Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help > Resolved HJT Threads
McAfee -- Panda ActiveScan problems McAfee -- Panda ActiveScan problems
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

Resolved HJT Threads Resolved spyware and popup issues.

 
 
Thread Tools
Old 12-30-2007, 07:15 PM   #1 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


McAfee -- Panda ActiveScan problems
I am new to the group and would appreciate any assistance. I joined because my PC has slowed considerably. It is often running at 100% when I am not doing anything.

On this site, I clicked the "first steps" of HAVING PROBLEMS WITH SPYWARE AND POP-UPS? and was following the steps.

In step #2, when I try to load the Panda ActiveScan, my McAfee anti-virus keeps giving me all these warnings, saying it removed a trojan, displaying warnings that the site is suspect, and giving security errors.

Any ideas?
europa_rising is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 12-31-2007, 03:16 PM   #2 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


Re: McAfee -- Panda ActiveScan problems
Here is the hijackthis listing:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:50:54 PM, on 12/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing)
O2 - BHO: (no name) - {92B6B0A3-7258-4AD7-ADAD-639D96820821} - C:\WINDOWS\system32\jkklm.dll
O2 - BHO: {326f0c97-84b0-a10a-da64-d64efe9c940e} - {e049c9ef-e46d-46ad-a01a-0b4879c0f623} - C:\WINDOWS\system32\vvfulcyl.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [78c1d172] rundll32.exe "C:\WINDOWS\system32\hfafljgv.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [Sonic RecordNow!] (User 'Pauline')
O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Pauline')
O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Pauline')
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\wicudbpa.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing)

--
End of file - 7199 bytes
europa_rising is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 12-31-2007, 05:52 PM   #3 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


Re: McAfee -- Panda ActiveScan problems
I did get the Panda Avticescan to work. I attach the report.
Attached Files
File Type: txt Activescan.txt (46.7 KB, 2 views)
europa_rising is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-01-2008, 07:08 PM   #4 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


Re: Problems with Spyware--Pleawe help--McAfee -- Panda ActiveScan problems
Ok--I got through the 5 recommended steps. The last one being running DSS. Below is the contents of main.txt; attached is extra.txt.

Deckard's System Scanner v20071014.68
Run by Joe on 2008-01-01 20:41:05
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
86: 2008-01-02 01:41:38 UTC - RP732 - Deckard's System Scanner Restore Point
85: 2008-01-02 00:47:33 UTC - RP731 - Software Distribution Service 3.0
84: 2008-01-01 21:11:37 UTC - RP730 - Deckard's System Scanner Restore Point
83: 2008-01-01 00:32:31 UTC - RP729 - System Checkpoint
82: 2007-12-30 23:56:53 UTC - RP728 - Removed Java 2 Runtime Environment, SE v1.4.2


-- First Restore Point --
1: 2007-12-09 23:44:06 UTC - RP647 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 254 MiB (512 MiB recommended).


-- HijackThis (run as Joe.exe) -------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:44:30 PM, on 1/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\FKP5FOSW\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Joe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {64428EB5-6A23-4A43-820C-A868C8C0D00B} - C:\WINDOWS\system32\jkklm.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing)
O2 - BHO: {326f0c97-84b0-a10a-da64-d64efe9c940e} - {e049c9ef-e46d-46ad-a01a-0b4879c0f623} - C:\WINDOWS\system32\vvfulcyl.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [78c1d172] rundll32.exe "C:\WINDOWS\system32\hfafljgv.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\wicudbpa.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing)

--
End of file - 7677 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt>

S2 LMIInfo (LogMeIn Kernel Information Provider) - c:\program files\logmein\x86\rainfo.sys (file missing)
S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; >

S2 DomainService - c:\windows\system32\wicudbpa.exe /service (file missing)
S2 Windows Hosts Plugin - "c:\windows\system32\spoolcv.exe" (file missing)
S3 KodakCCS (Kodak Camera Connection Software) - c:\windows\system32\drivers\kodakccs.exe (file missing)


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-12-30 19:57:32 484 --a------ C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job
2007-06-15 20:22:44 346 --a------ C:\WINDOWS\Tasks\McDefragTask.job
2007-06-15 20:22:42 348 --a------ C:\WINDOWS\Tasks\McQcTask.job


