|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
07-15-2008, 07:44 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 21
OS: Win xp home sp 2
|
Cannot start in normal mode or safe mode w/ networking.
Hello all,
I am having trouble with my fiance's laptop computer with Windows XP Home SP2. I am not able to establish a connection to the internet so I cannot run any of the online scanning tools, however I scanned and cleaned the computer in safe mode with Spybot S&D which was installed on the computer. I tried to download and install via jump drive AVG Free 8 and a current version of SpybotS&D. Unfortunately the installations failed due to the lack of internet connection. I ran Hijackthis and saved this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:48:52 PM, on 7/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://bfirst.info/in.cgi?2&key=mobile+home+refinace O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1443D5E6-F92E-DA36-0BBA-0744992443D0} - C:\Program Files\Bsuintvc\goiakzht.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: BndShell3 BHO Class - {8ABA9A9C-8791-4d61-8D5B-BCC9448EA573} - C:\Program Files\ISM\BndDrive7.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Her - {971D5B7B-F7DF-43ee-B771-6B7FA09975C3} - C:\WINDOWS\system32\sipov.dll O2 - BHO: (no name) - {97ED3E7B-D5B6-DF32-B35E-FF8A32F129C7} - C:\WINDOWS\system32\jwija.dll O2 - BHO: C:\WINDOWS\system32\Dhgthfg.dll - {B5AC49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\system32\Dhgthfg.dll O2 - BHO: C:\WINDOWS\system32\S7dsf4g.dll - {B5AF0562-94F3-42BD-F434-2604812C297D} - C:\WINDOWS\system32\S7dsf4g.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O2 - BHO: CBho Class - {F369DA09-FADE-44CB-987F-E2E0DEF51BCA} - C:\WINDOWS\system32\pgd.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\system32\_svchost.exe O4 - HKLM\..\Run: [ShareSearcher] c:\wsusupd.exe O4 - HKLM\..\Run: [InterVideo] C:\WINDOWS\TEMP\uwknmqxs.exe O4 - HKLM\..\Run: [zyzklynu] rundll32.exe "C:\Program Files\utmbqrmf\ujwtuxar.dll",Init O4 - HKLM\..\Run: [adwhylgl] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\adwhylgl.dll" O4 - HKLM\..\Run: [csrss] C:\WINDOWS\system32\wbem\csrss.exe O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe O4 - HKLM\..\Run: [eibagcot] C:\Program Files\Jblbbwcr\eibagcot.exe O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\32636\gm.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows Rescue System] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winsto.exe O4 - HKUS\S-1-5-18\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Windows Rescue System] C:\WINDOWS\TEMP\winsto.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://beta.windowsonecare.com/inst...SSWebAgent.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: Eixvple - C:\WINDOWS\SYSTEM32\Eixvple.dll O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\aesb.dll O21 - SSODL: ioseDBJgOgsg - {7941CCA5-D3EB-660F-F141-295A8636E924} - C:\WINDOWS\system32\oqxan.dll O22 - SharedTaskScheduler: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\aesb.dll O22 - SharedTaskScheduler: sdf4dr4gfdgeetj - {B5AC49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\system32\Dhgthfg.dll O22 - SharedTaskScheduler: JGhjddf9dtj - {B5AF0562-94F3-42BD-F434-2604812C297D} - C:\WINDOWS\system32\S7dsf4g.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft Internet Explorer - Unknown owner - C:\WINDOWS\system32\_svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8995 bytes Thanks! |
|
     |
|
07-15-2008, 10:23 PM
|
#2 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Cannot start in normal mode or safe mode w/ networking.
Hello skate2him and welcome,
While I see the many infections present on the system, I'd prefer to see a more comprehensive set of logs before I begin. As noted in the final step (Step 5) of our sticky topic IMPORTANT - Read This Before Posting For Malware Removal Help.... Download Deckard's System Scanner (DSS) to usb stick and transfer it to the Desktop of the infected computer. What DSS will do:
Note: You must be logged onto an account with administrator privileges.
