|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
07-04-2008, 04:37 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: xp sp3
|
[SOLVED] Comp. slow with popups, Trojan win32monder
Hello, My computer started giving me problems a week or so ago in the form of popups while online, it also slowed way down. At one point I could hardly access websites. At the time I was using the windows firewall,AVG 8.0(which I have since learned is pretty lousy compared to the older versions),and Adaware 08.I did much research and scanned with Kaspersky online scanner. It found several variants of win32monder.(YQ,MX,YS,YO,YN) , and Email worm win32.tantos B. Adaware found win32virtumonde.yeb,and win32ezula.ak
I have since got rid of AVG and installed Avast. I also got rid of Adaware and installed Spywareblaster and Spybot S&D and switched to the Zonealarm firewall. I still have these problems but not as severe. I am now in need of someone much more educated in these matters than I am to remedy my problems. Any help would be greatlly appreciated, Thank you. Deckard's System Scanner v20071014.68 Run by Brian on 2008-07-04 19:15:46 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; System Restore is disabled (service is not running). Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-07-04 19:18:00 Platform: Windows XP Service Pack 3 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\explorer.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Brian\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ie.search.msn.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.bestwebslinks.com/search.php?qq=%1 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://safesearch.cyberdefender.com/smallsearch.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://walnutbottom.ltbx.net/community/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {0AFA8FED-A984-4801-B5D2-033106BC211C} - C:\WINDOWS\system32\urqOIbXO.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: {becff59e-a1bd-6b1a-34c4-2685ed9d70a7} - {7a07d9de-5862-4c43-a1b6-db1ae95ffceb} - C:\WINDOWS\system32\oamgsq.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing) O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file) O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\ISP50\MAXSPEED\propelac.exe O4 - HKLM\..\Run: [dnscleaner] C:\WINDOWS\dnscleaner.exe O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\system32\tibs5.exe O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [10020c2b] rundll32.exe "C:\WINDOWS\system32\agfxajny.dll",b O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: winlogin.exe O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ppctlcab () - http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downlo...?1093621862783 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-12.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093620656929 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: - -- End of file - 9057 bytes -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* .scr - Icad.load.scr - shell\open\command - unable to read value -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-14 21:11:09 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-06-04 and 2008-07-04 ----------------------------- 2008-07-04 17:38:30 69664 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-04 17:28:11 0 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-04 17:27:35 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-07-04 17:26:56 11264 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> 2008-07-04 17:24:06 0 d-------- C:\WINDOWS\system32\ZoneLabs 2008-07-04 17:17:30 0 d-------- C:\WINDOWS\Internet Logs 2008-07-04 16:33:00 0 d-------- C:\VundoFix Backups 2008-07-03 00:40:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-01 01:12:21 0 d-------- C:\Documents and Settings\Brian\.housecall6.6 2008-06-30 19:14:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-29 