|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
09-11-2007, 07:41 PM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 13
OS: XP
|
Malware help re:Trojan.W32.Looksy
Constant popups-Security warning, opens IE to a "get this software to protect you", displays a "DISK FULL" window, Yellow "security warning box pointing to right side task bar which is pointing to a red X next to Norton, Spyware alert, Window with "SECURITPCCLEANER" advertised, this gets repeated every minute or so. Full system is slow.
I-uploaded Dss Extra. 2-Imbeded-Main.txt 3-Imbeded-Activescan.txt Please advise if I left something out. Regards, Richard Here is Main.txt: Deckard's System Scanner v20070905.67 Run by Richard on 2007-09-11 20:04:44 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 26: 2007-09-12 02:05:15 UTC - RP1225 - Deckard's System Scanner Restore Point 25: 2007-09-09 17  23 UTC - RP1224 - System Checkpoint24: 2007-09-08 14:15:32 UTC - RP1223 - System Checkpoint 23: 2007-09-07 13:34:09 UTC - RP1222 - System Checkpoint 22: 2007-09-06 04:42:21 UTC - RP1221 - System Checkpoint -- First Restore Point -- 1: 2007-08-21 01:35:57 UTC - RP1200 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 511 MiB (512 MiB recommended). -- HijackThis (run as Richard.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:09:20 PM, on 9/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Canon\BJCard\Bjmcmng.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\DSentry.exe C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Canon\BJCard\BJLaunch.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Richard\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Richard.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: MSVPS System - {3CB70CC2-303F-4A6C-824D-013AE8CFDB6B} - C:\WINDOWS\nsduo.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [BJLaunchEXE] C:\Program Files\Canon\BJCard\BJLaunch.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [AnyTime Organizer] C:\Program Files\AnyTime Deluxe\AtDem.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/potc_x.cab O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://autosupport.intuit.com/sdccom...ad/tgctlcm.cab O16 - DPF: {01115A00-3E00-11D2-8470-0060089874ED} (Support.com Control Commander Proxy) - http://autosupport.intuit.com/sdccom...load/tgcmd.cab O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://autosupport.intuit.com/sdccom...nload/ssrc.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho.../yinst0401.cab O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1129119762609 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/b...ll/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab O17 - HKLM\System\CS1\Services\Tcpip\..\{04A4FC5D-590A-40A6-A7DE-F53033F83FE4}: NameServer = 166.93.1.3,166.93.8.2 O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O21 - SSODL: msmhost - {BE291316-9626-4CB8-9AD8-DC43433C51D1} - C:\WINDOWS\msmhost.dll O21 - SSODL: msmdev - {0E1FC3F0-F62F-4CCC-83EF-AA87A8594064} - C:\WINDOWS\msmdev.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 12678 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 agp440 (Intel AGP Bus Filter) - c:\windows\\systemroot\system32\drivers\agp440.sys (file missing) R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing) S3 SDDMI2 - c:\windows\system32\ddmi2.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Bjmcmng (Canon BJ Memory Card Manager) - c:\program files\canon\bjcard\bjmcmng.exe <Not Verified; CANON INC.; Memory Card Utility> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2007-09-10 03:00:02 492 --a------ C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job 2007-09-10 03:00:02 532 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Norton QuickScan - Richard.job 2007-09-10 03:00:02 534 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Richard.job -- Files created between 2007-08-11 and 2007-09-11 ----------------------------- 2007-09-11 20:08:38 0 d-------- C:\Program Files\Trend Micro 2007-09-11 19:17:38 0 d-------- C:\Program Files\SpywareBlaster 2007-09-11 06:37:59 0 d-------- C:\WINDOWS\CSC 2007-09-10 00:29:04 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-09-09 16:33:32 48640 --a------ C:\WINDOWS\main_uninstaller.exe 2007-09-09 16:33:31 200704 --a------ C:\WINDOWS\msmhost.dll <Not Verified; ; msmhost> 2007-09-09 16:33:31 270336 --a------ C:\WINDOWS\msmdev.dll 2007-09-09 16:33:23 196608 --a------ C:\WINDOWS\nsduo.dll <Not Verified; ; nsduo> 2007-09-09 16:31:25 0 d-------- C:\Program Files\VideoAccessCodec 2007-09-08 16:44:04 0 d-------- C:\Documents and Settings\Richard\Application Data\vlc 2007-09-08 16:41:42 0 d-------- C:\Program Files\VideoLAN 2007-08-27 08:19:05 0 d-------- C:\Documents and Settings\Richard\Application Data\SpywareBot 2007-08-27 08:18:22 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-08-27 08:18:10 0 d-------- C:\Program Files\SpywareBot 2007-08-24 07:51:25 0 d--h----- C:\BJPrinter -- Find3M Report --------------------------------------------------------------- 2007-09-11 19:05:44 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-09-10 02:50:12 0 d-------- C:\Program Files\Symantec 2007-09-10 02:47:42 0 d-------- C:\Program Files\Picasa2 2007-09-10 02:38:39 0 d-------- C:\Program Files\iTunes 2007-09-10 02:26:58 0 d-------- C:\Program Files\DellSupport 2007-09-10 02:21:13 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-09-10 01:01:01 0 d-------- C:\Documents and Settings\Richard\Application Data\Symantec 2007-08-24 07:58:20 0 d-------- C:\Program Files\Google 2007-08-24 07:52:16 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-08-24 