Please include the following in your next reply: main.txt an attached extra.txt |
|
|
|
|
07-16-2008, 06:46 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 21
OS: Win xp home sp 2
|
Re: Cannot start in normal mode or safe mode w/ networking.
Thanks for your quick reply!
here is the text from main.txt and attached is extra.txt Deckard's System Scanner v20071014.68 Run by Administrator on 2008-07-16 15:25:40 Computer is in Safe Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; computer is in safe mode. -- Last 5 Restore Point(s) -- 31: 2007-10-28 08:25:53 UTC - RP277 - System Checkpoint 30: 2007-10-27 07:25:52 UTC - RP276 - System Checkpoint 29: 2007-10-26 06:41:37 UTC - RP275 - System Checkpoint 28: 2007-10-22 00:17:58 UTC - RP274 - System Checkpoint 27: 2007-10-18 09:20:49 UTC - RP273 - System Checkpoint -- First Restore Point -- 1: 2007-08-15 20:25:31 UTC - RP247 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 503 MiB (512 MiB recommended). -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:27:55 PM, on 7/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe C:\Documents and Settings\Administrator\Desktop\dss.exe C:\DOCUME~1\ADMINI~1\Desktop\Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://bfirst.info/in.cgi?2&key=mobile+home+refinace O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1443D5E6-F92E-DA36-0BBA-0744992443D0} - C:\Program Files\Bsuintvc\goiakzht.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: BndShell3 BHO Class - {8ABA9A9C-8791-4d61-8D5B-BCC9448EA573} - C:\Program Files\ISM\BndDrive7.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Her - {971D5B7B-F7DF-43ee-B771-6B7FA09975C3} - C:\WINDOWS\system32\sipov.dll O2 - BHO: (no name) - {97ED3E7B-D5B6-DF32-B35E-FF8A32F129C7} - C:\WINDOWS\system32\jwija.dll O2 - BHO: C:\WINDOWS\system32\Dhgthfg.dll - {B5AC49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\system32\Dhgthfg.dll O2 - BHO: C:\WINDOWS\system32\S7dsf4g.dll - {B5AF0562-94F3-42BD-F434-2604812C297D} - C:\WINDOWS\system32\S7dsf4g.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O2 - BHO: CBho Class - {F369DA09-FADE-44CB-987F-E2E0DEF51BCA} - C:\WINDOWS\system32\pgd.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\system32\_svchost.exe O4 - HKLM\..\Run: [ShareSearcher] c:\wsusupd.exe O4 - HKLM\..\Run: [InterVideo] C:\WINDOWS\TEMP\uwknmqxs.exe O4 - HKLM\..\Run: [zyzklynu] rundll32.exe "C:\Program Files\utmbqrmf\ujwtuxar.dll",Init O4 - HKLM\..\Run: [adwhylgl] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\adwhylgl.dll" O4 - HKLM\..\Run: [csrss] C:\WINDOWS\system32\wbem\csrss.exe O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe O4 - HKLM\..\Run: [eibagcot] C:\Program Files\Jblbbwcr\eibagcot.exe O4 - HKLM\..\Run: [ms] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\32636\gm.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows Rescue System] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winsto.exe O4 - HKCU\..\Run: [IESet] IExplorer.dll .dbt O4 - HKUS\S-1-5-18\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Windows Rescue System] C:\WINDOWS\TEMP\winsto.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [IESet] IExplorer.dll .dbt (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [f94mggfhfghodftdf] C:\WINDOWS\TEMP\winlogan.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://beta.windowsonecare.com/inst...SSWebAgent.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: Eixvple - C:\WINDOWS\SYSTEM32\Eixvple.dll O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\aesb.dll O21 - SSODL: ioseDBJgOgsg - {7941CCA5-D3EB-660F-F141-295A8636E924} - C:\WINDOWS\system32\oqxan.dll O22 - SharedTaskScheduler: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\aesb.dll O22 - SharedTaskScheduler: sdf4dr4gfdgeetj - {B5AC49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\system32\Dhgthfg.dll O22 - SharedTaskScheduler: JGhjddf9dtj - {B5AF0562-94F3-42BD-F434-2604812C297D} - C:\WINDOWS\system32\S7dsf4g.