|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
|
|
LinkBack | Thread Tools |
08-24-2008, 08:09 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2005
Location: Utah
Posts: 45
OS: Windows XP SP3
 |
trojan 135.exe attacking windows explorer
Hello, I have a laptop running Windows XP Home with service pack 3. When I try to open a file from windows explorer it sometimes doesn't respond. I have to right click and use the "open" function. I decided to scan for viruses.
Panda found the following: ANALYSIS: 2008-08-24 19:01:01 PROTECTIONS: 1 MALWARE: 50 SUSPECTS: 0 PROTECTIONS Description Version Active Updated Windows Defender 1.1.3704.0 No No MALWARE Id Description Type Active Severity Disinfectable Disinfected Location 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@trafficmp[3].txt 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@trafficmp[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@casalemedia[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@casalemedia[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@doubleclick[3].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@atdmt[3].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@atdmt[1].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@247realmedia[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@fastclick[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@tribalfusion[2].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@tribalfusion[3].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@mediaplex[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@mediaplex[1].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@mediaplex[4].txt 00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@linksynergy[2].txt 00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@linksynergy[3].txt 00145869 Cookie/SpyLog TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@spylog[1].txt 00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@revenue[1].txt 00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@www.myaffiliateprogram[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@com[1].txt 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@yadro[1].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@xiti[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@statcounter[2].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@statcounter[1].txt 00167760 Cookie/Hitslink TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@counter.hitslink[1].txt 00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@perf.overture[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ad.yieldmanager[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ad.yieldmanager[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@apmebf[2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@apmebf[3].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@burstnet[3].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@burstnet[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@serving-sys[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@serving-sys[3].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@bs.serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@bs.serving-sys[3].txt 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@www.burstbeacon[1].txt 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@www.burstbeacon[2].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@adtech[1].txt 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@server.iad.liveperson[4].txt 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@server.iad.liveperson[2].txt 00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@stat.onestat[2].txt 00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@stat.onestat[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@advertising[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@advertising[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@media.adrevolver[3].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@media.adrevolver[4].txt 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@statse.webtrendslive[1].txt 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@statse.webtrendslive[2].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ads.pointroll[4].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ads.pointroll[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ads.pointroll[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@overture[3].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@overture[2].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@realmedia[2].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@realmedia[3].txt 00171633 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@www5.addfreestats[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@questionmarket[1].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@questionmarket[3].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@zedo[2].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@zedo[1].txt 00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@bluestreak[2].txt 00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@bluestreak[1].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@adrevolver[3].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@adrevolver[1].txt 00187950 Cookie/bravenetA TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@bravenet[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@go[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@go[3].txt 00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@searchportal.information[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@target[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@target[3].txt 00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@did-it[2].txt 00216065 Cookie/Screensavers TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@i.screensavers[1].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@atwola[2].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@atwola[3].txt 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@smartadserver[1].txt 00286739 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ehg-dig.hitbox[2].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@ads.addynamix[1].txt 00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@citi.bridgetrack[1].txt 00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Rochelle\Cookies\rochelle@citi.bridgetrack[2].txt 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\WINDOWS\SYSTEM32\_135.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\Program Files\Common Files\Microsoft Shared\MSInfo\135.exe 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP843\A0051677.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP845\A0051845.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP848\A0051942.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP804\A0050472.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP810\A0050543.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP815\A0050639.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP815\A0050647.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP815\A0050657.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP818\A0050772.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP829\A0051243.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP838\A0051604.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP850\A0055607.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP852\A0055659.EXE 02886068 W32/Lineage.GRI.worm Virus/Trojan No 1 Yes No C:\135.EXE And here is my HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:00:44 PM, on 8/24/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\calc.exe C:\program files\internet explorer\IEXPLORE.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\WINDOWS\system32\sistray.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Rochelle\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/yco...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by117fd.bay117.hotmail.msn.co...x/HMAtchmt.ocx O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Windows_system2007_a11101 - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\135.exe -- End of file - 11624 bytes I have also seen the file 135.exe on my flash drives. When we get my computer clean, I need a way to clean those too, without transferring the file back to my computer, if you know what I mean... Much thanks, Rochelle |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-27-2008, 12:43 PM
|
#2 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Hi Rochelle
Thank you for your patience. I will be helping you deal with the issues raised in your log from this point onwards Before we start jumping into things, here is a quick basic note which I mention to everyone. The fix which I have provided for you is for this computer only, it should not be used on any other computer. Each fix is tailor made for the specific task in hand. If for some reason you have system restore disabled, then please re-enable it before proceeding, an infected restore is better than none. Please read through the fix first and set enough time aside to complete the task in one session. If there is anything you feel needs clarification then please ask - do not guess! Thanks. If this is a computer from a work place then please advise your IT department of the concerning issues before commencing past this point. Please follow these directions in the order they are set out for you. I do not see any anti virus detection software present on your computer. Without a resident virus checker you are leaving yourself wide open to infection, this in turn would render the fix useless. Before proceeding further, please download, install and update an anti virus solution. A good free anti virus software to start with is AntiVirŪ -> Only proceed with the rest fo the fix once you have installed a resident virus checker Next.... Please scan with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. ** Please note: If you are using Windows XP Service Pack 3 (SP3), then select the Service Pack 2 download. If you are using Windows XP Media Center, then you should select the Windows XP Pro Service Pack 2** Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows:
Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log.