07:49:46 0 d-------- C:\Program Files\TaxCut06 2007-08-24 07:46:03 0 d-------- C:\Program Files\TaxCut05 2007-08-24 07:44:50 0 d-------- C:\Program Files\TaxCut04 2007-08-24 07:43:25 0 d-------- C:\Program Files\TaxCut03 2007-08-24 07:41:26 0 d-------- C:\Program Files\Dell Computer 2007-08-24 07:37:30 0 d-------- C:\Program Files\Microsoft Money 2005 2007-08-24 07:36:58 0 d-------- C:\Program Files\Common Files 2007-08-24 07:32:08 0 d-------- C:\Program Files\Manage-IT 2007-08-24 07:29:01 0 d-------- C:\Program Files\IrfanView 2007-08-24 07:23:56 0 d-------- C:\Program Files\Canon 2007-08-24 07:19:20 0 d-------- C:\Program Files\AnyTime Deluxe 2007-07-28 11:04:11 0 d-------- C:\Program Files\Java 2007-07-22 13:33:29 0 d-------- C:\Documents and Settings\Richard\Application Data\AdobeUM 2007-07-15 22:27:42 0 d-------- C:\Program Files\Norton AntiVirus 2007-07-15 00:48:29 0 d-------- C:\Program Files\QuickTime 2007-07-15 00:45:40 0 d-------- C:\Program Files\Apple Software Update -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}] 09/08/2007 09:22 AM 196608 --a------ C:\WINDOWS\nsduo.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [10/06/2003 03:16 PM] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [08/14/2002 05:22 PM] "WinPatrol"="C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe" [04/12/2005 12:31 PM] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [02/17/2005 12:11 AM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [03/12/2007 06:30 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/22/2007 10:19 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [07/12/2007 04:00 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [06/29/2007 06:24 AM] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [01/31/2007 08:52 PM] "nwiz"="nwiz.exe" [10/06/2003 03:16 PM C:\WINDOWS\SYSTEM32\nwiz.exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/18/2005 12:58 PM] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [08/15/2007 03:28 AM] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [05/27/2004 09:05 PM] "BJLaunchEXE"="C:\Program Files\Canon\BJCard\BJLaunch.exe" [03/14/2002 10:41 AM] "BCMSMMSG"="BCMSMMSG.exe" [08/29/2003 05:59 AM C:\WINDOWS\BCMSMMSG.exe] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [02/28/2004 08:42 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [10/24/2005 03:53 PM] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "AnyTime Organizer"="C:\Program Files\AnyTime Deluxe\AtDem.exe" [02/17/2005 03:00 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "RunNarrator"=Narrator.exe C:\Documents and Settings\Richard\Start Menu\Programs\Startup\ DESKTOP.INI [9/3/2002 12:36:04 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 11:05:26 PM] DESKTOP.INI [9/3/2002 12:36:04 PM] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [11/4/2004 7:28:24 PM] HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [11/4/2004 7:50:52 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [1/22/2007 1:21:00 PM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "msmhost"= {BE291316-9626-4CB8-9AD8-DC43433C51D1} - C:\WINDOWS\msmhost.dll [09/08/2007 09:21 AM 200704] "msmdev"= {0E1FC3F0-F62F-4CCC-83EF-AA87A8594064} - C:\WINDOWS\msmdev.dll [09/08/2007 09:21 AM 270336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -- End of Deckard's System Scanner: finished at 2007-09-11 20:10:55 ------------ Here is Activescan.txt: Incident Status Location Adware:adware/sahagent Not disinfected c:\windows\system32\SHAgentNew.dll Potentially unwanted tool:application/myway Not disinfected c:\windows\system32\Xcite.dll Adware:adware/cws Not disinfected C:\Documents and Settings\Richard\Favorites\Health Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\cookies.txt[.doubleclick.net/] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\Local Folders\Junk[New_MP3_Player.zl7] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\Local Folders\Junk[Music_MP3.zl6] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\Local Folders\Junk[New_MP3_Player.zl7] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\pop3.imagi.net\Inbox[New_MP3_Player.zl7] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\pop3.imagi.net\Inbox[Music_MP3.zl6] Virus:W32/Bagle.AH.worm Disinfected C:\Documents and Settings\Richard\Application Data\Thunderbird\Profiles\default.6r3\Mail\pop3.imagi.net\Inbox[New_MP3_Player.zl7] Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Richard\Cookies\richard@go[1].txt Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Richard\Cookies\richard@searchportal.information[1].txt Adware:Adware/VideoAccess Not disinfected C:\Program Files\VideoAccessCodec\Uninstall.exe Potentially unwanted tool:Application/MyWay Not disinfected C:\WINDOWS\SYSTEM32\Xcite2.exe Spyware:Cookie/Tribalfusion Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.tribalfusion.com/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Atlas DMT Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.atdmt.com/] Spyware:Cookie/Bfast Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.bfast.com/] Spyware:Cookie/Traffic Marketplace Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.trafficmp.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.servedby.advertising.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.advertising.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.servedby.advertising.