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft Internet Explorer - Unknown owner - C:\WINDOWS\system32\_svchost.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 9443 bytes -- File Associations ----------------------------------------------------------- .bat - batfile - shell\edit\command - NOTEDAD.EXE %1 .ini - inifile - shell\open\command - NOTEDAD.EXE %1 .reg - regfile - shell\edit\command - NOTEDAD.EXE %1 .txt - txtfile - shell\open\command - NOTEDAD.EXE %1 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S2 CDRPDACC (Quinnware CDDA Driver (by InfinaDyne)) - c:\program files\quintessential player\cdrpdacc.sys <Not Verified; Arrowkey; CD Device Access> S2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.10) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.10> S2 NdisWon - c:\windows\system32\drivers\ndiswon.sys S3 ATHFMWDL (NETGEAR WG111T bootloader driver) - c:\windows\system32\drivers\athfmwdl.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 ICF - c:\windows\system32\svchost.exe:exe.exe S2 Microsoft Internet Explorer - c:\windows\system32\_svchost.exe -a S3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett-Packard Development Company, L.P.; hpqwmi Module> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-07-15 17:00:35 446 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2007-10-28 21:00:00 350 --a------ C:\WINDOWS\Tasks\At21.job 2007-10-28 20:00:00 350 --a------ C:\WINDOWS\Tasks\At20.job 2007-10-28 19:00:00 350 --a------ C:\WINDOWS\Tasks\At19.job 2007-10-28 18:00:00 350 --a------ C:\WINDOWS\Tasks\At18.job 2007-10-28 17:00:00 350 --a------ C:\WINDOWS\Tasks\At17.job 2007-10-28 16:00:00 350 --a------ C:\WINDOWS\Tasks\At16.job 2007-10-28 15:00:00 350 --a------ C:\WINDOWS\Tasks\At15.job 2007-10-28 14:00:00 350 --a------ C:\WINDOWS\Tasks\At14.job 2007-10-28 13:00:00 350 --a------ C:\WINDOWS\Tasks\At13.job 2007-10-28 12:00:00 350 --a------ C:\WINDOWS\Tasks\At12.job 2007-10-28 11:00:00 350 --a------ C:\WINDOWS\Tasks\At11.job 2007-10-28 10:00:00 350 --a------ C:\WINDOWS\Tasks\At10.job 2007-10-28 09:00:00 350 --a------ C:\WINDOWS\Tasks\At9.job 2007-10-28 08:00:00 350 --a------ C:\WINDOWS\Tasks\At8.job 2007-10-28 07:00:00 350 --a------ C:\WINDOWS\Tasks\At7.job 2007-10-28 06:00:00 350 --a------ C:\WINDOWS\Tasks\At6.job 2007-10-28 05:00:00 350 --a------ C:\WINDOWS\Tasks\At5.job 2007-10-28 04:00:00 350 --a------ C:\WINDOWS\Tasks\At4.job 2007-10-28 03:00:00 350 --a------ C:\WINDOWS\Tasks\At3.job 2007-10-28 01:00:00 350 --a------ C:\WINDOWS\Tasks\At2.job 2007-10-28 00:00:00 350 --a------ C:\WINDOWS\Tasks\At1.job 2007-10-27 23:00:00 350 --a------ C:\WINDOWS\Tasks\At24.job 2007-10-27 22:00:00 350 --a------ C:\WINDOWS\Tasks\At23.job 2007-10-27 21:00:00 350 --a------ C:\WINDOWS\Tasks\At22.job 2007-10-27 03:00:00 360 --a------ C:\WINDOWS\Tasks\XoftSpySE.job -- Files created between 2008-06-16 and 2008-07-16 ----------------------------- Nothing created in this timespan. -- Find3M Report --------------------------------------------------------------- Nothing modified in this timespan. -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1443D5E6-F92E-DA36-0BBA-0744992443D0}] 10/21/2007 05:12 PM 106496 --a------ C:\Program Files\Bsuintvc\goiakzht.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}] 10/15/2007 02:42 PM 192512 --a------ C:\Program Files\ISM\BndDrive7.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{971D5B7B-F7DF-43ee-B771-6B7FA09975C3}] 10/21/2007 05:08 PM 25088 --a------ C:\WINDOWS\system32\sipov.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97ED3E7B-D5B6-DF32-B35E-FF8A32F129C7}] 10/18/2007 08:22 AM 60928 --a------ C:\WINDOWS\system32\jwija.