|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-04-2008, 08:36 PM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 4
OS: windows xp
|
Does my comp have a virus? please check my log
Hi, I dont know much about the tech side of comps, but I was wondering if my computer could have a virus?
It did the strangest thing the other night.....i was asleep in my bed when all of a sudden i could hear noise coming from my computer...it sounded like the audio from a television show on DIY composting (weird i know) but when i got to my computer there was no programs running, when i got the screen up it just showed my normal desktop, yet there was still this audio running. So i turned the comp off. I ran my antivirus the next morning with no detection of any nasties. Does anyone know what could have caused it? (or am i going mad ) Please check my log. ****I was unable to complete step 4 (updating my operating system) at microsoft, could not complete the action.**** Cheers, Susan Deckard's System Scanner v20071014.68 Run by OWNER on 2008-05-05 13:20:30 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 30: 2008-05-05 20:20:46 UTC - RP401 - Deckard's System Scanner Restore Point 29: 2008-05-04 19:01:23 UTC - RP400 - System Checkpoint 28: 2008-05-03 18:11:07 UTC - RP399 - System Checkpoint 27: 2008-05-02 16:26:35 UTC - RP398 - Removed Kaspersky Internet Security 7.0. 26: 2008-05-01 18:27:29 UTC - RP397 - System Checkpoint -- First Restore Point -- 1: 2008-04-14 03:14:41 UTC - RP372 - Removed Windows Defender Backed up registry hives. Performed disk cleanup. Total Physical Memory: 511 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-05 13:22:32 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe C:\WINDOWS\system32\scardsvr.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe C:\WINDOWS\system32\perfs.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\wserving.exe C:\WINDOWS\system32\alg.exe C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\cavrid.exe C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATICCP.EXE C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\cappactiveprotection.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe C:\WINDOWS\system32\afinding.exe C:\WINDOWS\system32\routing.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\OWNER\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe O4 - HKCU\..\Run: [EPSON Stylus C110 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICCP.EXE /FU "C:\WINDOWS\TEMP\E_S17B.tmp" /EF "HKCU" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "F:\program files\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe -- End of file - 9539 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S3 SE26bus (Sony Ericsson Device 038 Driver driver (WDM)) - c:\windows\system32\drivers\se26bus.sys <Not Verified; MCCI; Sony Ericsson Device 038 Driver> S3 UIUSys (Conexant Setup API) - c:\windows\system32\drivers\uiusys.sys (file missing) S3 USBAAPL (Apple Mobile USB Driver) - c:\windows\system32\drivers\usbaapl.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AFinding (AFinding Service) - c:\windows\system32\afinding.exe R2 perfmons (perfmons Service) - c:\windows\system32\perfs.exe R2 Routing (Routing Service) - c:\windows\system32\routing.exe R2 WServing (WServing Service) - c:\windows\system32\wserving.exe S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-02 11:50:30 514 --a------ C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as OWNER at 9 38 AM.job 2008-04-13 19:58:35 290 --ah----- C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job -- Files created between 2008-04-05 and 2008-05-05 ----------------------------- 2008-05-05 13:20:26 0 d-------- C:\WINDOWS\CAVTemp 2008-05-04 23:08:15 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia 2008-05-04 20:13:00 0 d-------- C:\ie-spyad_zo 2008-05-04 17:48:04 0 d-------- C:\WINDOWS\LastGood 2008-05-04 17:45:00 0 d-------- C:\Program Files\Panda Security 2008-05-03 11:40:35 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Adobe 2008-05-02 10:03:14 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-05-02 10:03:04 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe 2008-05-02 09:37:42 0 d-------- C:\Program Files\Common Files\Scanner 2008-05-02 09:37:27 0 d-------- C:\Documents and Settings\All Users\Application Data\CA 2008-05-02 09:37:25 0 d-------- C:\Program Files\CA 2008-04-26 18:22:45 0 d-------- C:\Documents and Settings\OWNER\Application Data\yoclient 