-- Files created between 2007-12-01 and 2008-01-01 -----------------------------

2008-01-01 20:07:14 0 d-------- C:\WINDOWS\network diagnostic
2008-01-01 16:23:36 686630 --a------ C:\Program Files\dss.exe
2008-01-01 15:48:42 0 d-------- C:\Program Files\ZonedOut
2008-01-01 15:47:06 0 d-------- C:\ie-spyad_zo
2008-01-01 15:42:40 315590 --a------ C:\Program Files\ie-spyad_zo.exe
2008-01-01 15:19:58 0 d-------- C:\Program Files\SpywareBlaster
2007-12-31 17:41:03 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-12-31 16:47:28 0 d-------- C:\Program Files\Trend Micro
2007-12-31 13:47:25 90176 --a------ C:\WINDOWS\system32\hfafljgv.dll
2007-12-31 13:44:25 78912 --a------ C:\WINDOWS\system32\vvfulcyl.dll
2007-12-30 19:49:21 0 d-------- C:\Documents and Settings\Joe\Application Data\SpywareBot
2007-12-30 19:00:34 0 d-------- C:\WINDOWS\pss
2007-12-30 13:45:48 90176 --a------ C:\WINDOWS\system32\logedhbn.dll
2007-12-30 13:42:43 78400 --a------ C:\WINDOWS\system32\jmysnptg.dll
2007-12-29 13:02:36 78912 --a------ C:\WINDOWS\system32\fxiewkgg.dll
2007-12-27 14:27:29 81984 --a------ C:\WINDOWS\system32\cxwfyifg.dll
2007-12-25 10:49:42 78400 --a------ C:\WINDOWS\system32\yubtsgkm.dll
2007-12-22 16:09:55 78400 --a------ C:\WINDOWS\system32\xqixhtfu.dll
2007-12-16 21:18:11 0 d-------- C:\Documents and Settings\Joe\Application Data\iolo
2007-12-16 21:18:11 0 d-------- C:\Documents and Settings\All Users\Application Data\iolo
2007-12-16 19:22:30 0 d-------- C:\WINDOWS\system32\ineWc06
2007-12-16 12:12:33 85568 --a------ C:\WINDOWS\system32\flsvmlwi.dll
2007-12-13 18:17:30 85568 -----n--- C:\WINDOWS\system32\hvgmahwk.dll
2007-12-12 19:54:56 1501216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-12 19:44:59 0 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-12 19:43:49 11264 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>
2007-12-12 19:42:02 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-12-12 18:27:25 0 d-------- C:\Program Files\Internet Explorer Assistant
2007-12-12 18:13:49 85568 --a------ C:\WINDOWS\system32\dbbeldyt.dll
2007-12-09 18:57:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2007-12-09 18:43:55 10077 --ahs---- C:\WINDOWS\system32\mlkkj.ini2
2007-12-09 18:43:48 330848 --a------ C:\WINDOWS\system32\jkklm.dll
2007-12-09 18:38:11 0 d-------- C:\WINDOWS\system32\daSgo02


-- Find3M Report ---------------------------------------------------------------

2008-01-01 19:51:24 43038 --a------ C:\Documents and Settings\Joe\Application Data\wklnhst.dat
2008-01-01 15:44:11 240904 --a------ C:\Program Files\ZonedOut.zip
2007-12-31 18:49:01 0 d-------- C:\Program Files\QuickTime
2007-12-31 18:45:36 0 d-------- C:\Program Files\Messenger
2007-12-31 18:41:35 0 d-------- C:\Program Files\DellSupport
2007-12-30 19:20:49 0 d-------- C:\Program Files\McAfee
2007-12-30 18:57:47 0 d-------- C:\Program Files\Java
2007-12-30 18:55:26 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-30 18:54:02 0 d-------- C:\Program Files\MUSICMATCH
2007-12-27 15:44:15 0 d-------- C:\Documents and Settings\Joe\Application Data\SiteAdvisor
2007-12-27 15:00:16 0 d-------- C:\Program Files\SiteAdvisor
2007-12-13 20:57:16 0 d-------- C:\Program Files\Common Files
2007-12-12 19:51:59 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2007-12-06 11:25:54 0 d-------- C:\Program Files\Common Files\McAfee
2007-11-22 20:58:09 0 d-------- C:\Program Files\Common Files\Intuit