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5AC49A2-94F3-42BD-F434-2604812C897D}] 10/22/2007 11:02 PM 10000 --a------ C:\WINDOWS\system32\Dhgthfg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5AF0562-94F3-42BD-F434-2604812C297D}] 10/22/2007 11:02 PM 10000 --a------ C:\WINDOWS\system32\S7dsf4g.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F369DA09-FADE-44CB-987F-E2E0DEF51BCA}] 10/21/2007 05:12 PM 18944 --a------ C:\WINDOWS\system32\pgd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [12/13/2004 08:43 AM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [12/13/2004 08:38 AM] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [07/27/2004 02:48 PM] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [08/06/2004 09:27 AM] "AGRSMMSG"="AGRSMMSG.exe" [08/24/2004 05:20 AM C:\WINDOWS\AGRSMMSG.exe] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [02/08/2005 10:38 AM] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [10/14/2004 02:54 PM] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [10/26/2005 05:01 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/18/2005 12:58 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [11/22/2005 02:38 AM] "Microsoft Internet Explorer"="C:\WINDOWS\system32\_svchost.exe" [10/21/2007 05:07 PM] "ShareSearcher"="c:\wsusupd.exe" [10/21/2007 05:08 PM] "InterVideo"="C:\WINDOWS\TEMP\uwknmqxs.exe" [] "zyzklynu"="C:\Program Files\utmbqrmf\ujwtuxar.dll" [10/21/2007 05:11 PM] "adwhylgl"="regsvr32 /u C:\Documents and Settings\All Users\Application Data\adwhylgl.dll" [] "csrss"="C:\WINDOWS\system32\wbem\csrss.exe" [10/21/2007 05:12 PM] "SC2"="C:\Program Files\SecCenter\scprot4.exe" [10/21/2007 05:13 PM] "eibagcot"="C:\Program Files\Jblbbwcr\eibagcot.exe" [10/21/2007 05:13 PM] "ms"="C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\32636\gm.exe" [] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "f94mggfhfghodftdf"="C:\WINDOWS\TEMP\winlogan.exe" [] "IESet"="IExplorer.dll" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 10:24 AM] "Windows Rescue System"="C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winsto.exe" [] "IESet"="IExplorer.dll" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "IESet"=IExplorer.dll .dbt [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "f94mggfhfghodftdf"=C:\WINDOWS\TEMP\winlogan.exe "Windows Rescue System"=C:\WINDOWS\TEMP\winsto.exe "IESet"=IExplorer.dll .dbt C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [8/17/2007 11:33:53 PM] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [6/4/2006 5:16:40 PM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B25319}"= C:\WINDOWS\system32\aesb.dll [10/21/2007 05:08 PM 169984] "{B5AC49A2-94F3-42BD-F434-2604812C897D}"= C:\WINDOWS\system32\Dhgthfg.dll [10/22/2007 11:02 PM 10000] "{B5AF0562-94F3-42BD-F434-2604812C297D}"= C:\WINDOWS\system32\S7dsf4g.dll [10/22/2007 11:02 PM 10000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "DCOM Server 25319"= {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\aesb.dll [10/21/2007 05:08 PM 169984] "ioseDBJgOgsg"= {7941CCA5-D3EB-660F-F141-295A8636E924} - C:\WINDOWS\system32\oqxan.dll [10/21/2006 05:09 PM 14848] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Eixvple] Eixvple.dll 08/04/2004 02:00 AM 62464 C:\WINDOWS\system32\Eixvple.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"= [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved] @="Driver Group" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 007guard.com 127.0.0.1 www.007guard.com 127.0.0.1 008i.com 127.0.0.1 008k.com 127.0.0.1 www.008k.com 127.0.0.1 00hq.com 127.0.0.1 www.00hq.com 127.0.0.1 010402.com 127.0.0.1 032439.com 127.0.0.1 www.032439.com 6848 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-07-16 15:28:36 ------------ Thanks! |
|
|
|
|
07-16-2008, 08:36 PM
|
#4 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Cannot start in normal mode or safe mode w/ networking.