20:00:01 0 d-------- C:\Program Files\Alwil Software 2008-06-29 19:09:36 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-29 19:09:19 0 d-------- C:\Program Files\SpywareBlaster 2008-06-29 18:59:47 104448 --a------ C:\WINDOWS\system32\oamgsq.dll 2008-06-29 18:59:34 1734112 ---hs---- C:\WINDOWS\system32\ynjaxfga.ini2 2008-06-29 18:59:25 104448 --a------ C:\WINDOWS\system32\lggmknwf.dll 2008-06-29 18:30:22 104448 --a------ C:\WINDOWS\system32\jyqcaa.dll 2008-06-29 18:30:10 104448 --a------ C:\WINDOWS\system32\quenugby.dll 2008-06-29 18:29:38 95232 --a------ C:\WINDOWS\system32\npdsgkdb.dll 2008-06-29 18:05:30 87040 --a------ C:\WINDOWS\system32\ktqanrdc.dll 2008-06-29 18:05:26 104448 --a------ C:\WINDOWS\system32\naddpc.dll 2008-06-29 18:05:10 104448 --a------ C:\WINDOWS\system32\yrnvkahj.dll 2008-06-29 18:04:43 95232 --a------ C:\WINDOWS\system32\nyjofoye.dll 2008-06-29 18:03:25 95232 --a------ C:\WINDOWS\system32\tyufrsrw.dll 2008-06-29 10:51:55 87040 -----n--- C:\WINDOWS\system32\lrwpnohw.dll 2008-06-29 10:51:45 104448 --a------ C:\WINDOWS\system32\uzoezr.dll 2008-06-29 10:51:27 104448 --a------ C:\WINDOWS\system32\rdvhyccy.dll 2008-06-29 10:51:05 95232 --a------ C:\WINDOWS\system32\yanuivsv.dll 2008-06-29 00:12:12 94208 --a------ C:\WINDOWS\system32\qmsaricj.dll 2008-06-29 00:10:31 86528 -----n--- C:\WINDOWS\system32\pbwdcwxk.dll 2008-06-28 19:15:02 94208 --a------ C:\WINDOWS\system32\phsvwyda.dll 2008-06-28 19:08:11 86528 --a------ C:\WINDOWS\system32\pyrbsjcm.dll 2008-06-28 19:00:30 94208 --a------ C:\WINDOWS\system32\eoosplnr.dll 2008-06-26 07:28:03 108032 --a------ C:\WINDOWS\system32\gqpuvapn.dll 2008-06-26 07:26:24 95744 --a------ C:\WINDOWS\system32\pqecfpro.dll 2008-06-25 20:51:07 108032 --a------ C:\WINDOWS\system32\vyedfvmv.dll 2008-06-25 20:48:55 94720 --a------ C:\WINDOWS\system32\vihnlcir.dll 2008-06-22 00:25:16 130560 --a------ C:\WINDOWS\system32\wgbdaywx.dll 2008-06-22 00:22:03 130560 --a------ C:\WINDOWS\system32\rhteknsn.dll 2008-06-22 00:09:21 130560 --a------ C:\WINDOWS\system32\rjyfarar.dll 2008-06-16 00:10:13 0 d-------- C:\Program Files\OnTarget 2008-06-15 23:55:35 0 d-------- C:\WINDOWS\system32\netrax18 2008-06-13 17:45:16 0 d-------- C:\WINDOWS\system32\netrax05 -- Find3M Report --------------------------------------------------------------- 2008-07-03 07:25:29 0 d-------- C:\Program Files\MaxSpeed 2008-07-03 07:25:29 0 d-a------ C:\Program Files\Common Files 2008-06-30 19:32:06 0 d-------- C:\Documents and Settings\Brian\Application Data\Aim 2008-06-01 00:40:59 0 d-------- C:\Program Files\PointBlankCRBSv18a 2008-06-01 00:36:01 225839 --a------ C:\Program Files\PointBlankCRBSv18a.zip 2008-05-15 16:26:25 0 d-------- C:\Program Files\AVG 2008-05-12 23:02:35 0 d-------- C:\Documents and Settings\Brian\Application Data\Lavasoft 2008-05-09 16:43:26 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-07 07:57:15 0 d-------- C:\Program Files\Messenger 2008-05-07 07:55:52 0 d-------- C:\Program Files\Movie Maker 2008-05-07 07:47:03 0 d-------- C:\Program Files\Windows NT -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0AFA8FED-A984-4801-B5D2-033106BC211C}] C:\WINDOWS\system32\urqOIbXO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7a07d9de-5862-4c43-a1b6-db1ae95ffceb}] 06/29/2008 06:59 PM 104448 --a------ C:\WINDOWS\system32\oamgsq.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [08/08/2000 04:00 PM] "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [08/08/2000 04:00 PM] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [09/13/2003 10:36 PM] "Propel Accelerator"="C:\Program Files\ISP50\MAXSPEED\propelac.exe" [] "dnscleaner"="C:\WINDOWS\dnscleaner.exe" [] "tibs5"="C:\WINDOWS\system32\tibs5.exe" [] "RegSvr32"="C:\WINDOWS\system32\msmsgs.