2008-04-23 17:24:09 0 d-------- C:\Documents and Settings\OWNER\Application Data\Sony 2008-04-23 17:24:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Sony 2008-04-23 16:54:00 0 d-------- C:\Program Files\Sony 2008-04-23 15:53:50 0 d-------- C:\Program Files\Avanquest update 2008-04-23 15:53:50 0 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-04-23 15:52:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2008-04-20 09:22:51 2550 --a------ C:\WINDOWS\mozver.dat 2008-04-15 11:34:39 40 --a------ C:\WINDOWS\system32\drmgs.sys 2008-04-15 11:32:13 279552 --a------ C:\WINDOWS\system32\andt.sys 2008-04-14 18:12:22 0 d-------- C:\Program Files\Broadcom 2008-04-14 18:07:10 0 d-------- C:\Program Files\SigmaTel 2008-04-14 16:26:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-04-13 19:58:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-04-12 16:50:58 0 d-------- C:\Program Files\Microsoft IntelliPoint 2008-04-12 16:50:26 0 d-------- C:\Program Files\MSXML 6.0 -- Find3M Report --------------------------------------------------------------- 2008-05-02 09:37:42 0 d-------- C:\Program Files\Common Files 2008-04-23 15:53:50 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-17 18:51:43 0 d-------- C:\Documents and Settings\OWNER\Application Data\uTorrent 2008-04-13 19:55:18 0 d-------- C:\Documents and Settings\OWNER\Application Data\Lavasoft 2008-04-13 14:31:52 0 d-------- C:\Documents and Settings\OWNER\Application Data\OpenOffice.org2 2008-04-04 16:17:08 0 d-------- C:\Documents and Settings\OWNER\Application Data\Adobe 2008-04-04 16:07:15 0 d-------- C:\Program Files\Common Files\Adobe 2008-04-03 09:28:09 0 d-------- C:\Documents and Settings\OWNER\Application Data\AdobeUM 2008-03-30 13:20:40 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-30 13:20:32 0 d-------- C:\Documents and Settings\OWNER\Application Data\Mozilla 2008-03-27 07:14:26 0 d-------- C:\Program Files\Java 2008-03-24 12:33:59 0 d-------- C:\Program Files\EPSON 2008-03-24 12:33:02 0 d-------- C:\Program Files\Common Files\InstallShield 2008-03-24 12:31:45 0 d-------- C:\Documents and Settings\OWNER\Application Data\InstallShield 2008-03-19 05:38:58 0 d-------- C:\Documents and Settings\OWNER\Application Data\Macromedia -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [20/09/2005 11:35 AM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [20/09/2005 11:32 AM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [20/09/2005 11:36 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11 AM] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [31/08/2007 12:01 PM] "cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [02/05/2008 10:02 AM] "CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [02/05/2008 10:02 AM] "cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [02/05/2008 10:02 AM] "capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [02/05/2008 10:02 AM] "capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [02/05/2008 10:02 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus C110 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICCP.exe" [11/03/2007 11:00 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [24/11/2007 01:23 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 01:56 AM] "Sony Ericsson PC Suite"="F:\program files\Sony Ericsson PC Suite\SEPCSuite.exe" [20/11/2007 03:29 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW] UmxWnp.Dll 18/05/2007 02:30 PM 79368 C:\WINDOWS\system32\UmxWNP.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^OWNER^Start Menu^Programs^Startup^Microsoft Office Groove.lnk] path=C:\Documents and Settings\OWNER\Start Menu\Programs\Startup\Microsoft Office Groove.lnk backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^OWNER^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\OWNER\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "F:\program files\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "F:\program files\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler] "C:\Program Files\Registry Clean Expert\RCHelper.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe *Newly Created Service* - RKPAVPROC -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8120 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-05-05 13:25:41 ------------ Last edited by Susan_Kaye : 05-04-2008 at 08:39 PM. |
|
     
|
|
05-05-2008, 03:54 PM
|
#2 (permalink) |
|
Analyst, Security Team
|
Re: Does my comp have a virus? please check my log
Welcome to TSF.
Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one: O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad: sc stop AFinding sc delete AFinding sc stop perfmons sc delete perfmons sc stop Routing sc delete Routing sc stop WServing sc delete WServing del delete.bat Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it. Download OTMoveIt2 at http://download.bleepingcomputer.com.../OTMoveIt2.exe * Save it to your desktop. * Double-click OTMoveIt2.exe to run it. (Vista users, right click on OTMoveIt2.exe and select Run as an Administrator). * Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): Code:
C:\WINDOWS\system32\perfs.exe
C:\WINDOWS\system32\wserving.exe
C:\WINDOWS\system32\afinding.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\drmgs.sys
C:\WINDOWS\system32\andt.sys
hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{04079851-5845-4DEA-848C-3ECD647AA554}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10}
* Click the red Moveit! button. * A log of files and folders moved will be created in the C:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply. * Close OTMoveIt2. If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. Go to http://www.bleepingcomputer.com/comb...o-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
05-09-2008, 04:29 PM
|
#3 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 4
OS: windows xp
|
Re: Does my comp have a virus? please check my log
Thank you greyknight17.
here are my OTmoveIt2 and Combofix logs: C:\WINDOWS\system32\perfs.exe moved successfully. C:\WINDOWS\system32\wserving.exe moved successfully. C:\WINDOWS\system32\afinding.exe moved successfully. C:\WINDOWS\system32\routing.exe moved successfully. C:\WINDOWS\system32\drmgs.sys moved successfully. C:\WINDOWS\system32\andt.sys moved successfully. < hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch > Registry key hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch\\ deleted successfully. < HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{04079851-5845-4DEA-848C-3ECD647AA554} > Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{04079851-5845-4DEA-848C-3ECD647AA554}\\ deleted successfully. < HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10} > Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10}\\ deleted successfully. OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05102008_082758 ComboFix 08-05-08.1 - OWNER 2008-05-10 9:08:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.232 [GMT -7:00] Running from: C:\Documents and Settings\OWNER\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\comsa32.sys C:\WINDOWS\system32\Indt2.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PERFMONS -------\Legacy_ROUTING -------\Service_perfmons -------\Service_Routing ((((((((((((((((((((((((( Files Created from 2008-04-10 to 2008-05-10 ))))))))))))))))))))))))))))))) . 2008-05-10 08:27 . 2008-05-10 08:27 <DIR> d-------- C:\_OTMoveIt 2008-05-05 13:20 . 2008-05-05 13:20 <DIR> d-------- C:\WINDOWS\CAVTemp 2008-05-05 13:19 . 2008-05-05 13:19 <DIR> d-------- C:\Deckard 2008-05-04 20:13 . 2008-05-04 20:13 <DIR> d-------- C:\ie-spyad_zo 2008-05-04 17:45 . 2008-05-04 17:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-03 06:22 . 2008-05-10 09:12 50,716 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k0 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k7 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k6 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k5 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k4 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k3 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k2 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k1 2008-05-02 09:37 . 