|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
04-15-2007, 03:36 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 8
OS: WINXP
|
trojan horse downloader.small.57.a
All,
I have tried to get rid of this various ways, but have been unable to up to this point. So I followed all five steps in the instructions, and here is my main.txt file from hi-jack this: Deckard's System Scanner v20070411.38 Run by Family on 2007-04-15 at 16:10:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 96: 2007-04-15 21:10:45 UTC - RP568 - Deckard's System Scanner Restore Point 95: 2007-04-15 21  07 UTC - RP567 - Installed Windows XP WgaNotify.94: 2007-04-15 21:05:01 UTC - RP566 - Software Distribution Service 2.0 93: 2007-04-15 15:53:43 UTC - RP565 - Installed Windows XP (KB892130). 92: 2007-04-15 15:48:34 UTC - RP564 - Software Distribution Service 2.0 -- First Restore Point -- 1: 2007-01-16 04:31:11 UTC - RP473 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Family.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 4:23:17 PM, on 4/15/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Yahoo!\Antivirus\ISafe.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Yahoo!\Antivirus\VetMsg.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\Smtray.exe C:\Program Files\Yahoo!\Antivirus\CAVTray.exe C:\Program Files\Yahoo!\Antivirus\CAVRID.exe C:\Program Files\2Wire\Gateway\2PortalMon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Yahoo!\browser\ybrwicon.exe C:\Documents and Settings\Family\Desktop\dss.exe C:\PROGRA~1\HIJACK~1\Family.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcyds...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/sbcyds.../www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [Smapp] Smtray.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\Gateway\2PortalMon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: MS_update_0612_KB74062.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Support - {C66A417B-D8BC-4698-85E4-F8C3011F9868} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (file missing) (HKCU) O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.9.0.6...aces-en_US.cab O16 - DPF: Armored Attack by pogo - http://game1.pogo.com/applet-6.7.3.2...tank-en_US.cab O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.8.1.3...mmon-en_US.cab O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.8.4.5...jack-en_US.cab O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-6.8.1.3...ack2-en_US.cab O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.9.4.4...cade-en_US.cab O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-6.8.4.5...ling-en_US.cab O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.9.0.6...asta-en_US.cab O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.9.4.3...kers-en_US.cab O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.8.0.3...ess2-en_US.cab O16 - DPF: Command and Conquer Comanche by pogo - http://game1.pogo.com/applet-6.8.4.5...rike-en_US.cab O16 - DPF: Cribbage by pogo - http://game1.pogo.com/applet-6.7.3.3...bage-en_US.cab O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.3.23/ytz/ytz-en_US.cab O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.7.3.2...flag-en_US.cab O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.3.3...ccer-en_US.cab O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.9.0.4...ass2-en_US.cab O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.9.0.4...ingo-en_US.cab O16 - DPF: Greenback Bayou by pogo - http://game1.pogo.com/applet-6.8.1.3...back-en_US.cab O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.8.2.2...vest-en_US.cab O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.8.4.5...oker-en_US.cab O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.7.5.2...pool-en_US.cab O16 - DPF: Hog Heaven Slots by pogo - http://game1.pogo.com/applet-6.9.1.3...ancy-en_US.cab O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.9.0.4...gsaw-en_US.cab O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.7.5.2...gin2-en_US.cab O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-6.9.2.2...oker-en_US.cab O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.9.0.4...ttso-en_US.cab O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.9.1.3...jong-en_US.cab O16 - DPF: NASCAR Web Racing by pogo - http://game1.pogo.com/applet-6.7.3.2...scar-en_US.cab O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.9.0.4...igow-en_US.cab O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.9.0.4...cell-en_US.cab