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [10/22/2006 01:22 PM] "nwiz"="nwiz.exe" [10/22/2006 01:22 PM C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [10/22/2006 01:22 PM] "10020c2b"="C:\WINDOWS\system32\agfxajny.dll" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [05/15/2008 07:19 PM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [04/02/2008 09:07 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uninstal"="regsvr32 /u /s image.dll" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 08:12 PM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 10:05:26 PM] winlogin.exe [2/9/2005 12:03:13 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) "disableregistrytools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkHBRki [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Sprint DSL virtual assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Sprint DSL virtual assistant.lnk backup=C:\WINDOWS\pss\Sprint DSL virtual assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] C:\PROGRA~1\SPRINT~1\SMARTB~1\SprintDSLAlert.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\POINTER] point32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSGuard] C:\Program Files\PSGuard\PSGuard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SprintDSLSetup] F:\installs\BrdJmp\SprintDSLSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc *Newly Created Service* - KLIF *Newly Created Service* - SRESCAN *Newly Created Service* - VSMON -- End of Deckard's System Scanner: finished at 2008-07-04 19:25:00 ------------ |
|
     |
|
07-07-2008, 04:52 AM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 2,481
OS: XP
|
Re: Comp. slow with popups, Trojan win32monder
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ======== Please start the System Restore service as it is showing as being disabled. ========= P2P P2P - I see you have P2P software LimeWire 4.14.12 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. =========== Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs : Java 2 Runtime Environment, SE v1.4.2_03 J2SE Runtime Environment 5.0 Update 3 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 Java(TM) SE Runtime Environment 6 Update 1 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Leave Java(TM) 6 Update 5 installed Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here and Here =========== Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
============ Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ============ Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ============ Logs Required Report.txt C:\Combofix.txt Hijackthis Log |
|
|
|
|
07-07-2008, 07:28 PM
|
#4 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: xp sp3
|
Re: Comp. slow with popups, Trojan win32monder
First let me thank you for your help in advance, it is greatlly appreciated.
I have followed your intructions but I forgot to mention in my original post that I am getting a rundll error at startup, it says, "C:\windows\system32\agfxajny.dll The specified module could not be found" I also wondered if my new security setup looks good to you? Here are the requested logs. I will await further instructions. Thanks again. SDFix: Version 1.198 Run by Brian on Mon 07/07/2008 at 08:15 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\SYSTEM32\D2KPAX.EXE - Deleted C:\WINDOWS\SYSTEM32\IED.EXE - Deleted C:\WINDOWS\SYSTEM32\MCC.EXE - Deleted C:\WINDOWS\SYSTEM32\MINIPO~1.EXE - Deleted C:\WINDOWS\SYSTEM32\WINPRO~1.EXE - Deleted C:\WINDOWS\SYSTEM32\CDIMGDEV.DLL - Deleted C:\WINDOWS\SYSTEM32\D2KPAX.DLL - Deleted C:\WINDOWS\SYSTEM32\JAC.DLL - Deleted C:\WINDOWS\SYSTEM32\MSASMC18.DLL - Deleted C:\WINDOWS\SYSTEM32\MSXSLAB.DLL - Deleted C:\WINDOWS\SYSTEM32\SYSTEM32.DLL - Deleted C:\WINDOWS\CVCHOST.EXE - Deleted C:\WINDOWS\DL.EXE - Deleted C:\WINDOWS\DLM.EXE - Deleted C:\WINDOWS\MSSTASKS.EXE - Deleted C:\WINDOWS\MSTASKS1.EXE - Deleted C:\WINDOWS\MSTASKSS.EXE - Deleted C:\WINDOWS\MSXMIDI.EXE - Deleted C:\WINDOWS\NTLDR.EXE - Deleted C:\WINDOWS\REG33.EXE - Deleted C:\WINDOWS\ROCKY.EXE - Deleted C:\WINDOWS\SEKSDI~1.EXE - Deleted