|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
02-25-2008, 03:11 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 9
OS: Windows XP
|
Malware/Adware Problem
Below is Deckard Scan Main.txt contents. Attached are Deckard scan extra.txt and Panda's Activescan.txt.
Thanks for the help! Deckard's System Scanner v20071014.68 Run by Vera on 2008-02-25 16:54:51 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 29: 2008-02-25 21:55:45 UTC - RP256 - Deckard's System Scanner Restore Point 28: 2008-02-23 00:29:29 UTC - RP255 - System Checkpoint 27: 2008-02-13 21:18:15 UTC - RP254 - Software Distribution Service 3.0 26: 2008-02-10 19:13:33 UTC - RP253 - System Checkpoint 25: 2008-02-09 19:09:20 UTC - RP252 - System Checkpoint -- First Restore Point -- 1: 2007-11-15 18:51:33 UTC - RP228 - Software Distribution Service 3.0 Backed up registry hives. Performed disk cleanup. Total Physical Memory: 248 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-02-25 16:58:26 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\explorer.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\MapEDC\MapEDC.exe C:\Program Files\JavaCore\JavaCore.exe C:\Documents and Settings\Vera\Application Data\WinTouch\WinTouch.exe C:\Documents and Settings\Vera\Application Data\Microsoft\Windows\bclxqk.exe C:\WINDOWS\Q2hyaXM\command.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\McAfee.com\Agent\Mcdetect.exe C:\Program Files\McAfee.com\Agent\McTskshd.exe C:\Program Files\McAfee.com\VSO\mcvsrte.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\McAfee.com\VSO\McShield.exe C:\WINDOWS\system32\alg.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NoDNS\NoDNS.exe C:\Documents and Settings\Vera\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe O4 - HKCU\..\Run: [MapEDC] C:\Program Files\MapEDC\MapEDC.exe O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Vera\Application Data\WinTouch\WinTouch.exe O4 - HKCU\..\Run: [NoDNS] C:\Program Files\\NoDNS\\NoDNS.exe O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Vera\Application Data\Microsoft\Windows\bclxqk.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\nwprovau.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub...irector/sw.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...tent/opuc2.cab O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab O16 - DPF: {5445BE81-B796-11D2-B931-002018654E2E} (MeadCo Security Manager) - http://12.20.72.79/wcsapp/weblib/Jav.../ie/SecMgr.cab O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_04) - http://java.sun.com/update/1.5.0/jin...ndows-i586.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXM\command.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\McAfee.com\VSO\McShield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - C:\Program Files\McAfee.com\VSO\mcvsrte.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O24 - Desktop Component 0: - http://www.vatanappally.com/images/funny_babysit.jpg -- End of file - 9273 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7> S3 W8335XP (IEEE 802.11g Wireless Cardbus/PCI Adapter HW51) - c:\windows\system32\drivers\mrv8000c.sys <Not Verified; Marvell Semiconductor, Inc; Device driver for Marvell 802.11 NIC> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 cmdService (Command Service) - c:\windows\q2hyaxm\command.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Network Controller Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00031028&REV_03\4&2FA23535&0&18F0 Manufacturer: Name: Network Controller PNP Device ID: PCI\VEN_14E4&DEV_4320&SUBSYS_00031028&REV_03\4&2FA23535&0&18F0 Service: Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel(R) PRO/100 VE Network Connection Device ID: PCI\VEN_8086&DEV_1068&SUBSYS_01A41028&REV_03\4&2FA23535&0&40F0 Manufacturer: Intel Name: Intel(R) PRO/100 VE Network Connection PNP Device ID: PCI\VEN_8086&DEV_1068&SUBSYS_01A41028&REV_03\4&2FA23535&0&40F0 Service: E100B Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: PCI Modem Device ID: PCI\VEN_8086&DEV_266D&SUBSYS_542314F1&REV_03\3&61AAA01&0&F3 Manufacturer: Name: PCI Modem PNP Device ID: PCI\VEN_8086&DEV_266D&SUBSYS_542314F1&REV_03\3&61AAA01&0&F3 