2008-05-02 11:57 <DIR> d-------- C:\Program Files\Common Files\Scanner 2008-05-02 09:37 . 2008-05-02 09:37 <DIR> d-------- C:\Program Files\CA 2008-05-02 09:37 . 2008-05-02 10:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CA 2008-05-02 09:37 . 2008-05-07 23:04 881,432 --a------ C:\WINDOWS\system32\drivers\vetefile.sys 2008-05-02 09:37 . 2007-08-01 13:10 250,544 --a------ C:\WINDOWS\system32\KeyHelp.ocx 2008-05-02 09:37 . 2008-05-07 23:04 108,392 --a------ C:\WINDOWS\system32\drivers\veteboot.sys 2008-05-02 09:37 . 2008-05-02 10:02 99,592 --a------ C:\WINDOWS\system32\isafeif.dll 2008-05-02 09:37 . 2008-05-02 10:02 91,400 --a------ C:\WINDOWS\system32\isafprod.dll 2008-05-02 09:37 . 2008-05-02 10:02 83,256 --a------ C:\WINDOWS\system32\vetredir.dll 2008-05-02 09:37 . 2008-05-02 10:02 32,264 --a------ C:\WINDOWS\system32\drivers\vetmonnt.sys 2008-05-02 09:37 . 2008-05-02 10:02 26,376 --a------ C:\WINDOWS\system32\drivers\vet-filt.sys 2008-05-02 09:37 . 2008-05-02 10:02 21,512 --a------ C:\WINDOWS\system32\drivers\vetfddnt.sys 2008-05-02 09:37 . 2008-05-02 10:02 21,128 --a------ C:\WINDOWS\system32\drivers\vet-rec.sys 2008-04-26 18:22 . 2008-04-26 18:23 <DIR> d-------- C:\Documents and Settings\OWNER\Application Data\yoclient 2008-04-23 17:24 . 2008-04-23 17:24 <DIR> d-------- C:\Documents and Settings\OWNER\Application Data\Sony 2008-04-23 17:24 . 2008-04-23 17:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony 2008-04-23 17:24 . 2008-04-23 17:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-23 17:24 . 2008-04-23 17:24 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-23 16:54 . 2008-04-23 16:54 <DIR> d-------- C:\Program Files\Sony 2008-04-23 15:53 . 2008-05-03 06:48 <DIR> d-------- C:\Program Files\Avanquest update 2008-04-23 15:53 . 2008-04-23 15:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-04-23 15:52 . 2008-04-23 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2008-04-22 21:22 . 2008-04-22 21:22 24 --a------ C:\WINDOWS\AM_D7.PRF 2008-04-20 09:22 . 2008-05-04 17:45 2,550 --a------ C:\WINDOWS\mozver.dat 2008-04-16 17:23 . 2008-04-16 17:23 230 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-04-14 18:12 . 2008-04-14 18:12 <DIR> d-------- C:\Program Files\Broadcom 2008-04-14 18:07 . 2008-04-14 18:07 <DIR> d-------- C:\Program Files\SigmaTel 2008-04-14 16:26 . 2008-04-14 16:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-04-13 19:58 . 2008-04-13 19:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-04-12 16:53 . 2008-04-12 16:53 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-04-12 16:53 . 2008-04-12 16:53 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf 2008-04-12 16:52 . 2007-08-31 12:01 1,421,736 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-04-12 16:52 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll 2008-04-12 16:52 . 2007-08-31 11:58 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys 2008-04-12 16:51 . 2007-08-21 01:13 21,760 --a------ C:\WINDOWS\system32\drivers\point32.sys 2008-04-12 16:50 . 2008-04-12 16:50 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-04-12 16:50 . 2008-04-12 16:51 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint . |
|
|
|
|
05-09-2008, 04:49 PM
|
#4 (permalink) |
|
Analyst, Security Team
|
Re: Does my comp have a virus? please check my log
The combofix log was cut off. Please repost it and see if the whole log is copied here. If it still has problems copying the whole log, attach it as a file here instead.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
05-09-2008, 04:55 PM
|
#5 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 4
OS: windows xp
|
Re: Does my comp have a virus? please check my log
Sorry about that...this should work tho.