__________________
If we have helped you then please consider donating  Proud Member of ASAP & UNITE Since 2007 |
|
|
|
|
08-27-2008, 02:30 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2005
Location: Utah
Posts: 45
OS: Windows XP SP3
|
Re: trojan 135.exe attacking windows explorer
Thank you for responding but I am not as patient as you assumed...I reinstalled Windows XP and the computer should be happy now. I learned my lesson too. I installed SpywareBlaster, and so far I'm happy with it because I don't know it's there and it doesn't slow anything down.
I think that I was able to remove the virus from my flash drives by simply deleting the executable file I could see. When I scan them for viruses, nothing is found. If I am mistaken, I welcome your suggestions. |
|
|
|
|
08-27-2008, 09:57 PM
|
#4 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Hi there thank you for letting me know the current situation
However please be aware that although spyware blaster is a good tool it does not act as an anti virus, if you have not installed an AV then I would advise that install one now. Staying clear of infections... Make your Internet Explorer more secure - This can be done by following these simple instructions: Open Internet Explorer, click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialise and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. Safer Browsing Use software such as Trendprotect or Sitehound to help you stay away from unsuspecting sites that have malicious purposes. Use Spywareblaster to help prevent the installation of unwanted BHO's (Browser Helper Objects) Use an alternative browser Other browsers tend to be more secure than IE as they do not make use of active x objects, active x objects can be used by spyware as an infection point on your computer. Safer non active x browsers include Opera browser and, more recently, Firefox browser. Computer Maintenance Malware can breed in temporary locations. Use a program such as ccleaner slim to clear out temporary files your computer on a regular basis. Scan your computer regularly for malware Scan on a regular basis to keep your computer clean, free software such as Spybot's Search & Destroy and Adaware 2007 Free by Lavasoft can help you keep clear. These products are scan on demand and do not have active back ground scanning. These two products can be installed together without any complications. Other alternative software that runs under licience and monitors your computer continuously in the background for malware is Malwarebytes Anti-Malware (MBAM) - Please note that this product can also be run as free without a licience but the background protection will not be active. I have included some security related articles that I advise you read through in your own time. These articles will give you tips and advice on preveting malware, and how to stay safe whilst browsing the internet. -> So How Did I Get Infected In First Place - By TonyKlein -> How to prevent Malware - By miekiemoes -> I'm not pulling your leg, honest - By Sandi Hardmeie Good luck and happy surfing
__________________
If we have helped you then please consider donating Proud Member of ASAP & UNITE Since 2007 |
|
|
|
|
09-08-2008, 09:49 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2005
Location: Utah
Posts: 45
OS: Windows XP SP3
|
Re: trojan 135.exe attacking windows explorer
dear sjb007,
The virus has returned. I loaded AntiVir, and the program keeps finding traces in my system volume files. I have followed your instructions and run ComboFix. Logs are attached. Thank you Rochelle |
|
|
|
|
09-09-2008, 10:13 AM
|
#6 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Howdy there Rochelle
Sorry to hear the infection returned.... Please download Flash Disinfector by sUBs. Hold down the Shift key and insert your thumbdrive. Double click on Flash_Disinfector.exe to run it. Once done, you will be prompted. Click OK. Repeat this step if you have more than one thumbdrives. Once done... Go to start menu - Select Run and in the command box type in notepad Next - copy/paste the text in the code box below into it: Code:
File::
C:\Program Files\Common Files\Microsoft Shared\MSINFO\135.exe
Driver::
Windows_system2007_a11101
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3732a958-72fc-11dd-8c8f-00c09fb4cd61}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ee61cc-76f1-11dd-8c95-0014a41c825b}]
- Drag the CFScript.txt over onto Combofix.exe and release.  Combofix will then execute the script and produce a fresh log, save and post this back in your next reply Next steps.... Download and scan with CCleaner lite 1.Double click the file and install ccleaner 2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours" 3. Then select the items you wish to clean up. In the Windows Tab:
5. A pop up box will appear advising this process will permanently delete files from your system. 6. Click "OK" and it will scan and clean your system. 7. Click "exit" when done. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner. Click Accept, when prompted to download and install the program files and database of malware definitions.