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64428EB5-6A23-4A43-820C-A868C8C0D00B}]
12/09/2007 06:43 PM 330848 --a------ C:\WINDOWS\system32\jkklm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86afcb62-7631-40ea-b519-5d9269b1a487}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e049c9ef-e46d-46ad-a01a-0b4879c0f623}]
12/31/2007 01:44 PM 78912 --a------ C:\WINDOWS\system32\vvfulcyl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [04/07/2003 01:19 AM]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [04/07/2003 01:07 AM]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [08/06/2003 02:04 AM]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [04/03/2002 02:01 AM]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [05/11/2000 02:00 AM]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [03/30/2007 10:42 AM]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [08/03/2007 10:33 PM]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/06/2007 04:14 PM]
"78c1d172"="C:\WINDOWS\system32\hfafljgv.dll" [12/31/2007 01:47 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/11/2004 04:18 AM]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [02/13/2003 02:01 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [08/05/2006 05:17 PM]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [08/26/2003 08:47 PM]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"BCMSMMSG"="BCMSMMSG.exe" [08/29/2003 04:59 AM C:\WINDOWS\BCMSMMSG.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]

C:\Documents and Settings\Joe\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 10:00:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 10:00:00 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeecd]
iifeecd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 10/18/2007 08:47 PM 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"= c:\windows\system32\ldcore.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkklm.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"




-- End of Deckard's System Scanner: finished at 2008-01-01 20:47:06 ------------
Attached Files
File Type: txt extra.txt (17.6 KB, 3 views)
europa_rising is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-01-2008, 08:50 PM   #5 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home


Re: McAfee -- Panda ActiveScan problems
Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disconnect from the internet....pull the plug!
  3. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  4. Double click on combofix.exe & follow the prompts. Type 1, then press Enter to start the fix.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  7. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
  8. Re-establish an internet connection.
  9. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006


Please do not ask for help via Private Message.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-03-2008, 09:16 PM   #6 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


Re: McAfee -- Panda ActiveScan problems
Hi--I have now subscribed to the thread--so I will respond quicker. Thanks for your response. I did what you asked.

Here is the Combo log and the HijackThis log. First the Combo log:

ComboFix 08-01-04.1 - Joe 2008-01-03 22:25:37.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.67 [GMT -5:00]
Running from: C:\Documents and Settings\Joe\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\bkR11
C:\Temp\tpBe12
C:\WINDOWS\cookies.ini
C:\WINDOWS\hg173.exe
C:\WINDOWS\SYSTEM32\avsnevok.ini
C:\WINDOWS\SYSTEM32\brcmtejw.ini
C:\WINDOWS\system32\cxwfyifg.dll
C:\WINDOWS\system32\daSgo02
C:\WINDOWS\system32\dbbeldyt.dll
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\flsvmlwi.dll
C:\WINDOWS\SYSTEM32\fndfvsli.ini
C:\WINDOWS\system32\fxiewkgg.dll
C:\WINDOWS\system32\hfafljgv.dll
C:\WINDOWS\system32\hvgmahwk.dll
C:\WINDOWS\SYSTEM32\icwxlfxv.ini
C:\WINDOWS\system32\ilsvfdnf.dll
C:\WINDOWS\SYSTEM32\iwlmvslf.ini
C:\WINDOWS\system32\jkklm.dll
C:\WINDOWS\system32\jmysnptg.dll
C:\WINDOWS\SYSTEM32\kwhamgvh.ini
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\logedhbn.dll
C:\WINDOWS\SYSTEM32\mlkkj.ini
C:\WINDOWS\SYSTEM32\mlkkj.ini2
C:\WINDOWS\SYSTEM32\nbhdegol.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\SYSTEM32\tydlebbd.ini
C:\WINDOWS\SYSTEM32\vgjlfafh.ini
C:\WINDOWS\system32\vvfulcyl.dll
C:\WINDOWS\system32\wbgnootw.dll
C:\WINDOWS\system32\xqixhtfu.dll
C:\WINDOWS\system32\yubtsgkm.dll
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-03 22:19 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 20:17 . 2007-10-10 18:55 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-01-01 20:17 . 2007-10-10 18:55 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-01-01 20:16 . 2007-10-10 18:55 6,065,664 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-01-01 20:16 . 2007-06-30 22:31 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-01-01 20:16 . 2007-06-30 22:36 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-01-01 20:16 . 2007-10-10 18:55 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-01-01 20:16 . 2007-10-10 18:55 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-01-01 20:16 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-01-01 20:16 . 2007-10-10 05:59 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-01-01 20:07 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2008-01-01 16:23 . 2008-01-01 16:23 686,630 --a------ C:\Program Files\dss.exe
2008-01-01 16:09 . 2008-01-01 16:09 <DIR> d-------- C:\Deckard
2008-01-01 15:48 . 2008-01-01 15:48 <DIR> d-------- C:\Program Files\ZonedOut
2008-01-01 15:47 . 2008-01-01 15:47 <DIR> d-------- C:\ie-spyad_zo
2008-01-01 15:44 . 2008-01-01 15:44 240,904 --a------ C:\Program Files\ZonedOut.zip
2008-01-01 15:42 . 2008-01-01 15:42 315,590 --a------ C:\Program Files\ie-spyad_zo.exe
2008-01-01 15:19 . 2008-01-01 15:37 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-31 17:41 . 2007-12-31 19:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-31 17:41 . 2007-12-31 17:41 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-31 17:41 . 2007-12-31 17:41 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-31 17:41 . 2007-12-31 17:41 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-31 16:47 . 2007-12-31 16:47 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-30 19:49 . 2007-12-30 19:58 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\SpywareBot
2007-12-25 10:45 . 2008-01-03 22:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-25 10:45 . 2008-01-03 22:40 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-22 16:01 . 2007-12-25 10:44 1,315,955 --ahs---- C:\WINDOWS\SYSTEM32\yclsivnt.ini
2007-12-18 17:35 . 2007-12-22 16:00 414 --ahs---- C:\WINDOWS\SYSTEM32\xsnxgkac.ini
2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\iolo
2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo
2007-12-16 21:18 . 2007-12-16 21:18 406 --a------ C:\WINDOWS\SYSTEM32\ioloBootDefrag.cfg
2007-12-16 19:22 . 2007-12-16 19:22 <DIR> d-------- C:\WINDOWS\SYSTEM32\ineWc06
2007-12-12 19:54 . 2008-01-03 22:43 1,611,808 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-12-12 19:54 . 2008-01-03 22:43 19,940 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2007-12-12 19:44 . 2007-12-12 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-12 19:43 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-12-12 19:43 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-12-12 19:41 . 2008-01-03 22:44 353,247 --a------ C:\WINDOWS\SYSTEM32\vsconfig.xml
2007-12-12 18:27 . 2007-12-31 18:42 <DIR> d-------- C:\Program Files\Internet Explorer Assistant
2007-12-09 18:57 . 2007-12-09 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 03:05 43,178 ----a-w C:\Documents and Settings\Joe\Application Data\wklnhst.dat
2007-12-31 23:49 --------- d-----w C:\Program Files\QuickTime
2007-12-31 23:41 --------- d-----w C:\Program Files\DellSupport
2007-12-31 18:17 48,958 ----a-w C:\Documents and Settings\Pauline\Application Data\wklnhst.dat
2007-12-31 00:20 --------- d-----w C:\Program Files\McAfee
2007-12-30 23:57 --------- d-----w C:\Program Files\Java
2007-12-30 23:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 23:54 --------- d-----w C:\Program Files\MUSICMATCH
2007-12-29 00:39 --------- d-----w C:\Documents and Settings\Pauline\Application Data\SiteAdvisor
2007-12-27 20:44 --------- d-----w C:\Documents and Settings\Joe\Application Data\SiteAdvisor
2007-12-27 20:00 --------- d-----w C:\Program Files\SiteAdvisor
2007-12-17 00:26 8,244 ----a-w C:\Documents and Settings\David\Application Data\wklnhst.dat
2007-12-06 16:25 --------- d-----w C:\Program Files\Common Files\McAfee
2007-12-04 22:42 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-11-23 01:58 --------- d-----w C:\Program Files\Common Files\Intuit
2007-11-23 01:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 03:43 --------- d-----w C:\Documents and Settings\David\Application Data\SiteAdvisor
2006-08-07 15:45 65,016 ----a-w C:\Documents and Settings\Pauline\Application Data\GDIPFONTCACHEV1.DAT
2006-06-25 02:49 65,016 ----a-w C:\Documents and Settings\Joe\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86afcb62-7631-40ea-b519-5d9269b1a487}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07 114688]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04 114741]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 02:01 135264]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-30 10:42 36904]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-03-11 04:18 151597]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-05 17:17 77824]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47 204800]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeecd]
iifeecd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-10-18 20:47 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 10:20]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys []
S2 Windows Hosts Plugin;Windows Hosts Plugin;"C:\WINDOWS\system32\spoolcv.exe" []

