|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
06-30-2008, 10:48 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 5
OS: xp
|
Here is my Deckard log. Please help!
I've been trying to get rid of a virtumonde infection with no success. I am not at all experienced in this sort of thing so any help would be greatly appreciated. Here's my log:
Deckard's System Scanner v20071014.68 Run by Mona on 2008-06-30 21:58:05 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 88: 2008-07-01 04:58:47 UTC - RP805 - Deckard's System Scanner Restore Point 87: 2008-07-01 01:11:48 UTC - RP804 - System Checkpoint 86: 2008-06-28 19:27:46 UTC - RP803 - Last known good configuration 85: 2008-06-28 19:26:49 UTC - RP802 - Restore Operation 84: 2008-06-28 19:26:46 UTC - RP801 - Spyware Doctor: Cleaning Threats -- First Restore Point -- 1: 2008-06-28 19:24:40 UTC - RP718 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Mona.exe) ------------------------------------------------ logfile has no content; running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-30 22:01:17 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\RegistrySmart\RegistrySmart.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\alg.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Mona\Desktop\dss.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Symantec Shared\COH\COH32.exe C:\Program Files\Webroot\Spy Sweeper\ssu.exe C:\Program Files\Trend Micro\HijackThis\Mona.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {2CD8C3A2-5C57-45A8-B727-A79DEAF68930} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {79076950-F022-4D2A-AF45-C9E2F0A9F931} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {A2A1F4D1-7AE5-44F2-A0CB-B04DB7E3AE6D} - C:\WINDOWS\system32\qoMdBTnm.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {C1CF1A7A-A6B3-DB4F-C97D-DCC868FE7E9B} - (no file) O2 - BHO: {ff20d78f-1c9b-da29-7314-647072ec26ed} - {de62ce27-0746-4137-92ad-b9c1f87d02ff} - C:\WINDOWS\system32\dgbblz.dll O2 - BHO: (no name) - {EEE94C3F-52C2-4CD4-ABF8-45A3A26AA8B2} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] "C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" -boot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1163339409921 O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.mumbojumbo.com/assets/mjolauncher.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://noofy57.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_05) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.22/ttinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3209.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,avgrsstx.dll O20 - Winlogon Notify: rqRJCVop - C:\WINDOWS\system32\rqRJCVop.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 14729 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BS_I2cIo - c:\windows\system32\drivers\bs_i2cio.sys <Not Verified; BIOSTAR Group; BIOSTAR I/O driver fle> R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path ManagerŪ (32-bit)> R2 SetupNT - c:\windows\system32\setupnt.sys S2 ousbehci (NEC PCI to USB Enhanced Host Controller) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver> S3 ousb2hub (OrangeWare USB 2.0 Root Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver> S3 SjyPkt - c:\windows\system32\drivers\sjypkt.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-30 03:30:10 424 --a------ C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job 2008-06-30 02:00:09 1496 --a------ C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job 2008-06-28 12:00:07 284 --a----c- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-06-19 18:10:00 298 --a----c- C:\WINDOWS\Tasks\Ad-Aware SE Personal.job 2008-06-13 18:12:00 262 --a----c- C:\WINDOWS\Tasks\Spybot - Search & Destroy.job -- Files created between 2008-05-30 and 2008-06-30 ----------------------------- 2008-06-30 20:30:29 0 d-------- C:\Program Files\Trend Micro 2008-06-28 10:50:36 104960 --a------ C:\WINDOWS\system32\dgbblz.dll 2008-06-28 10:50:33 104960 --a------ C:\WINDOWS\system32\juvmgfjt.dll 2008-06-28 10:47:41 94208 --a------ C:\WINDOWS\system32\aohvqxit.dll 2008-06-28 10:08:11 104960 --a------ C:\WINDOWS\system32\hovmuk.dll 2008-06-28 10:07:58 104960 --a------ C:\WINDOWS\system32\tyybhvcl.dll 2008-06-22 11:59:39 128512 --a------ C:\WINDOWS\system32\ljovwyay.dll 2008-06-22 11:56:41 121344 --a------ C:\WINDOWS\system32\bbionwvp.dll 2008-06-22 11:54:48 128512 --a------ C:\WINDOWS\system32\pqnhdpml.dll 2008-06-20 22:48:26 0 d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-20 22:47:18 0 d-------- C:\Program Files\RegistrySmart 2008-06-19 18:03:06 104960 --a------ C:\WINDOWS\system32\gjjlywsw.dll 2008-06-18 15:20:56 0 d-------- C:\Program Files\Lavasoft 2008-06-18 15:20:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19:52 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 15:12:56 667139 --ahs---- C:\WINDOWS\system32\mnTBdMoq.ini2 2008-06-18 15:12:37 299520 --a------ C:\WINDOWS\system32\qoMdBTnm.dll 2008-06-18 14:19:31 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:18:49 0 d-------- C:\Program Files\Webroot 2008-06-18 14:18:49 0 d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:17:49 164 --a------ C:\install.dat 2008-06-18 11:03:08 134656 --a------ C:\WINDOWS\system32\cdvhbflu.dll 2008-06-18 10:57:46 129536 --a------ C:\WINDOWS\system32\aileerpj.dll 2008-06-17 12:35:32 0 dr-h----- C:\Documents and Settings\Mona\Recent 2008-06-17 10:53:56 130560 --a------ C:\WINDOWS\system32\uaaydwub.dll 2008-06-17 10:47:56 124416 --a------ C:\WINDOWS\system32\fjflicqb.dll 2008-06-17 10:45:13 130560 --a------ C:\WINDOWS\system32\iqonqhjh.dll 2008-06-17 10:45:01 124416 --a------ C:\WINDOWS\system32\cbgttrcm.dll 2008-06-16 11:23:07 0 d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23:07 0 d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 10:44:19 131584 --a------ C:\WINDOWS\system32\vbunypvh.dll 2008-06-16 10:42:03 127488 --a------ C:\WINDOWS\system32\wxhrbsua.dll 2008-06-16 10:41:18 688708 --ahs---- C:\WINDOWS\system32\TCLkknpo.ini2 2008-06-15 16:29:27 0 d--h----- C:\$AVG8.VAULT$ 2008-06-15 16:24:19 0 d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-15 16:23:53 0 d-------- C:\Program Files\AVG 2008-06-15 16:23:49 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-06-14 22:08:43 130560 --a------ C:\WINDOWS\system32\dumumsaw.dll 2008-06-14 22:08:32 128 --a------ C:\Documents and Settings\Mona\services.exe 2008-06-14 22:07:25 133632 --a------ C:\WINDOWS\system32\gxwxnhma.dll 2008-06-14 00:04:18 692636 --ahs---- C:\WINDOWS\system32\eddMlnpo.ini2 -- Find3M Report --------------------------------------------------------------- 2008-06-30 22:01:37 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-30 14:57:36 0 d-------- C:\Program Files\Norton 360 2008-06-30 02:46:42 0 d-------- C:\Program Files\Bonjour 2008-06-18 15:19:52 0 d-------- C:\Program Files\Common Files 2008-06-17 11:58:59 0 d-------- C:\Program Files\MySpace 2008-06-17 10:39:37 0 d-------- C:\Program Files\Ahead 2008-06-16 10:48:38 0 d-------- C:\Program Files\STOPzilla! 2008-06-16 10:43:29 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-14 23:07:47 0 d-------- C:\Program Files\Windows Live 2008-06-14 23  21 0 d-------- C:\Program Files\Musicmatch2008-06-14 22:59:09 0 d-------- C:\Documents and Settings\Mona\Application Data\Adobe 2008-06-14 22:58:52 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-14 00:02:01 0 d-------- C:\Documents and Settings\Mona\Application Data\LimeWire 2008-05-28 19:13:30 0 d-------- C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-25 19:16:53 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-03 15:49:17 0 d-------- C:\Program Files\Label Maker Wizard 2008-04-30 21:34:07 4 --a----c- C:\WINDOWS\system32\26E350 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CD8C3A2-5C57-45A8-B727-A79DEAF68930}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] 06/17/2008 02:23 PM 349552 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] 04/22/2008 04:50 PM 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79076950-F022-4D2A-AF45-C9E2F0A9F931}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A2A1F4D1-7AE5-44F2-A0CB-B04DB7E3AE6D}] 06/18/2008 03:12 PM 299520 --a------ C:\WINDOWS\system32\qoMdBTnm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C1CF1A7A-A6B3-DB4F-C97D-DCC868FE7E9B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{de62ce27-0746-4137-92ad-b9c1f87d02ff}] 06/28/2008 10:50 AM 104960 --a------ C:\WINDOWS\system32\dgbblz.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE94C3F-52C2-4CD4-ABF8-45A3A26AA8B2}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll [06/17/2008 02:23 PM 349552] [-HKEY_CLASSES_ROOT\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [08/04/2004 12:56 AM C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [10/06/2003 02:16 PM C:\WINDOWS\system32\nwiz.exe] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [03/03/2004 02:30 PM] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [05/16/2003 03:10 AM] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [02/14/2008 04:40 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [03/26/2008 05:40 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [02/18/2008 12:37 PM] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [02/26/2008 07:50 AM] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/15/2008 04:24 PM] "RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [06/19/2008 03:36 PM] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [08/04/2004 12:56 AM C:\WINDOWS\system32\rundll32.exe] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 09:24 AM] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [10/18/2006 09:05 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 1:15:54 AM] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [9/13/2007 2:50:44 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRJCVop] rqRJCVop.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMdBTnm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}] Auto\command- D:\Start.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe *Newly Created Service* - COMHOST -- Hosts ----------------------------------------------------------------------- 127.0.0.1 localhost #***Inserted By STOPzilla*** -- End of Deckard's System Scanner: finished at 2008-06-30 22:03:46 ------------ |