C:\WINDOWS\SEKSDI~2.EXE - Deleted C:\WINDOWS\MSSYS.COM - Deleted C:\E.EXE - Deleted C:\M.EXE - Deleted C:\MSDOS.EXE - Deleted C:\NTLDR.EXE - Deleted C:\P.EXE - Deleted C:\Q.EXE - Deleted C:\Q250204.EXE - Deleted C:\Q8276112.EXE - Deleted C:\SOUNDMX.EXE - Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe - Deleted Folder C:\WINDOWS\system32\bkEur05 - Removed Folder C:\WINDOWS\system32\netrax05 - Removed Folder C:\WINDOWS\system32\netrax18 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 20:24:44 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AIM95\\aim.exe"="C:\\Program Files\\AIM95\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:javaw" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\WINDOWS\\system32\\fxsclnt.exe"="C:\\WINDOWS\\system32\\fxsclnt.exe:*:Enabled:Microsoft Fax Console" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AIM95\\aim.exe"="C:\\Program Files\\AIM95\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Wed 9 Feb 2005 0 ..SHR --- "C:\mssys.com" Wed 9 Feb 2005 0 ..SHR --- "C:\Program Files\q330994.exe" Wed 9 Feb 2005 0 ..SHR --- "C:\WINDOWS\nem216.dll" Tue 30 May 2006 308,224 ...H. --- "C:\Program Files\MSN\txsrvc.dll" Tue 30 May 2006 302,592 ...H. --- "C:\Program Files\MSN\unicows.dll" Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Wed 9 Feb 2005 0 ..SHR --- "C:\WINDOWS\system\wmscrop.exe" Sun 29 Jun 2008 74 ..SH. --- "C:\WINDOWS\system32\ynjaxfga.tmp" Thu 23 Jun 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 29 Jul 2007 1,129 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti27A.tmp" Sun 7 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sun 22 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Mon 3 Sep 2007 27,136 ...H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Templates\~WRL0004.tmp" Mon 18 Feb 2008 27,648 ...H. --- "C:\Documents and Settings\Brian\Application Data\Microsoft\Templates\~WRL2710.tmp" Thu 23 Jun 2005 4,348 ...H. --- "C:\Documents and Settings\Brian\My Documents\My Music\License Backup\drmv1key.bak" Mon 8 May 2006 20 A..H. --- "C:\Documents and Settings\Brian\My Documents\My Music\License Backup\drmv1lic.bak" Thu 23 Jun 2005 312 A.SH. --- "C:\Documents and Settings\Brian\My Documents\My Music\License Backup\drmv2key.bak" Fri 4 Jul 2008 0 A..H. --- "C:\Program Files\MSN Apps\Updater\01.05.0000.1009\en-us\BIT4.tmp" Finished! ComboFix 08-07-05.1 - Brian 2008-07-07 21:43:39.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.241 [GMT -4:00] Running from: C:\Documents and Settings\Brian\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Brian\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM13313fb7.txt C:\WINDOWS\system32\cdrnaqtk.ini C:\WINDOWS\system32\eoosplnr.dll C:\WINDOWS\system32\gqpuvapn.dll C:\WINDOWS\system32\jyqcaa.dll C:\WINDOWS\system32\ktqanrdc.dll C:\WINDOWS\system32\kxwcdwbp.ini C:\WINDOWS\system32\lggmknwf.dll C:\WINDOWS\system32\lrwpnohw.dll C:\WINDOWS\system32\naddpc.dll C:\WINDOWS\system32\npdsgkdb.dll C:\WINDOWS\system32\nyjofoye.dll C:\WINDOWS\system32\oamgsq.dll C:\WINDOWS\system32\pbwdcwxk.dll C:\WINDOWS\system32\phsvwyda.dll C:\WINDOWS\system32\plkokbmt.ini C:\WINDOWS\system32\pqecfpro.dll C:\WINDOWS\system32\pyrbsjcm.dll C:\WINDOWS\system32\qmsaricj.dll C:\WINDOWS\system32\quenugby.dll C:\WINDOWS\system32\rdvhyccy.dll C:\WINDOWS\system32\rhteknsn.dll C:\WINDOWS\system32\rjyfarar.dll C:\WINDOWS\system32\tyufrsrw.dll C:\WINDOWS\system32\uzoezr.dll C:\WINDOWS\system32\vihnlcir.dll C:\WINDOWS\system32\vyedfvmv.dll C:\WINDOWS\system32\wgbdaywx.dll C:\WINDOWS\system32\whonpwrl.ini C:\WINDOWS\system32\yanuivsv.dll C:\WINDOWS\system32\ynjaxfga.ini C:\WINDOWS\system32\ynjaxfga.ini2 C:\WINDOWS\system32\ynjaxfga.tmp C:\WINDOWS\system32\yrnvkahj.dll C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 ))))))))))))))))))))))))))))))) . 2008-07-07 19:56 . 2008-07-07 19:56 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-04 22:44 . 