\Main\Desktop 2008-04-21 15:07:20 0 d---s---- C:\Documents and Settings\Main\Cookies 2008-04-21 15:07:20 0 dr-h----- C:\Documents and Settings\Main\Application Data 2008-04-21 15:07:20 0 d-------- C:\Documents and Settings\Main\Application Data\Identities 2008-04-21 15:07:19 3145728 --ah----- C:\Documents and Settings\Main\NTUSER.DAT 2008-04-21 15 24 262144 --a------ C:\Documents and Settings\All Users\NTUSER.DAT2008-04-21 15 19 0 d-------- C:\Documents and Settings\Default User\Application Data\Identities2008-04-21 15:05:45 0 d-------- C:\WINDOWS\Prefetch 2008-04-21 15:03:42 0 d---s---- C:\Documents and Settings\LocalService\Temporary Internet Files 2008-04-21 15:03:42 0 d---s---- C:\Documents and Settings\LocalService\History 2008-04-21 15:03:32 0 d-------- C:\WINDOWS\system32\LogFiles 2008-04-21 14:47:21 0 d--hs---- C:\System Volume Information 2008-04-21 12:39:47 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-21 12:39:44 0 d-------- C:\Documents and Settings\Main\Application Data\Mozilla -- Find3M Report --------------------------------------------------------------- 2008-05-03 11:22:03 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-01 17:29:51 0 d-------- C:\Program Files\Hp 2008-05-01 17:27:58 0 d-------- C:\Program Files\Common Files\Sonic Shared 2008-05-01 17:26:49 0 d-------- C:\Program Files\Common Files\HP 2008-05-01 17:21:00 0 d-------- C:\Program Files\Hewlett-Packard 2008-05-01 17:19:34 0 d-------- C:\Program Files\Common Files 2008-04-23 11:32:53 0 d-------- C:\Program Files\Java 2008-04-21 17:15:42 12976 --a------ C:\Documents and Settings\Main\Application Data\Comma Separated Values (Windows).CAL 2008-04-21 16:51:56 0 d-------- C:\Program Files\Online Services 2008-04-21 14:47:31 0 d-------- C:\Program Files\HPQ 2008-04-21 14:31:34 0 d-------- C:\Program Files\Windows NT 2008-04-21 14:28:09 0 d-------- C:\Program Files\WildTangent 2008-04-21 14:28:05 0 d-------- C:\Program Files\Synaptics 2008-04-21 14:28:03 0 d-------- C:\Program Files\Sonic 2008-04-21 14:26:36 0 d-------- C:\Program Files\NetWaiting 2008-04-21 14:26:24 0 d-------- C:\Program Files\Netscape 2008-04-21 14:26:10 0 d-------- C:\Program Files\muvee Technologies 2008-04-21 14:26:09 0 d-------- C:\Program Files\MSN Gaming Zone 2008-04-21 14:26:09 0 d-------- C:\Program Files\MSN Encarta Plus 2008-04-21 14:26:06 0 d-------- C:\Program Files\Movie Maker 2008-04-21 14:25:35 0 d-------- C:\Program Files\Microsoft Office Trial Wizard 2008-04-21 14:24:59 0 d-------- C:\Program Files\microsoft frontpage 2008-04-21 14:24:59 0 d-------- C:\Program Files\Messenger 2008-04-21 14:24:50 0 d-------- C:\Program Files\Intel 2008-04-21 14:24:49 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-21 14:23:15 0 d-------- C:\Program Files\Google 2008-04-21 14:23:14 0 d-------- C:\Program Files\CONEXANT 2008-04-21 14:23:14 0 d-------- C:\Program Files\Common Files\TiVo Shared 2008-04-21 14:22:45 0 d-------- C:\Program Files\Common Files\SureThing Shared 2008-04-21 14:22:45 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-04-21 14:22:42 0 d-------- C:\Program Files\Common Files\ODBC 2008-04-21 14:22:42 0 d-------- C:\Program Files\Common Files\muvee Technologies 2008-04-21 14:22:32 0 d-------- C:\Program Files\Common Files\MSSoap 2008-04-21 14:22:11 0 d-------- C:\Program Files\Common Files\LightScribe 2008-04-21 14:22:06 0 d-------- C:\Program Files\Common Files\Java 2008-04-21 14:22:06 0 d-------- C:\Program Files\Common Files\InstallShield 2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-03-31 17:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-03-31 17:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll 2008-03-31 17:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-03-21 16:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-03-21 16:28:54 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-03-21 16:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-03-21 16:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5AA74FD3-2F5B-463F-8713-44ACAF18822C}] 02/05/2008 11:38 AM 280576 --a------ C:\WINDOWS\system32\geBrrRjH.