Cheers, Susan ComboFix 08-05-08.1 - OWNER 2008-05-10 9:08:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.232 [GMT -7:00] Running from: C:\Documents and Settings\OWNER\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\comsa32.sys C:\WINDOWS\system32\Indt2.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PERFMONS -------\Legacy_ROUTING -------\Service_perfmons -------\Service_Routing ((((((((((((((((((((((((( Files Created from 2008-04-10 to 2008-05-10 ))))))))))))))))))))))))))))))) . 2008-05-10 08:27 . 2008-05-10 08:27 <DIR> d-------- C:\_OTMoveIt 2008-05-05 13:20 . 2008-05-05 13:20 <DIR> d-------- C:\WINDOWS\CAVTemp 2008-05-05 13:19 . 2008-05-05 13:19 <DIR> d-------- C:\Deckard 2008-05-04 20:13 . 2008-05-04 20:13 <DIR> d-------- C:\ie-spyad_zo 2008-05-04 17:45 . 2008-05-04 17:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-03 06:22 . 2008-05-10 09:12 50,716 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k0 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k7 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k6 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k5 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k4 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k3 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k2 2008-05-03 06:22 . 2008-05-10 09:12 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k1 2008-05-02 09:37 . 2008-05-02 11:57 <DIR> d-------- C:\Program Files\Common Files\Scanner 2008-05-02 09:37 . 2008-05-02 09:37 <DIR> d-------- C:\Program Files\CA 2008-05-02 09:37 . 2008-05-02 10:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CA 2008-05-02 09:37 . 2008-05-07 23:04 881,432 --a------ C:\WINDOWS\system32\drivers\vetefile.sys 2008-05-02 09:37 . 2007-08-01 13:10 250,544 --a------ C:\WINDOWS\system32\KeyHelp.ocx 2008-05-02 09:37 . 2008-05-07 23:04 108,392 --a------ C:\WINDOWS\system32\drivers\veteboot.sys 2008-05-02 09:37 . 2008-05-02 10:02 99,592 --a------ C:\WINDOWS\system32\isafeif.dll 2008-05-02 09:37 . 2008-05-02 10:02 91,400 --a------ C:\WINDOWS\system32\isafprod.dll 2008-05-02 09:37 . 2008-05-02 10:02 83,256 --a------ C:\WINDOWS\system32\vetredir.dll 2008-05-02 09:37 . 2008-05-02 10:02 32,264 --a------ C:\WINDOWS\system32\drivers\vetmonnt.sys 2008-05-02 09:37 . 2008-05-02 10:02 26,376 --a------ C:\WINDOWS\system32\drivers\vet-filt.sys 2008-05-02 09:37 . 2008-05-02 10:02 21,512 --a------ C:\WINDOWS\system32\drivers\vetfddnt.sys 2008-05-02 09:37 . 2008-05-02 10:02 21,128 --a------ C:\WINDOWS\system32\drivers\vet-rec.sys 2008-04-26 18:22 . 2008-04-26 18:23 <DIR> d-------- C:\Documents and Settings\OWNER\Application Data\yoclient 2008-04-23 17:24 . 2008-04-23 17:24 <DIR> d-------- C:\Documents and Settings\OWNER\Application Data\Sony 2008-04-23 17:24 . 2008-04-23 17:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony 2008-04-23 17:24 . 2008-04-23 17:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-23 17:24 . 2008-04-23 17:24 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-23 16:54 . 2008-04-23 16:54 <DIR> d-------- C:\Program Files\Sony 2008-04-23 15:53 . 2008-05-03 06:48 <DIR> d-------- C:\Program Files\Avanquest update 2008-04-23 15:53 . 2008-04-23 15:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-04-23 15:52 . 2008-04-23 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2008-04-22 21:22 . 2008-04-22 21:22 24 --a------ C:\WINDOWS\AM_D7.PRF 2008-04-20 09:22 . 2008-05-04 17:45 2,550 --a------ C:\WINDOWS\mozver.dat 2008-04-16 17:23 . 2008-04-16 17:23 230 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-04-14 18:12 . 2008-04-14 18:12 <DIR> d-------- C:\Program Files\Broadcom 2008-04-14 18:07 . 2008-04-14 18:07 <DIR> d-------- C:\Program Files\SigmaTel 2008-04-14 16:26 . 2008-04-14 16:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-04-13 19:58 . 2008-04-13 19:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-04-12 16:53 . 2008-04-12 16:53 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-04-12 16:53 . 2008-04-12 16:53 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf 2008-04-12 16:52 . 2007-08-31 12:01 1,421,736 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-04-12 16:52 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll 2008-04-12 16:52 . 2007-08-31 11:58 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys 2008-04-12 16:51 . 2007-08-21 01:13 21,760 --a------ C:\WINDOWS\system32\drivers\point32.sys 2008-04-12 16:50 . 2008-04-12 16:50 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-04-12 16:50 . 