O16 - DPF: Payday Freecell Solitaire by pogo - http://game1.pogo.com/applet-6.9.4.4...ell2-en_US.cab O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-6.7.3.2...uins-en_US.cab O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.9.0.6...heel-en_US.cab O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.9.0.4...nger-en_US.cab O16 - DPF: Pirate's Gold by pogo - http://game1.pogo.com/applet-6.7.3.3...gold-en_US.cab O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.7.3.3...opfu-en_US.cab O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.9.1.3...oppa-en_US.cab O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.9.0.4...pit2-en_US.cab O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.7.2.3...reak-en_US.cab O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-6.9.2.3...ares-en_US.cab O16 - DPF: Ricochet by pogo - http://game1.pogo.com/applet-6.7.3.2...chet-en_US.cab O16 - DPF: Sawgrass Golf by pogo - http://game1.pogo.com/applet-6.7.3.2...rass-en_US.cab O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.7.4.2...biz2-en_US.cab O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.7.3.2...wbiz-en_US.cab O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.8.3.2...puck-en_US.cab O16 - DPF: Spades 2 by pogo - http://game1.pogo.com/applet-6.7.4.2...des2-en_US.cab O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-6.7.3.3...ider-en_US.cab O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.8.4.5...hies-en_US.cab O16 - DPF: Stax by pogo - http://game1.pogo.com/applet-6.9.2.3...stax-en_US.cab O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-6.8.3.3...ooth-en_US.cab O16 - DPF: Tank Hunter by pogo - http://www.pogo.com/applet-6.7.3.23/tank/tank-en_US.cab O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.7.3.3...ldem-en_US.cab O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.8.4.5...eaks-en_US.cab O16 - DPF: Tube Runner by pogo - http://www.pogo.com/applet-6.7.3.23/tube/tube-en_US.cab O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-6.9.4.3...bo22-en_US.cab O16 - DPF: Vert Skater by pogo - http://game1.pogo.com/applet-6.7.3.2...ater-en_US.cab O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-6.8.3.2...ries-en_US.cab O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-6.9.4.3...bble-en_US.cab O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.7.4.3...omp2-en_US.cab O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.9.1.3...jong-en_US.cab O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/game...s/y/pyt1_x.cab O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab O16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cab O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v48/pool/pool.cab O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/Activ...veLauncher.cab O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yaho...tr_current.cab O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinner.com/games/v47.../blockwerx.cab O16 - DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} (Word Cubes Control) - http://www.worldwinner.com/games/v44...e/wordcube.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://www.worldwinner.com/games/v45...o/wordmojo.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v44/royal/royal.cab O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v42/paint/paint.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/game.../goldfever.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl Class) - http://prints.picturecenter.kodak.co...oadControl.cab O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} (WWSpades Control) - http://www.worldwinner.com/games/v46...s/wwspades.cab O16 - DPF: {F0FCC76D-767E-4759-A447-62289CA775AA} (Coreport SSO Client) - http://client.dbm.com/v51/ie/control...tSsoClient.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Vmodem (XP Vmodem) - c:\windows\system32\drivers\vmodem.sys R0 Vpctcom (XP Vpctcom) - c:\windows\system32\drivers\vpctcom.sys R0 Vvoice (XP Vvoice) - c:\windows\system32\drivers\vvoice.sys R1 Cdr4_xp - c:\windows\system32\drivers\cdr4_xp.sys R1 Cdralw2k - c:\windows\system32\drivers\cdralw2k.sys R1 cdudf_xp - c:\windows\system32\drivers\cdudf_xp.sys R1 DVDVRRdr_xp - c:\windows\system32\drivers\dvdvrrdr_xp.sys R1 ikhfile (File Security Kernel Anti-Spyware Driver) - c:\windows\system32\drivers\ikhfile.sys R1 ikhlayer (Kernel Anti-Spyware Driver) - c:\windows\system32\drivers\ikhlayer.sys R1 pwd_2k - c:\windows\system32\drivers\pwd_2k.sys R1 UdfReadr_xp - c:\windows\system32\drivers\udfreadr_xp.sys R1 VETEFILE (VET File Scan Engine) - c:\windows\system32\drivers\vetefile.sys R1 VETFDDNT (VET Floppy Boot Sector Monitor) - c:\windows\system32\drivers\vetfddnt.sys R1 VET-FILT (VET File System Filter) - c:\windows\system32\drivers\vet-filt.sys R1 VETMONNT (VET File Monitor) - c:\windows\system32\drivers\vetmonnt.sys R1 VET-REC (VET File System Recognizer) - c:\windows\system32\drivers\vet-rec.sys R2 portD (CMS PortIO Service) - c:\windows\system32\drivers\portd2k.sys R3 Gcr432 - c:\windows\system32\drivers\gcr432.sys R3 mmc_2K - c:\windows\system32\drivers\mmc_2k.sys R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys R3 Ptserlp (PCTEL Serial Device Driver for PCI) - c:\windows\system32\drivers\ptserlp.sys R3 smwdm - c:\windows\system32\drivers\smwdm.sys R3 VETEBOOT (VET Boot Scan Engine) - c:\windows\system32\drivers\veteboot.sys S3 dvd_2K - c:\windows\system32\drivers\dvd_2k.sys S3 wandrv (WAN Network Driver) - c:\windows\system32\drivers\wandrv.sys S3 wltwo51b (2Wire Wireless USB adapter Driver) - c:\windows\system32\drivers\wltwo51b.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 CAISafe - c:\program files\yahoo!\antivirus\isafe.exe R2 Pctspk (PCTEL Speaker Phone) - c:\windows\system32\pctspk.exe R2 uploadmgr (Upload Manager) - c:\windows\system32\svchost.exe -k netsvcs R2 VETMSGNT (VET Message Service) - c:\program files\yahoo!\antivirus\vetmsg.exe S3 YPCService - c:\windows\system32\ypcser~1.exe -- Scheduled Tasks ------------------------------------------------------------- 2007-04-09 02:00:00 1204 --a------ C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job<WRSPYS~1.JOB> 2006-10-25 19:52:55 242 -----n--- C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job<SPYBOT~1.JOB> 2006-02-16 21:23:24 302 -----n--- C:\WINDOWS\Tasks\XoftSpy.job -- Files created between 2007-03-15 and 2007-04-15 ----------------------------- 2007-04-15 10:26:31 21312 --a------ C:\WINDOWS\choice.exe 2007-04-15 10:24:52 0 d-------- C:\ie-spyad2<IE-SPY~1> 2007-04-15 10:18:18 0 d-------- C:\Program Files\SpywareGuard<SPYWAR~4> 2007-04-15 10:12:38 0 d-------- C:\Program Files\SpywareBlaster<SPYWAR~3> 2007-04-15 01:47:13 0 d-------- C:\WINDOWS\System32\ActiveScan<ACTIVE~1> 2007-04-15 01:47:09 0 d-------- C:\WINDOWS\LastGood 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\zts2.exe 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\System32\vcmgcd32.dll 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\System32\iifgfgf.dll 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\rundll16.exe 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\rundl132.dll 2007-04-08 10:28:00 0 d-a------ C:\WINDOWS\logo1_.exe 2007-04-08 10:19:17 128512 --a------ C:\WINDOWS\System32\TASKMGR.COM 2007-04-08 10:19:17 128512 --a------ C:\WINDOWS\System32\T.COM 2007-04-08 10:19:17 134144 --a------ C:\WINDOWS\REGEDIT.COM 2007-04-08 10:19:17 134144 --a------ C:\WINDOWS\R.COM -- Find3M Report --------------------------------------------------------------- 2007-04-15 03:09:49 0 d-------- C:\Program Files\Spyware Doctor<SPYWAR~1> 2007-04-15 03 46 0 d-------- C:\Program Files\QuickTime<QUICKT~1>2007-04-15 02:59:29 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-04-15 01:42:45 0 d-------- C:\Program Files\Plaxo 2007-04-07 09:13:35 0 d-------- C:\Documents and Settings\Family\Application Data\AVG7 2007-03-03 14:02:27 552 --a------ C:\WINDOWS\System32\d3d8caps.dat 2007-03-02 11:38:09 0 d-------- C:\Program Files\quickenw 2007-02-28 21:53:28 0 d-------- C:\Documents and Settings\Family\Application Data\Real 2007-02-28 21:49:36 0 d-------- C:\Program Files\Common Files\xing shared<XINGSH~1> 2007-02-28 21:49:19 0 d-------- C:\Program Files\Real 2007-02-28 21:48:36 0 d-------- C:\Program Files\Common Files\Real 2007-02-26 21:57:03 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-02-26 21:38:08 0 d-------- C:\Program Files\eBay 2007-02-18 21:46:34 0 d-------- C:\Program Files\Common Files\Data Dynamics<DATADY~1> 2007-02-18 21:40:02 0 d-------- C:\Program Files\eNeighborhoods, Inc<ENEIGH~1> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "PlaxoUpdate"="C:\\Program Files\\Plaxo\\2.12.1.1\\PlaxoHelper.exe -a" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "Smapp"="Smtray.exe" "srmclean"="C:\\Cpqs\\Scom\\srmclean.exe" "CaAvTray"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVTray.exe\"" "CAVRID"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVRID.exe\"" "2wSysTray"="C:\\Program Files\\2Wire\\Gateway\\2PortalMon.