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC7D8DE8-EF3D-4F44-8B54-03759FAC1367}] 02/05/2008 11:27 AM 41984 --a------ C:\WINDOWS\system32\geBtQiig.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] 23/04/2008 11:32 AM 34816 --a------ C:\Program Files\Java\jre6\bin\jp2ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [23/04/2008 11:32 AM] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [14/02/2006 10:49 PM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [23/03/2006 08:17 AM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [23/03/2006 08:13 AM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [23/03/2006 08:17 AM] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [18/04/2006 07:29 AM C:\WINDOWS\system32\CHDAudPropShortcut.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [04/03/2006 01:46 AM] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [12/04/2006 12:54 AM] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [07/03/2006 04:38 PM] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [22/02/2006 11:03 AM] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [11/10/2005 01:23 PM] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/03/2007 03:57 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10/01/2007 01:59 AM] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [14/01/2007 03:11 AM] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29/01/2008 05:38 PM] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [08/05/2007 04:24 PM] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [10/04/2008 03:14 PM] "Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [13/06/2007 02:18 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 05:00 PM] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [27/06/2007 07:03 PM] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [30/08/2007 05:43 PM] "AnyDVD"="C:\DOCUME~1\Main\LOCALS~1\Temp\IXP000.TMP\ANYDVD~1.EXE" [] C:\Documents and Settings\Main\Start Menu\Programs\Startup\ SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [29/08/2003 7:05:35 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [27/02/2006 5:02:06 PM] HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [19/02/2006 4:21:22 AM] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe [10/02/2006 7:56:20 AM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{BC7D8DE8-EF3D-4F44-8B54-03759FAC1367}"= C:\WINDOWS\system32\geBtQiig.dll [02/05/2008 11:27 AM 41984] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBtQiig] geBtQiig.dll 02/05/2008 11:27 AM 41984 C:\WINDOWS\system32\geBtQiig.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\geBrrRjH [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" *Newly Created Service* - AAWSERVICE *Newly Created Service* - AD-WATCH_CONNECT_FILTER *Newly Created Service* - AD-WATCH_REAL-TIME_SCANNER *Newly Created Service* - AD-WATCH_REGISTRY_FILTER *Newly Created Service* - COMHOST *Newly Created Service* - CSISCANNER *Newly Created Service* - IKFILESEC *Newly Created Service* - IKSYSFLT *Newly Created Service* - IKSYSSEC *Newly Created Service* - PXARK *Newly Created Service* - SDAUXSERVICE *Newly Created Service* - SDCORESERVICE -- End of Deckard's System Scanner: finished at 2008-05-03 11:42:33 ------------ |
|
     |
|
05-05-2008, 01:21 PM
|
#2 (permalink) |
|
Senior Trainee Analyst
Join Date: Oct 2007
Posts: 883
OS: XP SP2
|
Re: Virus Problem!!!
Hello and Welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please be patient with me during this time.
__________________
Our help is free but please donate |
|
|
|
|
05-05-2008, 07:05 PM
|
#3 (permalink) | |
|
Senior Trainee Analyst
Join Date: Oct 2007
Posts: 883
OS: XP SP2
|
Re: Virus Problem!!!