Service: -- Files created between 2008-01-25 and 2008-02-25 ----------------------------- 2008-02-25 15:12:15 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus> 2008-02-25 15:08:05 161 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys 2008-02-25 15:08:05 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware> 2008-02-25 14:55:58 0 d-------- C:\Program Files\NoDNS 2008-02-25 14:50:27 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-02-25 14:50:16 0 d-------- C:\WINDOWS\LastGood 2008-02-25 11:54:50 687592 --a------ C:\WINDOWS\system32\atmtd.dll 2008-02-25 11:54:45 0 d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon 2008-02-25 11:54:43 1989 --a------ C:\WINDOWS\uninstall_nmon.vbs 2008-02-25 11:54:43 0 d-------- C:\Program Files\Network Monitor 2008-02-25 11:54:41 0 d--hs---- C:\WINDOWS\Q2hyaXM 2008-02-25 11:49:35 0 d-------- C:\Documents and Settings\Vera\Application Data\WinTouch 2008-02-25 11:44:53 0 d-------- C:\WINDOWS\W?nSxS 2008-02-25 11:39:35 0 d-------- C:\Program Files\JavaCore 2008-02-25 11:39:35 0 d-------- C:\Program Files\InetGet2 2008-02-25 11:34:31 0 d-------- C:\Program Files\Temporary 2008-02-25 11:34:31 0 d-------- C:\Program Files\MapEDC 2008-02-25 10:00:46 81920 --a------ C:\WINDOWS\b154.exe 2008-02-24 09:21:38 0 d-------- C:\Program Files\QdrDrive 2008-02-24 09:21:27 0 d-------- C:\Program Files\s?mbols 2008-02-24 09:20:22 5120 --a------ C:\Documents and Settings\Vera\~.exe 2008-02-23 14:01:12 51200 --a------ C:\WINDOWS\b153.exe 2008-02-20 12:02:16 101376 --a------ C:\WINDOWS\b152.exe 2008-02-10 16:37:38 0 d-------- C:\Documents and Settings\Vera\Application Data\OurPictures -- Find3M Report --------------------------------------------------------------- 2008-02-25 16:19:02 0 d-------- C:\Program Files\QuickTime 2008-02-25 14:42:44 0 d-------- C:\Program Files\Viewpoint 2008-02-25 14:23:08 0 d-------- C:\Program Files\Common Files 2008-02-25 07:41:01 15328 --a------ C:\Documents and Settings\Vera\Application Data\wklnhst.dat 2008-02-24 22:14:31 0 d-------- C:\Program Files\s?mbols 2008-02-24 19:18:21 0 d-------- C:\Documents and Settings\Vera\Application Data\Adobe 2008-01-11 19:57:55 0 d-------- C:\Documents and Settings\Vera\Application Data\Macromedia -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [01/11/2006 12:05 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/12/2006 09:50 PM] "MCAgentExe"="C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" [09/22/2005 06:29 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MapEDC"="C:\Program Files\MapEDC\MapEDC.exe" [02/25/2008 11:34 AM] "JavaCore"="C:\Program Files\JavaCore\JavaCore.exe" [02/25/2008 11:39 AM] "WinTouch"="C:\Documents and Settings\Vera\Application Data\WinTouch\WinTouch.exe" [02/25/2008 11:51 AM] "NoDNS"="C:\Program Files\\NoDNS\\NoDNS.exe" [02/25/2008 02:55 PM] "SfKg6w"="C:\Documents and Settings\Vera\Application Data\Microsoft\Windows\bclxqk.exe" [02/25/2008 11:51 AM] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Status Monitor.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Status Monitor.lnk backup=C:\WINDOWS\pss\Status Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet *Newly Created Service* - RKPAVPROC *Newly Created Service* - SDTHOOK *Newly Created Service* - SHLWLOQRQQUY -- End of Deckard's System Scanner: finished at 2008-02-25 16:59:43 ------------ |
|
     |
|
02-26-2008, 10:47 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware/Adware Problem
Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. This will help us restore your system in the event of a serious crash. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. --------------------------------------------------------------------------------------------- Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. Last edited by tetonbob : 02-26-2008 at 10:48 PM. |
|
|
|
|
02-27-2008, 06:08 AM
|
#3 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 9
OS: Windows XP
|
Re: Malware/Adware Problem
Combo Fix Log:
ComboFix 08-02-25.3 - Vera 2008-02-27 7:28:17.1 - NTFSx86 Running from: C:\Documents and Settings\Vera\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon\domains.txt C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon\log.txt C:\Documents and Settings\Vera\Application Data\WinTouch C:\Documents and Settings\Vera\Application Data\WinTouch\wintouch.cfg C:\Documents and Settings\Vera\Application Data\WinTouch\WinTouch.exe C:\Documents and Settings\Vera\Application Data\WinTouch\WTUninstaller.exe C:\Program Files\inetget2 C:\Program Files\network monitor C:\Program Files\network monitor\netmon.exe C:\Program Files\QdrDrive C:\Program Files\smbols~1 C:\Program Files\Temporary C:\Program Files\Temporary\InsiDERInst.exe C:\WINDOWS\b152.exe C:\WINDOWS\b153.exe C:\WINDOWS\b154.exe C:\WINDOWS\Q2hyaXM\ C:\WINDOWS\Q2hyaXM\\asappsrv.dll C:\WINDOWS\Q2hyaXM\\command.exe C:\WINDOWS\Q2hyaXM\\kZ1Vurg.vbs C:\WINDOWS\Q2hyaXM\command.exe C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\wnsxs~1 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\cmdService ((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 ))))))))))))))))))))))))))))))) . 2008-02-25 22:37 . 2008-02-25 22:37 <DIR> d-------- C:\ie-spyad_zo 2008-02-25 22:36 . 2008-02-25 22:36 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-02-25 22:36 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-02-25 16:54 . 2008-02-25 16:54 <DIR> d-------- C:\Deckard 2008-02-25 15:12 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-02-25 14:55 . 2008-02-25 16:17 <DIR> d-------- C:\Program Files\NoDNS 2008-02-25 14:50 . 2008-02-25 16:38 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-02-25 14:50 . 2008-02-25 14:50 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-02-25 14:50 . 2008-02-25 14:50 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-25 14:50 . 2008-02-25 14:50 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-02-25 11:39 . 2008-02-25 16:11 <DIR> d-------- C:\Program Files\JavaCore 2008-02-25 11:34 . 2008-02-25 16:11 <DIR> d-------- C:\Program Files\MapEDC 2008-02-24 09:21 . 2008-02-24 09:21 278,793 --a------ C:\WINDOWS\system32\LF777.tmp 2008-02-24 09:21 . 2008-02-24 09:21 401 --a------ C:\WINDOWS\system32\L8139.tmp 2008-02-24 09:20 . 2008-02-24 09:21 181,965 --a------ C:\WINDOWS\system32\L9235.tmp 2008-02-24 09:20 . 2008-02-24 09:20 5,120 --a------ C:\Documents and Settings\Vera\~.exe 2008-02-22 13:07 . 2008-02-22 13:07 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-22 13:07 . 2008-02-22 13:07 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-10 16:37 . 2008-02-10 16:37 <DIR> d-------- C:\Documents and Settings\Vera\Application Data\OurPictures . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-25 21:19 --------- d-----w C:\Program Files\QuickTime 2008-02-25 19:42 --------- d-----w C:\Program Files\Viewpoint 2008-02-25 19:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint 2008-02-25 12:41 15,328 ----a-w C:\Documents and Settings\Vera\Application Data\wklnhst.dat 2008-02-24 14:20 5,120 ----a-w C:\Documents and Settings\Vera\~.exe 2008-01-10 06:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PopCap 2007-09-27 02:19 59,992 ----a-w C:\Documents and Settings\Vera\Application Data\GDIPFONTCACHEV1.DAT 2006-04-17 22:56 284 ----a-w C:\Documents and Settings\Vera\Application Data\ViewerApp.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [2006-01-11 12:05 212992] "MCAgentExe"="C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" [2005-09-22 18:29 303104] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-12 09:00 158208] [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Status Monitor.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Status Monitor.lnk backup=C:\WINDOWS\pss\Status Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2007-09-29 15:22 50528 C:\Program Files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a------ 2004-08-13 01:05 122939 C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2004-10-12 16:54 57344 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2005-10-14 13:46 77824 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a------ 2005-10-14 13:46 77824 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a------ 2005-10-14 13:50 114688 C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2005-10-14 13:49 94208 C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2005-12-20 20:54 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore] --a------ 2008-02-25 11:39 144896 C:\Program Files\JavaCore\JavaCore.