2008-07-04 22:44 221,184 --a------ C:\WINDOWS\SnoopFreeUI.exe 2008-07-04 22:44 . 2008-07-04 22:44 90,112 --a------ C:\WINDOWS\system32\SnoopFreeSvc.exe 2008-07-04 22:44 . 2008-07-04 22:44 45,056 --a------ C:\WINDOWS\SnoopFreeDll.dll 2008-07-04 22:44 . 2008-07-04 22:44 9,472 --a------ C:\WINDOWS\system32\drivers\SnopFree.sys 2008-07-04 19:15 . 2008-07-04 19:15 <DIR> d-------- C:\Deckard 2008-07-04 17:38 . 2008-07-07 21:50 552,992 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-04 17:38 . 2008-07-07 21:50 6,992 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-04 17:28 . 2008-07-04 17:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-07-04 17:27 . 2008-07-04 17:34 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-07-04 17:26 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-07-04 17:26 . 2004-04-27 05:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2008-07-04 17:24 . 2008-07-04 17:24 <DIR> d-------- C:\Program Files\Zone Labs 2008-07-04 17:17 . 2008-07-07 21:34 <DIR> d-------- C:\WINDOWS\Internet Logs 2008-07-04 16:33 . 2008-07-04 16:33 <DIR> d-------- C:\VundoFix Backups 2008-07-03 00:40 . 2008-07-03 00:40 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-07-03 00:40 . 2008-07-03 07:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-01 01:12 . 2008-07-01 01:12 <DIR> d-------- C:\Documents and Settings\Brian\.housecall6.6 2008-06-30 19:14 . 2008-06-30 19:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-29 20:00 . 2008-06-29 20:00 <DIR> d-------- C:\Program Files\Alwil Software 2008-06-29 19:38 . 2008-06-29 19:38 24,234,968 --a------ C:\Program Files\avastsetupeng.exe 2008-06-29 19:30 . 2008-06-29 19:30 77 --a------ C:\WINDOWS\st_affiliate.ini 2008-06-29 19:09 . 2008-06-29 19:14 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-29 19:09 . 2008-07-07 21:42 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-29 19:08 . 2008-06-29 19:08 2,869,536 --a------ C:\Program Files\spywareblastersetup41.exe 2008-06-29 10:48 . 2008-06-29 19:55 347 --ahs---- C:\WINDOWS\system32\ikRBHkkj.ini 2008-06-29 10:01 . 2008-07-01 01:01 110,502 --a------ C:\WINDOWS\BM13313fb7.xml 2008-06-29 09:31 . 2008-07-07 20:30 <DIR> d-------- C:\SDFix 2008-06-22 02:23 . 2008-06-22 02:23 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-06-22 02:23 . 2008-06-22 02:23 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-06-16 00:10 . 2008-06-16 00:10 <DIR> d-------- C:\Program Files\OnTarget 2008-06-10 23:06 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 23:06 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-07 23:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-07 23:36 --------- d-----w C:\Program Files\Java 2008-07-03 11:25 --------- d-----w C:\Program Files\MaxSpeed 2008-06-30 23:32 --------- d-----w C:\Documents and Settings\Brian\Application Data\Aim 2008-06-29 23:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-01 04:40 --------- d-----w C:\Program Files\PointBlankCRBSv18a 2008-06-01 04:36 225,839 ----a-w C:\Program Files\PointBlankCRBSv18a.zip 2008-05-15 20:26 --------- d-----w C:\Program Files\AVG 2008-05-13 03:02 --------- d-----w C:\Documents and Settings\Brian\Application Data\Lavasoft 2008-05-09 20:43 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll 2008-04-14 00:11 39,424 ----a-w C:\WINDOWS\AppPatch\acadproc.dll 2008-04-14 00:11 376,832 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msinfo.dll 2008-04-14 00:11 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll 2008-04-14 00:11 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll 2008-04-14 00:11 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll 2008-04-14 00:11 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll 2005-04-12 02:57 36 ----a-w C:\Documents and Settings\Brian\klextlock.dat 2005-02-09 16:03 0 --sh--r C:\Program Files\q330994.exe 2004-02-16 06:58 15,228,464 ----a-w C:\Program Files\java2re-1_4_2_03-windows-i586-p.exe 2004-01-31 17:17 1,022,400 ----a-w C:\Program