You're welcome.
You should be able to install AVG from your usb after this first round, but bear in mind that this system is heavily infected. This will require more than one round to properly eradicate, so please stay with me until given the 'all clear' even if symptoms seemingly abate. Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. *************************************************** Download the tools needed to a flash drive or other removable media, and transfer them to the infected computer. *************************************************** Download ComboFix.exe from here **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System  Download the file & save it as it's originally named, next to ComboFix.exe.  ---------------------------------------------------------------------
|
|
|
|
|
07-17-2008, 01:27 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 21
OS: Win xp home sp 2
|
Re: Cannot start in normal mode or safe mode w/ networking.
alright I ran the combofix program and the laptop rebooted and started as normal. here are the is the text from ComboFix.txt:
ComboFix 08-07-16.2 - Administrator 2008-07-16 22:58:01.1 - NTFSx86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.324 [GMT -6:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe . ADS - svchost.exe: deleted 49664 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Guest\Application Data\wsnpoem C:\Documents and Settings\Guest\Application Data\wsnpoem\audio.dll C:\Documents and Settings\Guest\Application Data\wsnpoem\video.dll C:\Documents and Settings\LocalService\Local Settings\Application Data\n.ini C:\Program Files\Insider C:\Program Files\Insider\Insider.exe C:\Program Files\Insider\UnInstall.exe C:\Program Files\ISM C:\Program Files\ISM\BndDrive7.dll C:\Program Files\ISM\bndloader.exe C:\Program Files\ISM\dictionary.gz C:\Program Files\ISM\ism.exe C:\Program Files\ISM\ISMModule7.exe C:\Program Files\ISM\targets.gz C:\Program Files\ISM\Uninstall.exe C:\Program Files\ISM2 C:\Program Files\ISM2\dictionary.gz C:\Program Files\ISM2\ISMPack7.exe C:\Program Files\ISM2\targets.gz C:\Program Files\outerinfo C:\Program Files\outerinfo\Terms.rtf C:\Program Files\SecCenter C:\Program Files\SecCenter\scprot4.exe C:\Program Files\WinAble C:\WINDOWS\b104.exe C:\WINDOWS\b122.exe C:\WINDOWS\b147.exe C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\mwinsys.ini C:\WINDOWS\notedad.exe C:\WINDOWS\sstem3~1 C:\WINDOWS\sstem3~1\r?gsvr32.exe C:\WINDOWS\System\AlxRes071021.exe C:\WINDOWS\system32\_svchost.exe C:\WINDOWS\system32\0x57.exe C:\WINDOWS\system32\7_exception.nls C:\WINDOWS\system32\adult.txt C:\WINDOWS\system32\aesb.dll C:\WINDOWS\system32\config\system~1\Applic~1\Microsoft\25319.dat C:\WINDOWS\system32\din.ip C:\WINDOWS\system32\drivers\bg_bg.gif C:\WINDOWS\system32\drivers\blank.gif C:\WINDOWS\system32\drivers\box_1.gif C:\WINDOWS\system32\drivers\box_2.gif C:\WINDOWS\system32\drivers\box_3.gif C:\WINDOWS\system32\drivers\button_buynow.gif C:\WINDOWS\system32\drivers\button_freescan.gif C:\WINDOWS\system32\drivers\cell_bg.gif C:\WINDOWS\system32\drivers\cell_footer.gif C:\WINDOWS\system32\drivers\cell_header_block.gif C:\WINDOWS\system32\drivers\cell_header_remove.gif C:\WINDOWS\system32\drivers\cell_header_scan.gif C:\WINDOWS\system32\drivers\close_ico.gif C:\WINDOWS\system32\drivers\detect.htm C:\WINDOWS\system32\drivers\download_box.gif C:\WINDOWS\system32\drivers\download_btn.jpg C:\WINDOWS\system32\drivers\download_now_btn.gif C:\WINDOWS\system32\drivers\footer_back.jpg C:\WINDOWS\system32\drivers\header_1.gif C:\WINDOWS\system32\drivers\header_2.gif C:\WINDOWS\system32\drivers\header_3.gif C:\WINDOWS\system32\drivers\header_4.gif C:\WINDOWS\system32\drivers\header_red_bg.gif C:\WINDOWS\system32\drivers\header_red_free_scan.gif C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif C:\WINDOWS\system32\drivers\icon_warning_big.gif