Hello afclark82.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Quote:
------------------------------------------------------ Please uninstall the following via the Add or Remove Programs Panel (Start->(or My Computer)->Control Panel->Add or Remove Programs) if they exist: Viewpoint Media Player<<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall Viewpoint Media Player, also delete these Folders if they still exist: C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Program Files\Viewpoint ------------------------------------------------------ I see you have P2P software ( uTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. If you decide to uninstall uTorrent, also delete these Folders if they still exist: C:\Documents and Settings\Main\Application Data\uTorrent C:\Program Files\uTorrent ------------------------------------------------------ Please visit this webpage for instructions on downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed.  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding.
__________________
Our help is free but please donate |
|
|
|
|
|
05-06-2008, 06:12 AM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 23
OS: XP SP2
|
Re: Virus Problem!!!
Here are the files. By the way, when I hadn't goten a response on here for a couple days I did two things to try to fix my comuter myself
1) Repaired windows 2) Downloaded and ran AVG Virus Scan These solutions fixed most of the problems with my computer but I am still getting errors popping up every once in a while on AVG. Attached are the HiJackThis and ComboFix Results. Thanks. ComboFix 08-05-01.3 - Main 2008-05-06 8:33:49.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1323 [GMT -4:00] Running from: C:\Documents and Settings\Main.PC154472964116\My Documents\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\Utuwvxyb.ini C:\WINDOWS\system32\Utuwvxyb.ini2 D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))) . 2008-05-05 01:57 . 2008-05-05 01:57 <DIR> d-------- C:\Program Files\File Shredder 2008-05-05 00:57 . 2008-05-05 00:57 <DIR> d-------- C:\Documents and Settings\Main 2008-05-04 23:03 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-05-04 23:02 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-05-04 23:02 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-05-04 22:27 . 2008-05-04 22:27 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-05-04 22:18 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-05-04 22:18 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-05-04 22:18 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-05-04 14:19 . 2005-07-18 21:38 98,304 --a------ C:\WINDOWS\system32\hpzjsn01.dll 2008-05-04 14:18 . 2006-05-05 17:18 11,634 --a------ C:\WINDOWS\hpomdl11.dat 2008-05-04 13:18 . 2008-05-04 13:18 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-05-04 13:15 . 2008-05-04 13:19 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-05-04 13:14 . 2008-05-04 13:14 <DIR> dr-h----- C:\MSOCache 2008-05-04 01:11 . 2008-05-05 00:04 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Contacts 2008-05-04 00:15 . 2006-08-21 05:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys 2008-05-04 00:15 . 2006-08-21 05:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe 2008-05-04 00:15 . 2006-08-21 08:21 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll 2008-05-04 00:11 . 2006-10-04 10:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-05-04 00:11 . 2006-10-04 10:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-05-04 00:11 . 2006-10-04 10:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-05-04 00:09 . 2008-05-04 00:09 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-05-04 00:09 . 2008-05-04 00:10 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-05-04 00:09 . 2008-05-04 00:10 <DIR> d-------- C:\b6f1aaccb37d4cdf87ac7d0e807483 2008-05-04 00:08 . 2007-04-16 11:52 984,576 --------- C:\WINDOWS\system32\dllcache\kernel32.dll 2008-05-04 00:07 . 2007-07-09 09:16 582,656 --a------ C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-05-03 23:57 . 2007-02-09 07:10 574,464 --------- C:\WINDOWS\system32\dllcache\ntfs.sys 2008-05-03 23:47 . 2007-05-16 11:12 1,314,816 --------- C:\WINDOWS\system32\dllcache\msoe.dll 2008-05-03 23:47 . 