2008-04-12 16:51 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-23 22:53 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-18 01:51 --------- d-----w C:\Documents and Settings\OWNER\Application Data\uTorrent 2008-04-14 03:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-04-14 02:55 --------- d-----w C:\Documents and Settings\OWNER\Application Data\Lavasoft 2008-04-13 21:31 --------- d-----w C:\Documents and Settings\OWNER\Application Data\OpenOffice.org2 2008-04-05 16:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-04-04 23:07 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-03 16:28 --------- d-----w C:\Documents and Settings\OWNER\Application Data\AdobeUM 2008-03-27 14:14 --------- d-----w C:\Program Files\Java 2008-03-24 19:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\UDL 2008-03-24 19:33 --------- d-----w C:\Program Files\EPSON 2008-03-24 19:33 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-24 19:31 --------- d-----w C:\Documents and Settings\OWNER\Application Data\InstallShield 2008-03-24 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\EPSON 2007-02-22 22:50 36,808,256 ----a-w C:\Program Files\iTunesSetup.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus C110 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICCP.exe" [2007-03-11 23:00 182272] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-24 13:23 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360] "Sony Ericsson PC Suite"="F:\program files\Sony Ericsson PC Suite\SEPCSuite.exe" [2007-11-20 15:29 356352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 11:35 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 11:32 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 11:36 114688] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 12:01 1037736] "cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-05-02 10:02 181512] "CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-05-02 10:02 234760] "cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-05-02 10:02 771336] "capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-05-02 10:02 173320] "capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-05-02 10:02 259336] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 01:01 437160] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW] UmxWnp.Dll 2007-05-18 14:30 79368 C:\WINDOWS\system32\UmxWNP.dll [HKLM\~\startupfolder\C:^Documents and Settings^OWNER^Start Menu^Programs^Startup^Microsoft Office Groove.lnk] path=C:\Documents and Settings\OWNER\Start Menu\Programs\Startup\Microsoft Office Groove.lnk backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^OWNER^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\OWNER\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-07 00:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 F:\program files\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-12-11 13:10 267048 F:\program files\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-12-11 11:56 286720 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler] --a------ 2007-04-14 03:23 393728 C:\Program Files\Registry Clean Expert\RCHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-11-24 13:23 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --------- 2006-10-18 20:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\program files\\iTunes.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:4\\program files\\iTunes.exe"= "C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"= "F:\\program files\\MediaManager.exe"= "F:\\program files\\Sony Ericsson PC Suite\\SEPCSuite.exe"= R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2008-01-21 13:54] R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 14:30] R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 14:30] R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2008-01-21 13:54] R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2008-01-21 13:54] R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2008-01-21 13:54] R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2008-01-21 13:54] R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2008-01-21 13:54] R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 14:30] R3 GTICARD;GTICARD;C:\WINDOWS\system32\DRIVERS\gticard.sys [2003-10-23 18:04] R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2008-01-21 13:54] R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2008-05-02 10:02] . Contents of the 'Scheduled Tasks' folder "2008-04-14 02:58:35 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job" - C:\Program Files\Microsoft IntelliPoint\ipoint.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-10 09:14:32 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe C:\WINDOWS\system32\scardsvr.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\cappactiveprotection.exe C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe . ************************************************************************** . Completion time: 2008-05-10 9:21:37 - machine was rebooted [OWNER] ComboFix-quarantined-files.txt 2008-05-10 16:21:30 Pre-Run: 9,312,251,904 bytes free Post-Run: 9,253,752,832 bytes free 213 --- E O F --- 2008-04-25 10:11:30 |
|
|
|
|
05-11-2008, 04:35 PM
|
#6 (permalink) |
|
Analyst, Security Team
|
Re: Does my comp have a virus? please check my log
Good job. Your log is clean.
To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided. Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
| Thread Tools | |
|
|