|
     |
|
07-03-2008, 02:46 PM
|
#2 (permalink) | ||
|
Analyst, Security Team
Join Date: Oct 2007
Location: Georgia
Posts: 1,882
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Hello and welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ It appears that you have two antivirus programs installed. Quote:
------------------------------------------------------ Quote:
We suggest uninstalling it via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Manager<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folder if it still exists: C:\Program Files\Viewpoint ------------------------------------------------------ Please download Combofix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named, to the desktop, next to ComboFix.exe Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
||
|
|
|
|
07-05-2008, 11:00 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 5
OS: xp
|
Re: Here is my Deckard log. Please help!
Chemist, thank you for reponding. I've deleted AVG and kept Norton. I've followed your instructions and now have posted the ComboFix and HiJackThis logs.
Thanks for your help. ComboFix 08-07-05.1 - Mona 2008-07-05 22:27:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.218 [GMT -7:00] Running from: C:\Documents and Settings\Mona\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mona\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMe76f1f9f.txt C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\aileerpj.dll C:\WINDOWS\system32\aohvqxit.dll C:\WINDOWS\system32\bbionwvp.dll C:\WINDOWS\system32\buokgmff.ini C:\WINDOWS\system32\cbgttrcm.dll C:\WINDOWS\system32\cdvhbflu.dll C:\WINDOWS\system32\dgbblz.dll C:\WINDOWS\system32\dumumsaw.dll C:\WINDOWS\system32\eddMlnpo.ini C:\WINDOWS\system32\eddMlnpo.ini2 C:\WINDOWS\system32\fjflicqb.dll C:\WINDOWS\system32\fualellm.ini C:\WINDOWS\system32\gjjlywsw.dll C:\WINDOWS\system32\gkomoasf.dll C:\WINDOWS\system32\gxwxnhma.dll C:\WINDOWS\system32\hitvqhvh.ini C:\WINDOWS\system32\hovmuk.dll C:\WINDOWS\system32\iqonqhjh.dll C:\WINDOWS\system32\juvmgfjt.dll C:\WINDOWS\system32\ljovwyay.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mnTBdMoq.ini C:\WINDOWS\system32\mnTBdMoq.ini2 C:\WINDOWS\system32\pqnhdpml.dll C:\WINDOWS\system32\pvwnoibb.ini C:\WINDOWS\system32\qoMdBTnm.dll C:\WINDOWS\system32\TCLkknpo.ini C:\WINDOWS\system32\TCLkknpo.ini2 C:\WINDOWS\system32\tulhwmvv.dll C:\WINDOWS\system32\tyybhvcl.dll C:\WINDOWS\system32\uaaydwub.dll C:\WINDOWS\system32\vbunypvh.dll C:\WINDOWS\system32\vvmwhlut.ini C:\WINDOWS\system32\wxhrbsua.dll C:\WINDOWS\system32\xbdgxhhj.ini C:\WINDOWS\system32\zexvuy.dll C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-05 21:24 . 2008-07-05 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-30 21:57 . 2008-06-30 21:57 <DIR> d-------- C:\Deckard 2008-06-30 20:30 . 2008-06-30 20:30 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-30 20:29 . 2008-06-30 20:30 812,344 --a------ C:\Program Files\HJTInstall.exe 2008-06-28 11:20 . 2008-06-28 11:21 15,070,104 --a------ C:\Program Files\SpySweeperRegSetup_EN.exe 2008-06-20 22:48 . 2008-06-30 11:16 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-19 07:01 . 2008-06-18 18:36 294 --ahs---- C:\WINDOWS\system32\hxdyoeci.ini 2008-06-18 18:54 . 2008-06-18 18:55 1,917 --a------ C:\WINDOWS\imsins.BAK 2008-06-18 18:36 . 2008-06-18 18:36 74 --ahs---- C:\WINDOWS\system32\hxdyoeci.tmp 2008-06-18 15:20 . 2008-06-18 15:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-18 15:20 . 2008-06-18 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19 . 2008-06-18 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 14:19 . 2008-06-18 14:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:19 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-06-18 14:19 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-06-18 14:19 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-06-18 14:19 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Program Files\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:18 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-06-18 14:17 . 2008-06-28 11:22 164 --a------ C:\install.dat 2008-06-16 16:23 . 2008-06-16 16:23 1,657,164 --ahs---- C:\WINDOWS\system32\mbmjgaep.tmp 2008-06-16 11:23 . 2008-07-04 01:57 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23 . 2008-06-16 11:23 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 11:23 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-16 11:23 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-16 11:23 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-16 11:23 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-14 22:08 . 