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapEDC] --a------ 2008-02-25 11:34 57344 C:\Program Files\MapEDC\MapEDC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] --a------ 2005-09-22 18:29 303104 c:\PROGRA~1\mcafee.com\agent\mcagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] --a------ 2006-01-11 12:05 212992 c:\PROGRA~1\mcafee.com\agent\mcupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] --a------ 2004-09-10 22:51 50688 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoDNS] --a------ 2008-02-25 14:55 102400 C:\Program Files\\NoDNS\\NoDNS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-01-12 21:50 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] --a------ 2007-04-23 10:43 228088 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w] C:\Documents and Settings\Vera\Application Data\Microsoft\Windows\bclxqk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-06-03 03:52 36975 C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-12-10 15:18 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2004-01-07 01:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online] --a------ 2003-08-17 21:50 163840 c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask] --a------ 2005-09-22 12:19 122880 c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch] C:\Documents and Settings\Vera\Application Data\WinTouch\WinTouch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2006-03-21 15:58 3325952 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2004-08-12 09:06] S3 PhilCam8116;Logitech QuickCam Pro 3000 (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys [2001-08-17 14:05] S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-27 07:51:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\ewido\security suite\ewidoctrl.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\system32\wdfmgr.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\system32\cscript.exe . ************************************************************************** . Completion time: 2008-02-27 7:58:35 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-27 12:58:22 . 2008-02-13 21:27:15 --- E O F --- HiJackThis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8  06 AM, on 2/27/2008Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\McAgent.exe C:\Program Files\ewido\security suite\ewidoctrl.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\system32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) - http://www.blackberry.com/devicesoftware/AxLoader.cab O16 - DPF: {5445BE81-B796-11D2-B931-002018654E2E} (MeadCo Security Manager) - http://12.20.72.79/wcsapp/weblib/Jav.../ie/SecMgr.cab O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O24 - Desktop Component 0: (no name) - http://www.vatanappally.com/images/funny_babysit.jpg -- End of file - 6604 bytes |
|
|
|
|
02-27-2008, 08:45 AM
|
#4 (permalink) | ||
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware/Adware Problem
Quote:
Quote:
This machine does not have the Windows XP Recovery Console installed. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Please do this: Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System  For you, it is: Microsoft Windows XP Home Edition Service Pack 2 Download the file & save it as it's originally named, next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. When complete, a log named CF_RC.txt will open. Please post the contents of that log. Please do not reboot your machine until we have reviewed the log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
||
|
|
|
|
02-28-2008, 03:08 PM
|
#5 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 9
OS: Windows XP
|
Re: Malware/Adware Problem
Sorry it took so long. I have been tied up with work. Here is the log that was created:
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons |
|
|
|
|
02-28-2008, 04:03 PM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware/Adware Problem
Great, you can reboot your machine as needed.