C:\WINDOWS\system32\drivers\infected.gif C:\WINDOWS\system32\drivers\ip6fw.sys C:\WINDOWS\system32\drivers\main_back.gif C:\WINDOWS\system32\drivers\Moiv63.sys C:\WINDOWS\system32\drivers\NdisWon.sys C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg C:\WINDOWS\system32\drivers\product_1_header.gif C:\WINDOWS\system32\drivers\product_1_name_small.gif C:\WINDOWS\system32\drivers\product_2_header.gif C:\WINDOWS\system32\drivers\product_2_name_small.gif C:\WINDOWS\system32\drivers\product_3_header.gif C:\WINDOWS\system32\drivers\product_3_name_small.gif C:\WINDOWS\system32\drivers\product_features.gif C:\WINDOWS\system32\drivers\pt.htm C:\WINDOWS\system32\drivers\rating.gif C:\WINDOWS\system32\drivers\remove_spyware_header.gif C:\WINDOWS\system32\drivers\s_detect.htm C:\WINDOWS\system32\drivers\screenshot.jpg C:\WINDOWS\system32\drivers\sep_hor.gif C:\WINDOWS\system32\drivers\sep_vert.gif C:\WINDOWS\system32\drivers\shadow.jpg C:\WINDOWS\system32\drivers\shadow_bg.gif C:\WINDOWS\system32\drivers\spacer.gif C:\WINDOWS\system32\drivers\spy_away_box.jpg C:\WINDOWS\system32\drivers\spyware_detected.gif C:\WINDOWS\system32\drivers\style.css C:\WINDOWS\system32\drivers\symavc32.sys C:\WINDOWS\system32\drivers\warning_ico.gif C:\WINDOWS\system32\drivers\yellow_warning_ico.gif C:\WINDOWS\system32\explorer.exe C:\WINDOWS\system32\finance.txt C:\WINDOWS\system32\iexplorer.dll .dbt C:\WINDOWS\system32\inf\scrsys071021.scr C:\WINDOWS\system32\inf\scrsys16_071021.dll C:\WINDOWS\system32\k.dat C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\mp43.exe C:\WINDOWS\system32\mywebhit.ini C:\WINDOWS\system32\n.ini C:\WINDOWS\system32\n2.ini C:\WINDOWS\system32\nusrmgr.exe C:\WINDOWS\system32\other.txt C:\WINDOWS\system32\pgd.dll C:\WINDOWS\system32\pharma.txt C:\WINDOWS\system32\RunOnce3.t__ C:\WINDOWS\system32\RunOnce3.tmp C:\WINDOWS\system32\sft.res C:\WINDOWS\system32\sipov.dll C:\WINDOWS\system32\update118.exe C:\WINDOWS\system32\update147.exe C:\WINDOWS\system32\update176.exe C:\WINDOWS\system32\update177.exe C:\WINDOWS\system32\update288.exe C:\WINDOWS\system32\update289.exe C:\WINDOWS\system32\update298.exe C:\WINDOWS\system32\update299.exe C:\WINDOWS\system32\winsys16_071021.dll C:\WINDOWS\system32\winsys32_071021.dll C:\WINDOWS\system32\wnsintisv.exe C:\WINDOWS\system32\wsnpoem C:\WINDOWS\system32\wsnpoem\video.dll C:\WINDOWS\system32\xpdx.sys C:\WINDOWS\tsitra11.exe C:\WINDOWS\tsitra801.exe C:\wsusupd.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_ICF -------\Legacy_MICROSOFT_INTERNET_EXPLORER -------\Legacy_MOIV63 -------\Legacy_NDISWON -------\Legacy_NETWORK_MONITOR -------\Legacy_POOF -------\Legacy_RUNTIME -------\Legacy_RUNTIME2 -------\Service_ICF -------\Service_Microsoft Internet Explorer -------\Service_MOIV63 -------\Service_Moiv63 -------\Service_NdisWon ((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))) . 2008-07-16 15:25 . 2008-07-16 15:25 <DIR> d-------- C:\Deckard . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-15 20:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-21 23:07 7,680 ----a-w C:\Documents and Settings\user\ie_update3r.exe 2006-05-26 04:58 670 ----a-w C:\Documents and Settings\Guest\Application Data\wklnhst.dat 2004-08-04 08:00 661,504 ----a-r C:\Documents and Settings\Guest\Application Data\ntos.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97ED3E7B-D5B6-DF32-B35E-FF8A32F129C7}] 2007-10-18 08:22 60928 --a------ C:\WINDOWS\system32\jwija.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Ojmty"="C:\WINDOWS\s?stem32\r?gsvr32.exe" [?] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400] "Tbsa"="C:\DOCUME~1\user\APPLIC~1\SKS~1\winspool.exe" [2007-10-21 13:56 72704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-12-13 08:43 163840] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-12-13 08:38 135168] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 14:48 1396736] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-02-08 10:38 167936] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 14:54 262144] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-26 17:01 41984] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 12:58 278528] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-22 02:38 155648] "eibagcot"="C:\Program Files\Jblbbwcr\eibagcot.exe" [2007-10-21 17:13 43008] "AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 05:20 88363 C:\WINDOWS\AGRSMMSG.exe] C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-09-23 14:36:42 61440] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-17 23:33:53 113664] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [2006-06-04 17:16:40 483412] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "ioseDBJgOgsg"= {7941CCA5-D3EB-660F-F141-295A8636E924} - C:\WINDOWS\system32\oqxan.dll [2006-10-21 17:09 14848] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Eixvple] 2004-08-04 02:00 62464 C:\WINDOWS\system32\Eixvple.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] --a------ 2004-09-07 17:28 213054 C:\Program Files\HPQ\Default Settings\Cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-12-03 14:24 290816 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-02-17 00:11 49152 C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] --a------ 2005-04-11 16:21 794624 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2005-10-18 12:58 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 10:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-11-22 02:38 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-03-04 04:36 36975 C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\WINDOWS\\system32\\svchost.exe"= S3 ATHFMWDL;NETGEAR WG111T bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys [2004-10-14 18:24] . Contents of the 'Scheduled Tasks' folder "2007-10-28 06:00:00 C:\WINDOWS\Tasks\At1.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 16:00:00 C:\WINDOWS\Tasks\At10.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 17:00:00 C:\WINDOWS\Tasks\At11.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 18:00:00 C:\WINDOWS\Tasks\At12.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 19:00:00 C:\WINDOWS\Tasks\At13.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 20:00:00 C:\WINDOWS\Tasks\At14.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 21:00:00 C:\WINDOWS\Tasks\At15.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 22:00:00 C:\WINDOWS\Tasks\At16.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 23:00:00 C:\WINDOWS\Tasks\At17.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-29 00:00:00 C:\WINDOWS\Tasks\At18.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-29 01:00:00 C:\WINDOWS\Tasks\At19.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 07:00:00 C:\WINDOWS\Tasks\At2.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-29 02:00:00 C:\WINDOWS\Tasks\At20.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-29 03:00:00 C:\WINDOWS\Tasks\At21.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 03:00:00 C:\WINDOWS\Tasks\At22.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 04:00:00 C:\WINDOWS\Tasks\At23.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 05:00:00 C:\WINDOWS\Tasks\At24.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 09:00:00 C:\WINDOWS\Tasks\At3.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 10:00:00 C:\WINDOWS\Tasks\At4.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 11:00:00 C:\WINDOWS\Tasks\At5.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 12:00:00 C:\WINDOWS\Tasks\At6.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 13:00:00 C:\WINDOWS\Tasks\At7.