This animation will guide you through the process:  **Note** To optimize scanning time and produce a more sensible report for review: Close any open programs Turn off the real time scanner of any existing antivirus program while performing the online scan. You may disconnect from the internet once you begin the scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. Please ensure that you include in your next reply: The combofix log The log from Kaspersky A fresh HJT log Update me on how things are.. NB: Please copy and paste logs straight into your reply rather than add as attachments, this makes it easier for analysis - Thanks
__________________
If we have helped you then please consider donating Proud Member of ASAP & UNITE Since 2007 |
|
|
|
|
09-09-2008, 08:19 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2005
Location: Utah
Posts: 45
OS: Windows XP SP3
|
Re: trojan 135.exe attacking windows explorer
Hello sjb007,
Thank you so much for your help. I hope that now I am clean. ComboFix 08-09-05.09 - RLM 2008-09-09 18:29:19.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.191 [GMT -6:00] Running from: C:\Documents and Settings\RLM\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\RLM\Desktop\CFScript.txt * Created a new restore point . Other Deletions . E:\Autorun.inf . Drivers/Services . -------\Legacy_WINDOWS_SYSTEM2007_A11101 -------\Service_Windows_system2007_a11101 Files Created from 2008-08-10 to 2008-09-10 . 2008-09-08 21:36 . 2008-09-08 21:36 <DIR> d-------- C:\Documents and Settings\RLM\Application Data\AdobeUM 2008-09-08 09:46 . 2008-09-08 09:46 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-07 14:30 . 2008-09-07 14:30 <DIR> d-------- C:\Program Files\iPod 2008-09-07 14:30 . 2008-09-07 14:30 <DIR> d-------- C:\Documents and Settings\RLM\Application Data\Apple Computer 2008-09-07 14:29 . 2008-09-07 14:30 <DIR> d-------- C:\Program Files\iTunes 2008-09-07 14:29 . 2008-09-07 14:29 <DIR> d-------- C:\Program Files\Bonjour 2008-09-07 14:28 . 2008-09-07 14:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-07 14:27 . 2008-09-07 14:27 <DIR> d-------- C:\Program Files\Apple Software Update 2008-09-07 14:26 . 2008-09-07 14:26 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-09-07 14:26 . 2008-09-07 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-09-07 13:03 . 2008-09-07 14:29 <DIR> d-------- C:\Program Files\QuickTime 2008-09-05 18:22 . 2008-09-05 18:22 <DIR> d-------- C:\Program Files\Avira 2008-09-05 18:22 . 2008-09-05 18:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-09-03 21:11 . 2008-04-13 18:12 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-09-03 21:11 . 2008-04-13 12:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-09-03 21:11 . 2008-04-13 12:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-09-03 21:11 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-09-03 18:55 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll 2008-09-03 18:55 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll 2008-09-03 18:55 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll 2008-09-03 18:55 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll 2008-09-03 18:55 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll 2008-09-03 18:55 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll 2008-09-03 18:55 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll 2008-09-03 18:55 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll 2008-09-03 18:30 . 2008-09-03 18:30 <DIR> d-------- C:\Program Files\Hp 2008-08-31 21:23 . 2008-08-31 21:23 <DIR> d-------- C:\Program Files\Netflix 2008-08-31 16:38 . 2008-09-08 08:54 <DIR> d-------- C:\Program Files\CleanUp! 2008-08-30 12:46 . 2008-08-30 12:46 169 --a------ C:\WINDOWS\RtlRack.ini 2008-08-30 12:38 . 2008-08-30 12:38 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-08-30 12:38 . 2008-08-30 12:38 <DIR> d-------- C:\Program Files\AvRack 2008-08-30 12:38 . 2001-07-05 10:19 164 --------- C:\WINDOWS\avrack.ini 2008-08-30 12:37 . 