Please go to: VirusTotal
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
02-28-2008, 09:09 PM
|
#7 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 9
OS: Windows XP
|
Re: Malware/Adware Problem
Result for C:\Documents and Settings\Vera\~.exe:
Antivirus Version Last Update Result AhnLab-V3 2008.2.28.2 2008.02.28 - AntiVir 7.6.0.67 2008.02.28 TR/Crypt.XPACK.Gen Authentium 4.93.8 2008.02.29 - Avast 4.7.1098.0 2008.02.28 - AVG 7.5.0.516 2008.02.28 - BitDefender 7.2 2008.02.29 - CAT-QuickHeal 9.50 2008.02.28 (Suspicious) - DNAScan ClamAV 0.92.1 2008.02.29 - DrWeb 4.44.0.09170 2008.02.28 - eSafe 7.0.15.0 2008.02.28 suspicious Trojan/Worm eTrust-Vet 31.3.5573 2008.02.29 - Ewido 4.0 2008.02.28 - FileAdvisor 1 2008.02.29 - Fortinet 3.14.0.0 2008.02.28 - F-Prot 4.4.2.54 2008.02.28 - F-Secure 6.70.13260.0 2008.02.29 Suspicious:W32/Malware!Gemini Ikarus T3.1.1.20 2008.02.29 - Kaspersky 7.0.0.125 2008.02.29 - McAfee 5241 2008.02.28 - Microsoft 1.3301 2008.02.28 - NOD32v2 2910 2008.02.28 - Norman 5.80.02 2008.02.28 - Panda 9.0.0.4 2008.02.28 Suspicious file Prevx1 V2 2008.02.29 Generic.Malware Rising 20.33.40.00 2008.02.29 - Sophos 4.27.0 2008.02.29 Mal/Generic-A Sunbelt 3.0.906.0 2008.02.28 - Symantec 10 2008.02.29 - TheHacker 6.2.9.229 2008.02.25 - VBA32 3.12.6.2 2008.02.27 - VirusBuster 4.3.26:9 2008.02.28 - Webwasher-Gateway 6.6.2 2008.02.29 Trojan.Crypt.XPACK.Gen Additional information File size: 5120 bytes MD5: bf86eb21ccd1f2a3ac53b912ba9610f3 SHA1: 12054535886562c5fc18d73f282b1f8aef080532 PEiD: - packers: PE_Patch Prevx info: http://info.prevx.com/aboutprogramte...4FBA00740300C1 Result for : C:\WINDOWS\system32\L9235.tmp File L9235.tmp_ received on 02.29.2008 04:52:37 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 15/31 (48.39%) Loading server information... Your file is queued in position: 2. Estimated start time is between 42 and 60 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.2.28.2 2008.02.28 - AntiVir 7.6.0.67 2008.02.28 DR/Scapur.K.18 Authentium 4.93.8 2008.02.29 - Avast 4.7.1098.0 2008.02.28 - AVG 7.5.0.516 2008.02.28 Downloader.Purityscan.Y BitDefender 7.2 2008.02.29 Adware.Purityscan.JA CAT-QuickHeal 9.50 2008.02.28 - ClamAV 0.92.1 2008.02.29 Trojan.Scapur-22 DrWeb 4.44.0.09170 2008.02.28 - eSafe 7.0.15.0 2008.02.28 Win32.Scapur.k eTrust-Vet 31.3.5573 2008.02.29 - Ewido 4.0 2008.02.28 - FileAdvisor 1 2008.02.29 - Fortinet 3.14.0.0 2008.02.28 W32/Scapur.K!tr F-Prot 4.4.2.54 2008.02.28 - F-Secure 6.70.13260.0 2008.02.29 W32/PurityScan.BQW.dropper Ikarus T3.1.1.20 2008.02.29 - Kaspersky 7.0.0.125 2008.02.29 Trojan.Win32.Scapur.k McAfee 5241 2008.02.28 - Microsoft 1.3301 2008.02.28 - NOD32v2 2910 2008.02.28 probably a variant of Win32/TrojanDownloader.PurityScan Norman 5.80.02 2008.02.28 W32/PurityScan.BQW.dropper Panda 9.0.0.4 2008.02.28 Adware/Yazzle Prevx1 V2 2008.02.29 TROJAN.PURITYSCAN.H Rising 20.33.40.00 2008.02.29 - Sophos 4.27.0 2008.02.29 Yazzle Installer Sunbelt 3.0.906.0 2008.02.28 - TheHacker 6.2.9.229 2008.02.25 - VBA32 3.12.6.2 2008.02.27 Trojan.Win32.Scapur.k VirusBuster 4.3.26:9 2008.02.28 - Webwasher-Gateway 6.6.2 2008.02.29 Trojan.Dropper.Scapur.K.18 Additional information File size: 181965 bytes MD5: ddad54de15551655dae0dff6275e8dd2 SHA1: 7945a90504fcbfd09eebef3dcad097c62dd784c2 PEiD: - packers: PE_Patch.PECompact, PecBundle, PECompact norman sandbox: [ General information ]<br /> * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.<br /> * Accesses executable file from resource section.<br /> * Creating several executable files on hard-drive.