.
Contents of the 'Scheduled Tasks' folder
"2007-06-16 01:22:44 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-06-16 01:22:42 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-12-31 00:57:32 C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job"
- C:\Program Files\SpywareBot\SpywareBot.ex
- C:\Program Files\SpywareBot
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-03 22:46:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-03 22:52:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-04 03:52:06
.
2008-01-02 01:20:20 --- E O F ---




------------------------------------------------------------
Here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:21 PM, on 1/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\McAfee\MSC\mcuimgr.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing)

--
End of file - 6748 bytes
europa_rising is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-03-2008, 09:23 PM   #7 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home


Re: McAfee -- Panda ActiveScan problems
Good job.

Next....

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Killall::

File::
C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job
C:\WINDOWS\SYSTEM32\yclsivnt.ini
C:\WINDOWS\SYSTEM32\xsnxgkac.ini

Folder::
C:\WINDOWS\SYSTEM32\ineWc06
C:\Documents and Settings\Joe\Application Data\SpywareBot
C:\Program Files\SpywareBot

Driver::
Windows Hosts Plugin

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86afcb62-7631-40ea-b519-5d9269b1a487}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeecd]
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------


Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006


Please do not ask for help via Private Message.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-03-2008, 09:59 PM   #8 (permalink)
Registered User
 
Join Date: Dec 2007
Posts: 8
OS: windows XP


Re: McAfee -- Panda ActiveScan problems
Ok, I ran the two steps with no problem. Here is the Combofix log followed by the Hijack This log:

ComboFix 08-01-04.1 - Joe 2008-01-03 23:26:15.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.60 [GMT -5:00]
Running from: C:\Documents and Settings\Joe\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\SYSTEM32\xsnxgkac.ini
C:\WINDOWS\SYSTEM32\yclsivnt.ini
C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Joe\Application Data\SpywareBot
C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_49_21 PM_218.log
C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_49_33 PM_515.log
C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_56_23 PM_734.log
C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_57_30 PM_531.log
C:\Documents and Settings\Joe\Application Data\SpywareBot\rs.dat
C:\Documents and Settings\Joe\Application Data\SpywareBot\Settings\ScanResults.pie
C:\WINDOWS\SYSTEM32\ineWc06
C:\WINDOWS\SYSTEM32\xsnxgkac.ini
C:\WINDOWS\SYSTEM32\yclsivnt.ini
C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_WINDOWS_HOSTS_PLUGIN
-------\Windows Hosts Plugin


((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 )))))))))))))))))))))))))))))))
.