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 14:00:00 C:\WINDOWS\Tasks\At8.job" - C:\WINDOWS\system32\X28Io8R6.exe "2007-10-28 15:00:00 C:\WINDOWS\Tasks\At9.job" - C:\WINDOWS\system32\X28Io8R6.exe "2008-07-17 05:05:03 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2007-10-27 09:00:00 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . - - - - ORPHANS REMOVED - - - - HKCU-Run-ISMModule7 - C:\Program Files\ISM\ISMModule7.exe HKCU-Run-ISMPack7 - C:\Program Files\ISM2\ISMPack7.exe HKCU-Run-SpybotSD TeaTimer - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe MSConfigStartUp-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe MSConfigStartUp-IS CfgWiz - C:\Program Files\Norton Internet Security\cfgwiz.exe MSConfigStartUp-SSC_UserPrompt - C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe MSConfigStartUp-URLLSTCK - C:\Program Files\Norton Internet Security\UrlLstCk.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-16 23:08:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Apoint2K\ApntEx.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.bin C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-07-16 23:12:07 - machine was rebooted [user] ComboFix-quarantined-files.txt 2008-07-17 05:12:03 Pre-Run: 43,492,061,184 bytes free Post-Run: 44,523,307,008 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 330 NEW HIJACKTHIS LOG: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:18, on 2008-07-16 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Jblbbwcr\eibagcot.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\DOCUME~1\user\APPLIC~1\SKS~1\winspool.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {97ED3E7B-D5B6-DF32-B35E-FF8A32F129C7} - C:\WINDOWS\system32\jwija.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eibagcot] C:\Program Files\Jblbbwcr\eibagcot.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [Tbsa] "C:\DOCUME~1\user\APPLIC~1\SKS~1\winspool.exe" -vt yazb O4 - HKCU\..\Run: [Ojmty] C:\WINDOWS\s?stem32\r?gsvr32.exe O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O8 - Extra context menu item: &Search - ?p=ZKxdm011YYUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://beta.windowsonecare.com/inst...SSWebAgent.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: Eixvple - C:\WINDOWS\SYSTEM32\eixvple.dll O21 - SSODL: ioseDBJgOgsg - {7941CCA5-D3EB-660F-F141-295A8636E924} - C:\WINDOWS\system32\oqxan.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 7279 bytes Also, when ComboFix finished running it automatically opened up a file called log.txt. im not sure whether you need this because you never mentioned it but I have attached it in case you do. Should i install and run avg and clean any disinfected files now? |
|
|
|
|
07-17-2008, 08:30 PM
|
#6 (permalink) | |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Cannot start in normal mode or safe mode w/ networking.
Hello skate2him, we still have quite a bit to do.
Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. *************************************************** Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. --------------------------------------------------------------------- Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% -(Drive that contains the Windows Directory, typically C:\SDFix). Do not run it yet, we'll use it shortly. --------------------------------------------------------------------- Open notepad and copy/paste the text in the code box below into it: Quote:
in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
After you've uploaded the [4]Submit_<date and time>.zip.... 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. -------------------------------------------------------------------- Open the extracted SDFix folder and double click RunThis.bat to start the script.
-------------------------------------------------------------------- Run a new scan with HijackThis.exe and save the log. -------------------------------------------------------------------- Please include the following in your next reply: C:\ComboFix.txt C:\SDFix\Report.txt New HijackThis log |