Files\tax act03pa.exe 2004-01-31 17:12 8,124,385 ----a-w C:\Program Files\tax act03dxdw.exe 2003-08-24 05:24 16,251,072 ----a-w C:\Program Files\AdbeRdr60_enu_full.exe 2005-02-09 16:03 0 --sh--r C:\WINDOWS\nem216.dll 2005-02-09 16:03 0 --sh--r C:\WINDOWS\system\wmscrop.exe . ((((((((((((((((((((((((((((( snapshot@2008-06-29_10.09.48.55 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-29 13:54:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-08 01:50:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-28 07:48:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-07 23:56:36 5,402,624 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat + 2008-07-07 23:56:36 180,224 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2008-06-28 07:48:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-07 23:56:26 5,402,624 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat + 2008-07-07 23:56:26 180,224 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\system32\aswBoot.exe + 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr + 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys + 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys + 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys + 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys + 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys + 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys + 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys + 2007-07-19 20:10:28 127,768 ----a-w C:\WINDOWS\system32\drivers\klif.sys + 2008-04-03 01:07:36 796,048 ----a-w C:\WINDOWS\system32\libeay32_0.9.6l.dll + 2008-04-03 01:07:40 83,432 ----a-w C:\WINDOWS\system32\vsdata.dll + 2008-04-03 01:08:00 394,952 ----a-w C:\WINDOWS\system32\vsdatant.sys + 2008-04-03 01:07:40 157,160 ----a-w C:\WINDOWS\system32\vsinit.dll + 2008-04-03 01:07:40 103,912 ----a-w C:\WINDOWS\system32\vsmonapi.dll + 2008-04-03 01:07:40 275,944 ----a-w C:\WINDOWS\system32\vspubapi.dll + 2008-04-03 01:07:42 71,144 ----a-w C:\WINDOWS\system32\vsregexp.dll + 2008-04-03 01:07:42 472,552 ----a-w C:\WINDOWS\system32\vsutil.dll + 2008-04-03 01:07:42 46,568 ----a-w C:\WINDOWS\system32\vswmi.dll + 2008-04-03 01:07:42 99,816 ----a-w C:\WINDOWS\system32\vsxml.dll + 2008-04-03 01:07:44 83,432 ----a-w C:\WINDOWS\system32\zlcomm.dll + 2008-04-03 01:07:44 71,144 ----a-w C:\WINDOWS\system32\zlcommdb.dll + 2008-04-03 01:07:32 370,208 ----a-w C:\WINDOWS\system32\ZoneLabs\av.dll + 2007-05-31 05:03:30 65,248 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\aphish.dat + 2006-06-30 19:47:36 21,568 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\avcmhk4.dll + 2007-05-31 05:03:30 1,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\pdmkl.dat + 2007-05-31 05:03:16 77,824 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHComm.dll + 2007-05-31 05:03:16 110,592 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHrule.dll + 2007-05-31 05:03:16 331,776 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHUM.dll + 2007-05-31 05:03:16 38,400 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\FSSync.dll + 2006-09-20 04:12:14 208,960 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\inv.dll + 2007-12-03 19:53:58 282,624 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\kave.dll + 2006-12-19 23:13:52 1,093,632 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll + 2007-05-31 05:03:20 548,864 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcp80.dll + 2007-05-31 05:03:20 626,688 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcr80.dll + 2007-05-31 05:03:18 184,320 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prloader.dll + 2007-05-31 05:03:22 90,112 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prremote.dll + 2007-12-03 19:53:58 139,264 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe + 2006-12-19 23:13:52 200,704 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ssleay32.dll + 2008-04-03 