2008-06-18 08:32 128 --a------ C:\Documents and Settings\Mona\services.exe 2008-06-14 22:07 . 2008-06-30 01:54 110,484 --a------ C:\WINDOWS\BMe76f1f9f.xml 2008-06-10 15:56 . 2008-04-14 04:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-06 05:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-06 05:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-06 04:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-06 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-01 05:35 --------- d-----w C:\Program Files\Norton 360 2008-06-30 09:46 --------- d-----w C:\Program Files\Bonjour 2008-06-19 01:55 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-17 18:58 --------- d-----w C:\Program Files\MySpace 2008-06-17 17:39 --------- d-----w C:\Program Files\Ahead 2008-06-16 17:48 --------- d-----w C:\Program Files\STOPzilla! 2008-06-16 17:43 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-16 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-06-15 06:07 --------- d-----w C:\Program Files\Windows Live 2008-06-15 06:06 --------- d-----w C:\Program Files\Musicmatch 2008-06-15 05:58 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-14 07:02 --------- d-----w C:\Documents and Settings\Mona\Application Data\LimeWire 2008-05-29 02:13 --------- d-----w C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-26 02:16 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-26 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-26 02:12 2,400,784 ----a-w C:\Program Files\WLinstaller.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-03 22:48 924,392 -c--a-w C:\Program Files\setup.exe 2008-03-18 03:10 9,525,462 -c--a-w C:\Program Files\aep292.exe 2008-03-11 23:13 199,021,300 -c--a-w C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip 2008-03-11 02:08 606,168 -c--a-w C:\Program Files\AmazonMP3Installer.exe 2007-02-03 00:07 722,176 ----a-w C:\Documents and Settings\Mona\gotomypc_428.exe 2006-09-09 01:51 563,712 ----a-w C:\Documents and Settings\Mona\gotomypc_370.exe 2006-03-14 05:38 563,712 ----a-w C:\Documents and Settings\Mona\370_gotomypc.exe 2005-08-18 04:11 8,192 -csha-w C:\Program Files\Thumbs.db 2004-09-24 18:23 204 -c--a-w C:\Program Files\princess.gif 2004-09-24 18:23 201 -c--a-w C:\Program Files\prince.gif 2004-09-24 18:23 1,458 -c--a-w C:\Program Files\reggie1_emoticon.bmp 2004-09-24 08:01 3,603,880 -c--a-w C:\Program Files\ssfsetup648_1761519317.exe 2004-09-04 03:23 462,919 ----a-w C:\Documents and Settings\Mona\gotomypc.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16 49152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16 5058560] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [2004-03-03 14:30 131072] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 03:10 57344] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-14 16:40 1836544] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [2008-03-26 17:40 2577120] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 12:37 51048] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 07:50 988512] "nwiz"="nwiz.exe" [2003-10-06 14:16 741376 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 18:23 443968] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-09-13 14:50:44 745472] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 BS_I2cIo;BS_I2cIo;C:\WINDOWS\System32\drivers\BS_I2cIo.sys [2003-11-20 16:04] R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 11:43] R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 12:37] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53] S2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2003-06-01 14:10] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2003-06-01 14:10] S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}] \Shell\Auto\command - D:\Start.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-07-04 01:10:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job" - C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe "2008-06-28 19:00:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-30 10:30:10 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job" - C:\Program Files\RegistrySmart\RegistrySmart.ex - C:\Program Files\RegistrySmart "2008-06-14 01:12:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy.job" - C:\PROGRA~1\SPYBOT~1\SpybotSD.exe "2008-06-30 09:00:09 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . - - - - ORPHANS REMOVED - - - - HKLM-Run-e45c2c03 - C:\WINDOWS\system32\tulhwmvv.dll Notify-rqRJCVop - rqRJCVop.dll MSConfigStartUp-BearShare - C:\Program Files\BearShare\BearShare.