2008-08-30 12:37 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-08-30 12:36 . 2008-08-30 12:36 <DIR> d-------- C:\Program Files\Synaptics 2008-08-30 12:36 . 2004-10-08 00:33 185,824 --a------ C:\WINDOWS\system32\drivers\SynTP.sys 2008-08-30 12:36 . 2004-10-08 00:36 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll 2008-08-30 12:36 . 2004-10-08 00:36 90,202 --a------ C:\WINDOWS\system32\SynTPAPI.dll 2008-08-30 12:36 . 2004-10-08 00:46 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll 2008-08-30 12:36 . 2004-10-08 00:35 77,917 --a------ C:\WINDOWS\system32\SynCOM.dll 2008-08-30 12:36 . 2004-10-08 00:44 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll 2008-08-30 05:27 . 2008-08-30 05:27 <DIR> d-------- C:\Documents and Settings\RLM\Application Data\Leadertech 2008-08-30 05:04 . 2008-08-30 05:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HotSync 2008-08-30 05:04 . 2008-08-30 05:02 53,248 --a------ C:\WINDOWS\PalmDevC.dll 2008-08-30 05:03 . 2008-08-30 05:27 <DIR> d-------- C:\Program Files\palmOne 2008-08-30 05:02 . 2008-09-03 18:29 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-08-30 05:02 . 2008-08-30 05:02 <DIR> d-------- C:\Documents and Settings\RLM\Application Data\HotSync 2008-08-27 17:22 . 2008-08-30 18:13 395 --a------ C:\WINDOWS\system\CMCNFG2.INI 2008-08-27 06:55 . 2008-08-27 06:55 <DIR> d-------- C:\Program Files\Windows Defender 2008-08-26 19:58 . 2008-08-26 19:58 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-26 19:56 . 2008-09-08 18:03 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-26 19:48 . 2008-08-27 06:43 <DIR> d-------- C:\Program Files\NOS 2008-08-26 19:48 . 2008-08-27 06:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS 2008-08-26 19:02 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll 2008-08-26 19:02 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll 2008-08-26 19:02 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-08-25 20:47 . 2008-08-25 20:47 <DIR> d-------- C:\Documents and Settings\RLM\Contacts 2008-08-25 20:46 . 2008-09-07 14:27 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-25 20:32 . 2008-08-25 20:54 <DIR> d-------- C:\Program Files\Windows Live 2008-08-25 20:32 . 2008-08-25 20:43 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-25 20:31 . 2008-08-25 20:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-25 20:00 . 2008-08-25 20:26 <DIR> d-------- C:\Documents and Settings\RLM\Application Data\OfficeUpdate12 2008-08-25 19:58 . 2008-08-25 19:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-08-25 19:57 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-08-25 19:57 . 2008-08-25 19:57 376 --a------ C:\WINDOWS\ODBC.INI 2008-08-25 19:56 . 2008-08-25 19:56 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-08-25 19:56 . 2008-08-25 19:56 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-08-25 19:51 . 2008-08-25 19:51 <DIR> dr-h----- C:\MSOCache 2008-08-25 17:35 . 2008-08-25 17:42 <DIR> d-------- C:\Program Files\Microsoft Money 2005 2008-08-25 17:28 . 2008-08-30 05:02 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-08-25 17:27 . 2004-12-21 11:32 369,024 --------- C:\WINDOWS\system32\drivers\BCMWL5.SYS 2008-08-25 17:23 . 2008-08-30 12:37 6 --a------ C:\ISACER.ID 2008-08-25 17:18 . 2008-04-13 13:19 146,048 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2008-08-25 12:42 . 2008-08-25 12:43 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-25 12:42 . 2008-08-25 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-25 12:42 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX 2008-08-25 12:42 . 2005-08-25 19:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-08-25 12:13 . 2008-08-25 12:13 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-08-25 12:12 . 2008-08-25 12:12 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-25 12:12 . 2008-08-25 12:12 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-08-25 12:11 . 