<br /> * File length: 181965 bytes.<br /><br /> [ Changes to filesystem ]<br /> * Creates directory C:\WINDOWS\TEMP\.<br /> * Creates file C:\WINDOWS\TEMP\nsr8999.tmp.<br /> * Deletes file C:\WINDOWS\TEMP\nsr8999.tmp.<br /> * Creates file C:\PROGRA~1\Common Files\Yazzle1552OinAdmin.exe.<br /> * Deletes file C:\PROGRA~1\Common Files\Yazzle1552OinUninstaller.exe.<br /> * Creates file C:\WINDOWS\TEMP\mshtml2.exe.<br /> * Deletes file C:\WINDOWS\TEMP\mshtml2.exe.<br /><br /> [ Changes to registry ]<br /> * Creates key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"Publisher\"=\"Outerinfo\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"DisplayName\"=\"Outerinfo\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"UninstallString\"=\"\"C:\PROGRA~1\Common Files\Yazzle1552OinUninstaller.exe\"\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"HelpLink\"=\"mailto:uninstaller@outerinfo.com\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"InstallLocation\"=\"C:\PROGRA~1\Common Files\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"NoModify\"=\"\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"NoRepair\"=\"\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"DisplayVersion\"=\"5.2.1552\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo\".<br /> * Sets value \"Append\"=\"oref=5_99001552\" in key \"HKCU\Software\Microsoft\".<br /><br /> [ Signature Scanning ]<br /> * C:\PROGRA~1\Common Files\Yazzle1552OinAdmin.exe (140288 bytes) : W32/PurityScan.BQW.<br /><br /> Prevx info: http://info.prevx.com/aboutprogramte...4AC600452D9002 Result for: C:\WINDOWS\system32\LF777.tmp File LF777.tmp received on 02.29.2008 05:01:56 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 3/32 (9.38%) Loading server information... Your file is queued in position: 3. Estimated start time is between 45 and 65 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.2.28.2 2008.02.28 - AntiVir 7.6.0.67 2008.02.28 - Authentium 4.93.8 2008.02.29 - Avast 4.7.1098.0 2008.02.28 - AVG 7.5.0.516 2008.02.28 - BitDefender 7.2 2008.02.29 - CAT-QuickHeal 9.50 2008.02.28 - ClamAV 0.92.1 2008.02.29 - DrWeb 4.44.0.09170 2008.02.28 Adware.SearchAid.origin eSafe 7.0.15.0 2008.02.28 - eTrust-Vet 31.3.5573 2008.02.29 - Ewido 4.0 2008.02.28 - FileAdvisor 1 2008.02.29 - Fortinet 3.14.0.0 2008.02.28 - F-Prot 4.4.2.54 2008.02.28 - F-Secure 6.70.13260.0 2008.02.29 - Ikarus T3.1.1.20 2008.02.29 - Kaspersky 7.0.0.125 2008.02.29 - McAfee 5241 2008.02.28 - Microsoft 1.3301 2008.02.28 Adware:Win32/InternetSpeedMonitor NOD32v2 2910 2008.02.28 - Norman 5.80.02 2008.02.28 Malware.CDHW Panda 9.0.0.4 2008.02.28 - Prevx1 V2 2008.02.29 - Rising 20.33.40.00 2008.02.29 - Sophos 4.27.0 2008.02.29 - Sunbelt 3.0.906.0 2008.02.28 - Symantec 10 2008.02.29 - TheHacker 6.2.9.229 2008.02.25 - VBA32 3.12.6.2 2008.02.27 - VirusBuster 4.3.26:9 2008.02.28 - Webwasher-Gateway 6.6.2 2008.02.29 - Additional information File size: 278793 bytes MD5: e0c2afde5b351a39b28133f4a057e5a3 SHA1: 6cca282054ee02abe4f755e9fc9592384baa0eac PEiD: - |
|
|
|
|
02-28-2008, 09:17 PM
|
#8 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,758
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware/Adware Problem
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Disconnect from the internet. Disable your protection applications. Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com Close HijackThis now. --------------------------------------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's windo |