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BounceBack Launcher.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\BounceBack Launcher.lnk" "backup"="C:\\WINDOWS\\pss\\BounceBack Launcher.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\CMSPER~1\\BOUNCE~1\\BBLAUN~1.EXE " "item"="BounceBack Launcher" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MI1933~1\\Office10\\OSA.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Works Calendar Reminders.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Works Calendar Reminders.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\WORKSS~1\\wkcalrem.exe " "item"="Microsoft Works Calendar Reminders" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Quicken Scheduled Updates.lnk" "backup"="C:\\WINDOWS\\pss\\Quicken Scheduled Updates.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\quickenw\\bagent.exe " "item"="Quicken Scheduled Updates" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="apdproxy" "hkey"="HKLM" "command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="StartEAK" "hkey"="HKLM" "command"="C:\\Program Files\\Compaq\\Easy Access Button Support\\StartEAK.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I&F Viewer toolbar] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="phototoolkitmem" "hkey"="HKCU" "command"="\"C:\\Program Files\\Photo Toolkit\\ivbar\\phototoolkitmem.exe\" -start" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WksSb" "hkey"="HKLM" "command"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WkDetect" "hkey"="HKLM" "command"="C:\\Program Files\\Microsoft Works\\WkDetect.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NBJ" "hkey"="HKCU" "command"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PlaxoHelper" "hkey"="HKCU" "command"="C:\\Program Files\\Plaxo\\2.8.1.2\\PlaxoHelper.exe -a" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RxMon" "hkey"="HKLM" "command"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\AudioCentral\\RxMon.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DrgToDsc" "hkey"="HKLM" "command"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\DragToDisc\\DrgToDsc.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioEngineUtility] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="EngUtil" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Roxio Shared\\System\\EngUtil.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKCU" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeUpdateManager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="coloreal" "hkey"="HKLM" "command"="\"C:\\Program Files\\COMPAQ\\Coloreal\\coloreal.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ypager" "hkey"="HKCU" "command"="C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ybrwicon" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ymetray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ymetray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\ymetray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="yop" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{81559C35-8464-49F7-BB0E-07A383BEF910}"="" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- Hosts ----------------------------------------------------------------------- 127.0.0.1 localhost #***Inserted By STOPzilla*** 127.0.0.1 600pics.com # ***Inserted By STOPzilla*** 127.0.0.1 a1.interclick.com # ***Inserted By STOPzilla*** 127.0.0.1 absolutepics.net # ***Inserted By STOPzilla*** 127.0.0.1 all-tgp.org # ***Inserted By STOPzilla*** 127.0.0.1 all-websearch.com # ***Inserted By STOPzilla*** 127.0.0.1 bailefunk.com # ***Inserted By STOPzilla*** 127.0.0.1 best4all.net # ***Inserted By STOPzilla*** 127.0.0.1 besthardcore.net # ***Inserted By STOPzilla*** 127.0.0.1 bundleware.com # ***Inserted By STOPzilla*** 71 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-04-15 at 16:24:29 --------- And I am also attaching the extra.txt file. I am a beginner at trying to fix these things, so please be patient with me! |
|
     |
|
04-16-2007, 11:26 PM
|
#3 (permalink) |
|
Analyst, Security Team; Assistant Rangemaster, TSF Academy
Join Date: Sep 2006
Posts: 1,302
OS: Windows XP SP2
|
Re: trojan horse downloader.small.57.a
Hi hollasj,