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.advertising.com/] Spyware:Cookie/Zedo Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.zedo.com/] Spyware:Cookie/Hitbox Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.hg1.hitbox.com/] Spyware:Cookie/2o7 Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.112.2o7.net/] Spyware:Cookie/Doubleclick Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.doubleclick.net/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.servedby.advertising.com/] Spyware:Cookie/QkSrv Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.qksrv.net/] Spyware:Cookie/Com.com Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.com.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.servedby.advertising.com/] Spyware:Cookie/Adserver Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.z1.adserver.com/] Spyware:Cookie/Zedo Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.zedo.com/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\cookies.txt[.servedby.advertising.com/] Virus:W32/Sobig.E Disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\Mail\pop3.imagi.net\Inbox[your_details.zip][details.pif] Virus:W32/Bugbear.B Disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\Mail\pop3.imagi.net\Inbox[ARMRTZN.XLS.zlq] Virus:Trj/Webber Disinfected E:\My Documents\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\abi8dxkc.slt\Mail\pop3.imagi.net\Inbox[E-Loan-Appraiser-Results.zlo] Spyware:Cookie/Doubleclick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.doubleclick.net/] Spyware:Cookie/Zedo Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.zedo.com/] Spyware:Cookie/Adtech Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.adtech.de/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.fastclick.com/] Spyware:Cookie/Adserver Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.z1.adserver.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.servedby.advertising.com/] Spyware:Cookie/Advertising Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.advertising.com/] Spyware:Cookie/Tribalfusion Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Atlas DMT Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.atdmt.com/] Spyware:Cookie/Com.com Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.com.com/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Santa Monica networks inc Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.smni.com/] Spyware:Cookie/Bfast Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.bfast.com/] Spyware:Cookie/Hitbox Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.ehg.hitbox.com/] Spyware:Cookie/Santa Monica networks inc Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.smni.com/] Spyware:Cookie/Overture Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.overture.com/] Spyware:Cookie/Santa Monica networks inc Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.smni.com/] Spyware:Cookie/CentrPort Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.centrport.net/] Spyware:Cookie/Hitbox Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.hg1.hitbox.com/] Spyware:Cookie/Target Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.target.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[server.iad.liveperson.net/] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Mediaplex Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.mediaplex.com/] Spyware:Cookie/Traffic Marketplace Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.trafficmp.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[server.iad.liveperson.net/hc/9055627] Spyware:Cookie/Server.iad.Liveperson Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[server.iad.liveperson.net/hc/57211298] Spyware:Cookie/FastClick Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[.fastclick.net/] Spyware:Cookie/Server.iad.Liveperson Not disinfected E:\My Documents\Documents and Settings\Richard Cook\Application Data\Mozilla\Profiles\default\ujd3lweh.slt\cookies.txt[server.iad.liveperson.net/hc/57211298] |
|
     |
|
09-12-2007, 09:41 AM
|
#2 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 13
OS: XP
|
Re: Malware help re:Trojan.W32.Looksy
I am unable to find the "EDIT" button so I can add forgotten computer detail to my post. I have run Balarc Advisor to my initial post, but uther than like this "REPLY" I can't figure out how to make that addition.
Richard |
|
|
|
|
09-13-2007, 10:14 AM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 25,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware help re:Trojan.W32.Looksy
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. Last edited by tetonbob : 09-13-2007 at 10:15 AM. |
|
|
|
|
09-13-2007, 02:56 PM
|
#5 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 13
OS: XP
|
Re: Malware help re:Trojan.W32.Looksy
Thanks for your response tetonbob,
1-Does ComboFix.exe have to download to the desktop or can I cut and paste it to my desktop from My Download files? When my download manager window opens I don't have a browse button to redirect from MDF to the desktop. 2-Although apparently moot at this point, why am I unable to edit my original post? 3-I will proceed as soon as I get home and cranked up. Regards, Richard |
|
|
|
|
09-13-2007, 03:31 PM
|
#6 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 25,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware help re:Trojan.W32.Looksy
Quote:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. |
|
|
|
|
|
09-14-2007, 05:23 AM
|
#7 (permalink) |
|
Registered User
Join Date: Sep 2007
Posts: 13
OS: XP
|
Re: Malware help re:Trojan.W32.Looksy
http://download.bleepingcomputer.com...a/ComboFix.exe after several attempts yields a Server Not Found
Regards, RichardSC |
|
|
|
-> Run -> paste in the following single line command & click OK