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-05 22:34:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-07-05 22:40:26 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-06 05:40:06 Pre-Run: 52,489,089,024 bytes free Post-Run: 52,564,873,216 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptOut C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 256 --- E O F --- 2008-06-11 04:05:34 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:44:13 PM, on 7/5/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] "C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" -boot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1163339409921 O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.mumbojumbo.com/assets/mjolauncher.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://noofy57.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.22/ttinst.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3209.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 11879 bytes |
|
|
|
|
07-06-2008, 02:53 PM
|
#4 (permalink) | |
|
Analyst, Security Team
Join Date: Oct 2007
Location: Georgia
Posts: 1,882
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Hello again, noofy57. Please tell us how your system is behaving after doing the following.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please go to: VirusTotal
Are you familiar with this zipped file? Do you know what it belongs to? Please let us know. C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript into ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. If you use dial-up for the internet, skip this step and let me know. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: VirusTotal results C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
|
07-07-2008, 05:05 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 5
OS: xp
|
Re: Here is my Deckard log. Please help!
Hi Chemist. I followed your instructions again, but was unable to access the Kapersky Online Scanner. I got a message that said the Internet server or proxy server couldn't be located. Do you have another way for me to run this scan? Meanwhile, I've pasted the Virus Totals and the ComboFix.txt file below. I'll run the HijackThis log after I am able to run the Kapersky scan. By the way, the zip file you asked about is for MS PhotoDraw V2. Thanks. ComboFix 08-07-05.1 - Mona 2008-07-07 14:38:44.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.208 [GMT -7:00] Running from: C:\Documents and Settings\Mona\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mona\Desktop\CFScript.txt * Created a new restore point FILE :: File:: C:\WINDOWS\system32\hxdyoeci.iniC:\WINDOWS\system32\hxdyoeci.tmpC:\Documents and Settings\Mona\services.exeC:\WINDOWS\BMe76f1f9f.xmlC:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.jobRegistry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}]Folder:: C:\Documents and Settings\All Users\Application Data\Avg8C:\Documents and Settings\All Users\Application Data\Viewpoint . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMe76f1f9f.xml . ((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))) . 2008-07-05 21:24 . 2008-07-05 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-30 21:57 . 2008-06-30 21:57 <DIR> d-------- C:\Deckard 2008-06-30 20:30 . 2008-06-30 20:30 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-30 20:29 . 2008-06-30 20:30 812,344 --a------ C:\Program Files\HJTInstall.exe 2008-06-28 11:20 . 2008-06-28 11:21 15,070,104 --a------ C:\Program Files\SpySweeperRegSetup_EN.exe 2008-06-20 22:48 . 2008-06-30 11:16 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-19 07:01 . 2008-06-18 18:36 294 --ahs---- C:\WINDOWS\system32\hxdyoeci.ini 2008-06-18 18:54 . 2008-06-30 03:00 1,917 --a------ C:\WINDOWS\imsins.BAK 2008-06-18 18:36 . 2008-06-18 18:36 74 --ahs---- C:\WINDOWS\system32\hxdyoeci.tmp 2008-06-18 15:20 . 2008-06-18 15:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-18 15:20 . 2008-06-18 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19 . 2008-06-18 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 14:19 . 2008-06-18 14:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:19 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-06-18 14:19 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-06-18 14:19 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-06-18 14:19 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Program Files\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:18 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-06-18 14:17 . 2008-06-28 11:22 164 --a------ C:\install.dat 2008-06-16 16:23 . 2008-06-16 16:23 1,657,164 --ahs---- C:\WINDOWS\system32\mbmjgaep.tmp 2008-06-16 11:23 . 2008-07-04 01:57 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23 . 2008-06-16 11:23 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 11:23 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-16 11:23 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-16 11:23 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-16 11:23 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-14 22:08 . 2008-06-18 08:32 128 --a------ C:\Documents and Settings\ |