2007-06-13 06:23 1,033,216 --------- C:\WINDOWS\system32\dllcache\explorer.exe 2008-05-03 23:47 . 2007-05-16 11:12 510,976 --------- C:\WINDOWS\system32\dllcache\wab32.dll 2008-05-03 23:47 . 2007-05-16 11:12 86,528 --------- C:\WINDOWS\system32\dllcache\directdb.dll 2008-05-03 23:47 . 2007-05-16 11:12 85,504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll 2008-05-03 18:38 . 2008-05-03 18:38 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Bluetooth Software 2008-05-03 18:35 . 2008-05-05 12:56 <DIR> d--hs---- C:\Documents and Settings\Main.PC154472964116\Temporary Internet Files 2008-05-03 18:35 . 2008-05-03 18:35 <DIR> d--hs---- C:\Documents and Settings\Main.PC154472964116\History 2008-05-03 18:34 . 2008-05-05 12:55 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116 2008-05-03 18:34 . 2008-05-06 08:39 217,088 --ah----- C:\Documents and Settings\Main.PC154472964116\ntuser.dat.LOG 2008-05-03 18:34 . 2008-05-03 18:34 1,799 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv5000 (EZ410UA#ABL)_YN_0Pavi_QCND62431FG_E413900DB1_46_I30A8_SHP_V56.37_BF.13_T060510_WXH2_L409_M2039_J120_7Intel_8T2400_91.83_#080503_N80861092_(EZ410UA#ABL)_XMOBILE_CN10_Z_2F.13.MRK 2008-05-03 17:43 . 2008-05-03 17:43 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-05-03 17:19 . 2008-05-03 17:19 2,997 --a------ C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate 2008-05-03 17:14 . 2008-05-03 17:19 <DIR> d-------- C:\Program Files\Symantec 2008-05-03 17:01 . 2008-05-06 05:12 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-05-03 16:50 . 2008-05-03 16:50 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-05-03 16:50 . 2008-05-03 16:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-05-03 16:49 . 2008-05-05 22:04 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-05-03 16:49 . 2008-05-03 16:49 <DIR> d-------- C:\Program Files\AVG 2008-05-03 16:49 . 2008-05-03 16:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-05-03 16:49 . 2008-05-03 16:49 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-05-03 16:37 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-05-03 16:36 . 2008-05-05 13:06 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\AVGTOOLBAR 2008-05-03 16:22 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-05-03 16:22 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\HP 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\ESRI 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\EndNote 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\DivX 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\CyberLink 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\Ahead 2008-05-03 16:21 . 2008-05-03 16:21 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\AdobeUM 2008-05-03 16:21 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-05-03 16:21 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-05-03 16:21 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-05-03 16:21 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys 2008-05-03 16:20 . 2008-05-03 16:20 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\Research In Motion 2008-05-03 16:20 . 2008-05-03 16:20 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\PC Tools 2008-05-03 16:20 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-05-03 16:20 . 2008-04-21 17:15 12,976 --a------ C:\Documents and Settings\Main.PC154472964116\Application Data\Comma Separated Values (Windows).CAL 2008-05-03 16:20 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-05-03 16:20 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys 2008-05-03 16:04 . 2008-05-05 08:29 <DIR> d-------- C:\Documents and Settings\Main.PC154472964116\Application Data\uTorrent 2008-05-03 15:56 . 2008-05-03 15:56 <DIR> d--hs---- C:\Documents and Settings\Main.PC154472964116\UserData 2008-05-03 15:52 . 2008-05-03 15:52 <DIR> d-------- C:\Program Files\NetWaiting 2008-05-03 12:18 . 2008-05-03 12:18 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-03 10:43 . 2008-05-03 12:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-03 09:58 . 2008-05-03 23:46 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-03 09:55 . 2008-05-03 09:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-03 01:44 . 