2008-01-03 22:19 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 20:17 . 2007-10-10 18:55 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-01-01 20:17 . 2007-10-10 18:55 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-01-01 20:16 . 2007-10-10 18:55 6,065,664 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-01-01 20:16 . 2007-06-30 22:31 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-01-01 20:16 . 2007-06-30 22:36 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-01-01 20:16 . 2007-10-10 18:55 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-01-01 20:16 . 2007-10-10 18:55 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-01-01 20:16 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-01-01 20:16 . 2007-10-10 05:59 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-01-01 20:07 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2008-01-01 16:23 . 2008-01-01 16:23 686,630 --a------ C:\Program Files\dss.exe
2008-01-01 16:09 . 2008-01-01 16:09 <DIR> d-------- C:\Deckard
2008-01-01 15:48 . 2008-01-01 15:48 <DIR> d-------- C:\Program Files\ZonedOut
2008-01-01 15:47 . 2008-01-01 15:47 <DIR> d-------- C:\ie-spyad_zo
2008-01-01 15:44 . 2008-01-01 15:44 240,904 --a------ C:\Program Files\ZonedOut.zip
2008-01-01 15:42 . 2008-01-01 15:42 315,590 --a------ C:\Program Files\ie-spyad_zo.exe
2008-01-01 15:19 . 2008-01-01 15:37 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-31 17:41 . 2007-12-31 19:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-31 17:41 . 2007-12-31 17:41 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-12-31 17:41 . 2007-12-31 17:41 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico
2007-12-31 17:41 . 2007-12-31 17:41 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico
2007-12-31 16:47 . 2007-12-31 16:47 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-25 10:45 . 2008-01-03 23:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-25 10:45 . 2008-01-03 22:40 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\iolo
2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo
2007-12-16 21:18 . 2007-12-16 21:18 406 --a------ C:\WINDOWS\SYSTEM32\ioloBootDefrag.cfg
2007-12-12 19:54 . 2008-01-03 23:37 1,652,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-12-12 19:54 . 2008-01-03 23:35 20,396 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2007-12-12 19:44 . 2007-12-12 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-12 19:43 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-12-12 19:43 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-12-12 19:41 . 2008-01-03 23:37 353,247 --a------ C:\WINDOWS\SYSTEM32\vsconfig.xml
2007-12-12 18:27 . 2007-12-31 18:42 <DIR> d-------- C:\Program Files\Internet Explorer Assistant
2007-12-09 18:57 . 2007-12-09 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 03:05 43,178 ----a-w C:\Documents and Settings\Joe\Application Data\wklnhst.dat
2007-12-31 23:49 --------- d-----w C:\Program Files\QuickTime
2007-12-31 23:41 --------- d-----w C:\Program Files\DellSupport
2007-12-31 18:17 48,958 ----a-w C:\Documents and Settings\Pauline\Application Data\wklnhst.dat
2007-12-31 00:20 --------- d-----w C:\Program Files\McAfee
2007-12-30 23:57 --------- d-----w C:\Program Files\Java
2007-12-30 23:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 23:54 --------- d-----w C:\Program Files\MUSICMATCH
2007-12-29 00:39 --------- d-----w C:\Documents and Settings\Pauline\Application Data\SiteAdvisor
2007-12-27 20:44 --------- d-----w C:\Documents and Settings\Joe\Application Data\SiteAdvisor
2007-12-27 20:00 --------- d-----w C:\Program Files\SiteAdvisor
2007-12-17 00:26 8,244 ----a-w C:\Documents and Settings\David\Application Data\wklnhst.dat
2007-12-06 16:25 --------- d-----w C:\Program Files\Common Files\McAfee
2007-12-04 22:42 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-11-23 01:58 --------- d-----w C:\Program Files\Common Files\Intuit
2007-11-23 01:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 03:43 --------- d-----w C:\Documents and Settings\David\Application Data\SiteAdvisor
2006-08-07 15:45 65,016 ----a-w C:\Documents and Settings\Pauline\Application Data\GDIPFONTCACHEV1.DAT
2006-06-25 02:49 65,016 ----a-w C:\Documents and Settings\Joe\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07 114688]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04 114741]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 02:01 135264]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-30 10:42 36904]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-03-11 04:18 151597]
"StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-05 17:17 77824]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47 204800]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-10-18 20:47 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 10:20]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys []

.
Contents of the 'Scheduled Tasks' folder
"2007-06-16 01:22:44 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-06-16 01:22:42 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-03 23:38:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-03 23:44:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-04 04:44:30
ComboFix2.txt 2008-01-04 03:52:14
.
2008-01-02 01:20:20 --- E O F ---




----------------------------------------------------------------
Here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:41 PM, on 1/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Mi