Welcome to Tech Support Forum!  I apologize for the delay getting to your log. The helpers here are all volunteers and we have been very busy here lately. If you are still having malware problems, I will be glad to help. It looks like you have a nasty file infector in your system. When it comes to these type of infections, there is no guarantee we can clean it up. I would strongly suggest you backup all your important data first. This is just in case the fix screws up any important OS files and crashes your system. OK, let’s do this next. First of all, while it is acceptable to have two anti-virus programs installed, it is not a good idea to have them both running in auto-protect mode as it may make both less effective. Choose just one to run in auto-protect and use the other for ad-hoc scans only. NEXT: First of all, we will need to disable a few security applications as they may interfere with the fixes that we need to make. To disable SpywareGuard:
To deactivate Spyware Doctor's OnGuard Tools:
NEXT: BEFORE BEGINNING, Please read completely through the instructions below. Please also print these instructions or copy them to Notepad (or another word processor), and save it for easier reference. This is because we will be in Safe Mode during the fix and you won’t be able to access the Internet to view these instructions. Please download Dr.Web CureIt and save it to your desktop: Next, please reboot your computer into Safe Mode by doing the following:
Now scan with Dr.Web CureIt:
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply. NEXT: BEFORE BEGINNING, Please read completely through the instructions below. Please also print these instructions or copy them to Notepad (or another word processor), and save it for easier reference. This is because we will be in Safe Mode during the fix and you won’t be able to access the Internet to view these instructions. Please download SDFix by AndyManchesta and save it to your desktop. Double-click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix). Please then reboot your computer into Safe Mode by doing the following:
Once in Safe Mode, please do the following:
NEXT: Please run HijackThis and click "Scan". Place a check (tick) next to the following entries (if present): R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcyds...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/sbcyds.../www.yahoo.com O4 - Global Startup: MS_update_0612_KB74062.exe O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/Activ...veLauncher.cab Close ALL programs and browsers (including this one), leaving ONLY HijackThis open, then click "Fix checked". Then please exit HijackThis. NEXT: Please download OTMoveIt by OldTimer:
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. After reboot, please run OTMoveIt again, follow the directions as above, and post the Results report for me to see. NEXT: Your log shows that you have disabled some startup programs using msconfig. This is not recommended because I cannot clearly see everything that is loading on your computer at startup. This can be bad if they are malware, so I would like you to re-enable those startup entries. To re-enable all startup items please follow these instructions:
NEXT: Please REBOOT your computer normally into Windows and post these logs in your next reply:
(You might have to paste the logs in multiple posts in the event they are too long and breach the post length of the forum software). Also, please let me know how things are running now and if you encountered any problems while you were following the directions I posted.
__________________
 Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
04-19-2007, 07:28 AM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 8
OS: WINXP
|
Re: trojan horse downloader.small.57.a
Thank you for your help!
I completely understand if your response is slow - you guys get a lot of requests for help. I finally got the cureit to run - I had a hard time getting my computer into safe mode! Here is the log - I am continuing on the steps. RegUBP2b-Family.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots;Trojan.StartPage.1505;Deleted.; A0142265.DLL;C:\System Volume Information\_restore{BBA6B7C1-0007-4E61-9AA1-4F5EF9F62A8A}\RP554;Adware.IWonBar;Renamed.; A0142576.reg;C:\System Volume Information\_restore{BBA6B7C1-0007-4E61-9AA1-4F5EF9F62A8A}\RP571;Trojan.StartPage.1505;Deleted.; A0142265.#LL;C:\System Volume Information\_restore{BBA6B7C1-0007-4E61-9AA1-4F5EF9F62A8A}\RP554;Adware.IWonBar;Renamed.; Now I am going to run SDfix, and then I will post that log. Thanks, hollasj |
|
|
|
|
04-19-2007, 07:47 AM
|
#5 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 8
OS: WINXP
|
Re: trojan horse downloader.small.57.a
Here is the report.txt from the sdfix.