01:07:32 99,816 ----a-w C:\WINDOWS\system32\ZoneLabs\camupd.dll + 2004-01-30 17:35:08 813,568 ----a-w C:\WINDOWS\system32\ZoneLabs\dbghelp.dll + 2008-04-03 01:07:34 128,480 ----a-w C:\WINDOWS\system32\ZoneLabs\fbl.dll + 2008-04-03 01:07:34 38,376 ----a-w C:\WINDOWS\system32\ZoneLabs\featuremap.dll + 2008-04-03 01:07:34 321,016 ----a-w C:\WINDOWS\system32\ZoneLabs\imsecure.dll + 2008-04-03 01:08:02 288,144 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\ConfigWizard.zip.dll + 2008-07-04 22:01:29 152,976 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\licenseui.zip.dll + 2008-04-03 01:08:02 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zlsvc.zip.dll + 2008-04-03 01:08:02 1,361,296 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zpy.zip.dll + 2008-04-03 01:08:02 71,056 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zui.zip.dll + 2008-04-03 01:09:10 30,184 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll + 2008-04-03 01:09:12 30,216 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll + 2008-02-27 08:10:26 714,208 ----a-w C:\WINDOWS\system32\ZoneLabs\qrbase.dll + 2008-02-27 08:10:28 792,032 ----a-w C:\WINDOWS\system32\ZoneLabs\qrsrecl.dll + 2008-04-03 01:07:38 173,544 ----a-w C:\WINDOWS\system32\ZoneLabs\scheduler.dll + 2008-01-21 13:34:36 7,603,688 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat + 2008-02-27 08:10:32 1,504,736 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.dll + 2008-02-27 08:10:44 51,176 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.sys + 2008-04-03 01:07:38 456,168 ----a-w C:\WINDOWS\system32\ZoneLabs\ssleay32.dll + 2008-04-03 01:09:12 214,528 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll + 2008-04-03 01:09:14 3,266,040 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp.dll + 2006-09-05 01:59:14 503,875 ----a-w C:\WINDOWS\system32\ZoneLabs\upd_core.dll + 2007-10-11 21:50:32 832,984 ----a-w C:\WINDOWS\system32\ZoneLabs\updating.dll + 2008-04-03 01:07:54 144,936 ----a-w C:\WINDOWS\system32\ZoneLabs\updclient.exe + 2007-01-11 22:31:06 286,787 ----a-w C:\WINDOWS\system32\ZoneLabs\updtrsdk.dll + 2008-04-03 01:07:40 108,008 ----a-w C:\WINDOWS\system32\ZoneLabs\vsavpro.dll + 2008-04-03 01:07:40 83,432 ----a-w C:\WINDOWS\system32\ZoneLabs\vsdb.dll + 2008-04-03 01:07:54 75,304 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmon.exe + 2008-04-03 01:07:40 2,029,032 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmondll.dll + 2008-04-03 01:07:42 1,361,384 ----a-w C:\WINDOWS\system32\ZoneLabs\vsruledb.dll + 2008-04-03 01:07:42 239,080 ----a-w C:\WINDOWS\system32\ZoneLabs\vsvault.dll + 2008-01-21 13:34:36 7,603,688 ----a-w C:\WINDOWS\system32\ZoneLabs\zlasdbup.dat + 2008-04-03 01:07:44 177,640 ----a-w C:\WINDOWS\system32\ZoneLabs\zlparser.dll + 2008-04-03 01:07:44 79,344 ----a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll + 2008-04-03 01:07:46 382,440 ----a-w C:\WINDOWS\system32\ZoneLabs\zlsre.dll + 2008-04-03 01:07:46 120,296 ----a-w C:\WINDOWS\system32\ZoneLabs\zlupdate.dll + 2008-04-03 01:07:50 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll + 2008-07-08 01:51:03 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5fc.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SnoopFreeUI"="SnoopFreeUI.exe" [2008-07-04 22:44 221184 C:\WINDOWS\SnoopFreeUI.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk.disabled [2007-08-21 00:13:34 1763] Kodak EasyShare software.lnk.disabled [2004-08-12 13:28:20 1813] Kodak software updater.lnk.disabled [2004-09-02 09:54:36 2014] Microsoft Office.lnk.disabled [2003-03-03 13:35:08 1731] Microsoft Works Calendar Reminders.lnk.disabled [2003-03-03 13:42:41 875] Sprint DSL virtual assistant.lnk.disabled [2005-06-30 15:54:28 1822] HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart "uninstal"=regsvr32 /u /s image.