2008-05-03 01:44 724,992 --a------ C:\WINDOWS\iun6002.exe 2008-05-03 01:44 . 2008-05-03 01:44 170 --a------ C:\WINDOWS\spywarebegone-fullversion-installed.html 2008-05-03 01:31 . 2008-05-03 01:39 <DIR> d-------- C:\Program Files\XoftSpySE 2008-05-02 23:41 . 2008-05-03 09:52 109,794 --a------ C:\WINDOWS\BM03ba3a2a.xml 2008-05-02 01:45 . 2008-05-02 01:45 <DIR> d-------- C:\Program Files\SlySoft 2008-05-02 01:45 . 2008-05-02 01:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft 2008-05-02 01:45 . 2008-05-02 12:02 40 ---hs---- C:\Documents and Settings\All Users\Application Data\.zreglib 2008-05-02 01:45 . 2008-05-02 01:45 24 ---hs---- C:\WINDOWS\S8A7852DF.tmp 2008-05-01 21:35 . 2008-05-01 21:35 221 --a------ C:\WINDOWS\NCLogConfig.ini 2008-05-01 20:40 . 2008-05-04 23:17 1,168 --a------ C:\WINDOWS\_isenv31.ini 2008-05-01 20:40 . 2008-05-04 23:17 521 --a------ C:\WINDOWS\_iserr31.ini 2008-05-01 20:40 . 2008-05-04 23:17 392 --a------ C:\WINDOWS\_delis32.ini 2008-05-01 17:29 . 2008-05-01 17:29 <DIR> d-------- C:\bin 2008-05-01 17:19 . 2008-05-01 17:19 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-05-01 15:36 . 2008-05-01 21:05 117,089 --------- C:\WINDOWS\hpoins11.dat.temp 2008-05-01 15:36 . 2006-05-05 17:18 11,634 --------- C:\WINDOWS\hpomdl11.dat.temp 2008-05-01 12:06 . 2008-05-04 23:34 117,151 --a------ C:\WINDOWS\hpoins11.dat 2008-05-01 11:31 . 2006-04-12 20:04 49,664 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-05-01 11:31 . 2006-04-12 20:04 21,568 --a------ C:\WINDOWS\system32\drivers\HPZius12.sys 2008-05-01 11:31 . 2006-04-12 20:04 16,496 --a------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-05-01 11:29 . 2006-04-12 20:02 827,392 --a------ C:\WINDOWS\system32\hpotiop2.dll 2008-05-01 11:29 . 2006-04-12 20:02 659,456 --a------ C:\WINDOWS\system32\hpowiax2.dll 2008-05-01 11:29 . 2006-04-12 20:04 282,624 --a------ C:\WINDOWS\system32\HPZc3212.dll 2008-05-01 11:29 . 2006-04-12 20:02 254,026 --a------ C:\WINDOWS\system32\hpovst09.dll 2008-05-01 11:29 . 2006-01-04 04:12 77,824 --a------ C:\WINDOWS\system32\HPZIDS01.dll 2008-05-01 02:49 . 2008-05-01 02:49 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-04-30 22:29 . 2008-04-30 22:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith 2008-04-30 13:28 . 2008-04-30 13:28 <DIR> d-------- C:\Program Files\TechSmith 2008-04-30 13:28 . 2008-04-30 13:28 <DIR> d-------- C:\Program Files\Common Files\TechSmith Shared 2008-04-30 11:53 . 2008-04-30 11:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-04-30 11:53 . 2008-04-30 11:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL 2008-04-30 11:52 . 2008-05-01 09:04 <DIR> d-------- C:\Program Files\Common Files\AOL 2008-04-30 11:50 . 2008-04-30 11:53 371 --ah----- C:\IPH.PH 2008-04-30 01:46 . 2008-04-30 01:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-04-30 01:45 . 2008-04-30 01:45 <DIR> d-------- C:\Program Files\Yahoo! 2008-04-28 17:19 . 2008-04-28 17:19 <DIR> d-------- C:\Program Files\GPLGS 2008-04-28 17:18 . 2008-04-28 17:18 <DIR> d-------- C:\Program Files\Acro Software 2008-04-28 10:34 . 2008-04-28 10:38 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI 2008-04-27 12:10 . 2008-04-27 12:10 180 --a------ C:\WINDOWS\ArcView9x.INI 2008-04-25 19:03 . 2008-04-25 19:03 <DIR> d-------- C:\Program Files\ESRI 2008-04-25 18:43 . 2008-04-25 18:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESRI 2008-04-25 18:42 . 2008-04-25 18:43 <DIR> d-------- C:\Program Files\Common Files\ESRI 2008-04-25 18:41 . 2008-04-25 18:41 <DIR> d-------- C:\Program Files\Leica Geosystems 2008-04-25 18:37 . 2008-04-25 18:37 <DIR> d-------- C:\Program Files\Common Files\AnswerWorks 4.0 2008-04-25 18:36 . 2008-04-25 19:04 <DIR> d-------- C:\Python24 2008-04-25 18:36 . 2008-04-25 18:43 <DIR> d-------- C:\Program Files\ArcGIS 2008-04-25 09:28 . 2008-04-25 09:28 <DIR> d-------- C:\Program Files\DVD Decrypter 2008-04-23 17:25 . 2008-04-23 17:25 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-04-23 15:48 . 2008-04-23 15:48 <DIR> d-------- C:\Program Files\DVD Shrink . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-05 03:32 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-05-05 03:32 --------- d-----w C:\Program Files\Common Files\HP 2008-05-04 17:19 --------- d-----w C:\Program Files\Microsoft Works 2008-05-03 22:31 --------- d-----w C:\Program Files\HPQ 2008-05-03 22:04 --------- d-----w C:\Program Files\MSN Encarta Plus 2008-05-03 22:00 --------- d-----w C:\Program Files\Google 2008-05-03 22:00 --------- d-----w C:\Program Files\CONEXANT 2008-05-03 22:00 --------- d-----w C:\Program Files\Common Files\SureThing Shared 2008-05-03 21:59 --------- d-----w C:\Program Files\Common Files\LightScribe 2008-05-03 21:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sonic 2008-05-03 21:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-03 21:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-03 20:37 --------- d-----w C:\Program Files\Java . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 2008-05-03 16:49 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B6A0B4A6-04E0-4B2D-964F-1086238401E3}] C:\WINDOWS\system32\byxvwutU.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-05-03 16:49 2050816] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-05-03 16:49 2050816] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 17:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 22:49 454656] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 08:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 08:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 08:17 118784] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 07:29 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-04 01:46 761948] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-04-12 00:54 102400] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 16:38 131072] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 11:03 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 13:23 1187840] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-03 16:49 1177368] C:\Documents and Settings\Main.PC154472964116\Start Menu\Programs\Startup\ SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-02-27 17:02:06 581693] HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"= R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-03 16:49] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-03 16:49] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-03 16:49] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-03 16:50] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-06 08:38:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????U??????(?@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\AVG\AVG8\avgrsx.exe . ************************************************************************** . Completion time: 2008-05-06 8:43:03 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-06 12:43:00 Pre-Run: 75,672,649,728 bytes free Post-Run: 75,695,292,416 bytes free 264 --- E O F --- 2008-05-05 04:19:40 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:10:03 AM, on 06/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\SpywareGuard\sgmain.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\AVG\AVG8\aAvgApi.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: (no name) - {B6A0B4A6-04E0-4B2D-964F-1086238401E3} - C:\WINDOWS\system32\byxvwutU.dll (file missing) O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 8894 bytes Last edited by tetonbob : 05-06-2008 at 07:36 AM. |
|
|
|
|
05-07-2008, 08:31 AM
|
#5 (permalink) |
|
Senior Trainee Analyst
Join Date: Oct 2007
Posts: 883
OS: XP SP2
|
Re: Virus Problem!!!
Hello again, afclark82.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Although you uninstalled Norton(Symantec), you still have remnants active on your system which can cause system instability. We need to remove them. Please download the Norton Removal Tool and Save it to your Desktop.
Delete the following Files and Folders if they still exist: C:\WINDOWS\BM03ba3a2a.xml C:\WINDOWS\spywarebegone C:\WINDOWS\iun6002.exe C:\WINDOWS\spywarebegone-fullversion-installed.html C:\Program Files\XoftSpySE ------------------------------------------------------ Please disable Spywareguard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) O2 - BHO: (no name) - {B6A0B4A6-04E0-4B2D-964F-1086238401E3} - C:\WINDOWS\system32\byxvwutU.dll (file missing) Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report new HijackThis log report on system behavior
__________________ Our help is free but please donate |