It told me to run another program but I did not do this since it was not in your instructions. Now I will run hijack and then post that log. SDFix: Version 1.79 Run by Administrator - Thu 04/19/2007 - 8:31:15.48 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MS_update_0612_KB74062.exe - Deleted C:\WINDOWS\regedit.com - Deleted Removing Temp Files ADS Check: Checking if ADS is attached to system32 Folder C:\WINDOWS\system32 No streams found. Checking if ADS is attached to svchost.exe C:\WINDOWS\system32\svchost.exe No streams found. Final Check: Remaining Services: ------------------ Remaining Files: --------------- Backups Folder: - C:\SDFix\backups\backups.zip Checking For Files with Hidden Attributes: C:\Documents and Settings\Family\NetHood\files on centerpointenergy.com\Desktop.ini C:\Program Files\America Online 6.0\aolphx.exe C:\Program Files\America Online 6.0\aoltray.exe C:\Program Files\America Online 6.0\packethsvc.exe C:\Program Files\America Online 6.0\RBM.exe C:\Program Files\America Online 6.0\waol.exe C:\Program Files\America Online 6.0\COMIT\cswitch.exe C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe C:\WINDOWS\system32\PackethSvc.exe C:\Documents and Settings\Family\Application Data\Microsoft\Word\~WRL1426.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@R465.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@R467.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@R469.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@R46B.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@R46D.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@S466.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@S468.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@S46A.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@S46C.tmp C:\Documents and Settings\Family\Local Settings\Temp\Z@S46E.tmp Finished |
|
|
|
|
04-19-2007, 08:07 AM
|
#6 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 8
OS: WINXP
|
Re: trojan horse downloader.small.57.a
Here are my final log files. If I forgot to do something please let me know I think I tried to follow it to the letter! :) Move it log File/Folder C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MS_update_0612_KB74062.exe not found. C:\spyware software\Setup.exe moved successfully. C:\WINDOWS\Downloaded Program Files\iwonslot1,0,2,5.inf moved successfully. C:\WINDOWS\zts2.exe moved successfully. C:\WINDOWS\System32\vcmgcd32.dll moved successfully. C:\WINDOWS\System32\iifgfgf.dll moved successfully. C:\WINDOWS\rundll16.exe moved successfully. C:\WINDOWS\rundl132.dll moved successfully. C:\WINDOWS\logo1_.exe moved successfully. C:\WINDOWS\System32\TASKMGR.COM moved successfully. C:\WINDOWS\System32\T.COM moved successfully. File/Folder C:\WINDOWS\REGEDIT.COM not found. C:\WINDOWS\R.COM moved successfully. Created on 04/19/2007 08:53:46 hijack this log Logfile of HijackThis v1.99.1 Scan saved at 9:02:30 AM, on 4/19/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Yahoo!\Antivirus\ISafe.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Yahoo!\Antivirus\VetMsg.exe C:\Program Files\HijackThis\HijackThis.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\Smtray.exe C:\Program Files\Yahoo!\Antivirus\CAVTray.exe C:\Program Files\Yahoo!\Antivirus\CAVRID.exe C:\Program Files\2Wire\Gateway\2PortalMon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Plaxo\2.8.1.2\PlaxoHelper.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\COMPAQ\CPQINET\CPQInet.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\CMS Peripherals\BounceBack Express\BBLauncher.exe C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\SpywareGuard\sgmain.exe C:\WINDOWS\System32\WgaTray.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [Smapp] Smtray.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\Gateway\2PortalMon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe" O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.8.1.2\PlaxoHelper.exe -a O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [I&F Viewer toolbar] "C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe" -start O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BounceBack Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\quickenw\bagent.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Support - {C66A417B-D8BC-4698-85E4-F8C3011F9868} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (file missing) (HKCU) O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.9.0.6...aces-en_US.cab O16 - DPF: Armored Attack by pogo - http://game1.pogo.com/applet-6.7.3.2...tank-en_US.cab O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.8.1.3...mmon-en_US.cab O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.8.4.5...jack-en_US.cab O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-6.8.1.3...ack2-en_US.cab O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.9.4.4...cade-en_US.cab O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-6.8.4.5...ling-en_US.cab O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.9.0.6...asta-en_US.cab O16 - DPF: Checkers by pogo - http://game1.pogo.com/applet-6.9.4.3...kers-en_US.cab O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.8.0.3...ess2-en_US.cab O16 - DPF: Command and Conquer Comanche by pogo - http://game1.pogo.com/applet-6.8.4.5...rike-en_US.cab O16 - DPF: Cribbage by pogo - http://game1.pogo.com/applet-6.7.3.3...bage-en_US.cab O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.3.23/ytz/ytz-en_US.cab O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.7.3.2...flag-en_US.cab O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.3.3...ccer-en_US.cab O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.9.0.4...ass2-en_US.cab O16 - DPF: Fortune Bingo by pogo - |