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Propel Accelerator"=C:\Program Files\ISP50\MAXSPEED\propelac.exe "WinampAgent"=C:\Program Files\Winamp\winampa.exe "SprintDSLSetup"=F:\installs\BrdJmp\SprintDSLSetup.exe "PSGuard"=C:\Program Files\PSGuard\PSGuard.exe "POINTER"=point32.exe "msnappau"="C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" "dnscleaner"=C:\WINDOWS\dnscleaner.exe "Microsoft Works Portfolio"=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup "NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit "RegSvr32"=C:\WINDOWS\system32\msmsgs.exe "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" "tibs5"=C:\WINDOWS\system32\tibs5.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\WINDOWS\\system32\\javaw.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\WINDOWS\\system32\\fxsclnt.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 19:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 19:16] R3 USB-100;Prestige USB Adapter;C:\WINDOWS\system32\DRIVERS\USB150.SYS [2004-08-25 12:48] . Contents of the 'Scheduled Tasks' folder "2008-06-15 01:11:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . - - - - ORPHANS REMOVED - - - - BHO-{0AFA8FED-A984-4801-B5D2-033106BC211C} - C:\WINDOWS\system32\urqOIbXO.dll WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file) HKLM-Run-10020c2b - C:\WINDOWS\system32\agfxajny.dll MSConfigStartUp-CTFMON - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 21:57:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\SnoopFreeDll.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\SnoopFreeSvc.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-07-07 22:04:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-08 02:04:06 ComboFix2.txt 2008-06-29 14:11:33 Pre-Run: 3,769,188,352 bytes free Post-Run: 3,740,516,352 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 318 --- E O F --- 2008-06-30 02:29:29 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:08:19 PM, on 7/7/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\SnoopFreeSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\SnoopFreeUI.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.bestwebslinks.com/search.php?qq=%1 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://walnutbottom.ltbx.net/community/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;localhost;<local> O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing) O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file) O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled O4 - Global Startup: Kodak EasyShare software.lnk.disabled O4 - Global Startup: Kodak software updater.lnk.disabled O4 - Global Startup: Microsoft Office.lnk.disabled O4 - Global Startup: Microsoft Works Calendar Reminders.lnk.disabled O4 - Global Startup: Sprint DSL virtual assistant.lnk.disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-12.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093620656929 O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 7607 bytes |
|
|
|
|
07-08-2008, 04:44 AM
|
#5 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 2,481
OS: XP
|
Re: Comp. slow with popups, Trojan win32monder
Hello again
Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly =========== S& D Spybot's Tea Timer While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
============= Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ============= JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
============== Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ============ Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
Animated Tutorial Here To optimize scanning time and produce a more sensible report for review:
=========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. =========== Logs Required C:\Combofix.txt Kaspersky Scan Report Hijackthis Log How is your system running now. |
![[SOLVED] Comp. slow with popups, Trojan win32monder](http://www.techsupportforum.com/cwd/iconimages/resolved-hjt-threads/solved-comp-slow-popups-trojan-win32monder.gif)