2008-07-22 08:45 1,214,526 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-08-25 12:11 . 2008-07-22 08:45 790,846 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-08-25 12:11 . 2008-07-22 08:45 9,696 -----c--- C:\WINDOWS\system32\dllcache\drvmain.sdb 2008-08-25 11:46 . 2008-08-25 11:46 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-25 11:46 . 2008-08-25 11:46 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-25 11:46 . 2008-08-25 11:46 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-25 11:29 . 2006-10-18 21:47 991,744 -----c--- C:\WINDOWS\system32\dllcache\drmv2clt.dll 2008-08-25 11:28 . 2008-04-13 18:11 233,472 --------- C:\WINDOWS\system32\azroles.dll 2008-08-25 11:28 . 2008-04-13 18:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll 2008-08-25 11:28 . 2006-10-18 21:47 7,168 -----c--- C:\WINDOWS\system32\dllcache\asferror.dll 2008-08-25 11:22 . 2008-06-13 05:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-25 11:14 . 2008-05-01 08:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-25 11:14 . 2008-05-08 08:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-08-25 10:59 . 2008-08-25 11:54 316,640 --a------ C:\WINDOWS\WMSysPr9.prx 2008-08-25 10:58 . 2008-08-25 10:58 <DIR> d-------- C:\WINDOWS\provisioning 2008-08-25 10:58 . 2008-08-25 11:46 <DIR> d-------- C:\WINDOWS\peernet 2008-08-25 10:56 . 2008-08-25 10:56 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-25 10:49 . 2008-08-25 11:35 <DIR> d-------- C:\WINDOWS\EHome 2008-08-25 10:45 . 2002-04-15 21:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img 2008-08-25 10:45 . 2008-04-14 05:42 11,264 --------- C:\WINDOWS\system32\spnpinst.exe 2008-08-25 10:45 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig 2008-08-25 10:45 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat 2008-08-25 10:33 . 2008-08-25 10:33 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2008-08-25 10:33 . 2008-08-26 22:44 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-08-25 10:33 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-08-25 10:32 . 2008-08-25 11:46 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-25 10:31 . 2008-04-13 11:39 438,784 --------- C:\WINDOWS\system32\xpob2res.dll 2008-08-25 10:31 . 2008-04-13 18:12 354,304 --a------ C:\WINDOWS\system32\winhttp.dll 2008-08-25 10:31 . 2008-04-13 18:12 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2008-08-25 10:31 . 2008-04-13 18:11 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll 2008-08-25 10:31 . 2008-04-13 18:11 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll 2008-08-25 10:13 . 2008-09-08 21:37 <DIR> d--hs---- C:\WINDOWS\Installer 2008-08-25 10:12 . 2008-09-09 18:15 <DIR> d-------- C:\Documents and Settings\RLM 2008-08-25 10:10 . 2008-08-25 10:10 13,688 --a------ C:\WINDOWS\system32\wpa.bak 2008-08-25 10:07 . 2008-08-25 10:07 <DIR> d--hs---- C:\Documents and Settings\NetworkService 2008-08-25 10:07 . 2008-08-25 11:05 <DIR> d--hs---- C:\Documents and Settings\LocalService 2008-08-25 10:06 . 2008-08-25 10:06 8,192 --a------ C:\WINDOWS\REGLOCS.OLD 2008-08-25 10:04 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\EXCH_regtrace.exe 2008-08-25 10:04 . 2003-03-31 06:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\quser.exe 2008-08-25 10:04 . 2003-03-31 06:00 14,848 --a--c--- C:\WINDOWS\system32\dllcache\register.exe 2008-08-25 10:02 . 2003-03-31 06:00 131,584 --a--c--- C:\WINDOWS\system32\dllcache\pmxviceo.dll 2008-08-25 10:02 . 2003-03-31 06:00 11,264 --a--c--- C:\WINDOWS\system32\dllcache\pmxmcro.dll 2008-08-25 10:02 . 2003-03-31 06:00 9,728 --a--c--- C:\WINDOWS\system32\dllcache\query.exe 2008-08-25 10:02 . 2003-03-31 06:00 6,144 --a--c--- C:\WINDOWS\system32\dllcache\pmxgl.dll . Find3M Report . 2008-08-30 11:02 16,694 ----a-w C:\WINDOWS\system32\drivers\PalmUSBD.sys 2008-08-25 23:29 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-08-25 15:36 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-21 18:52 524,288 ----a-w C:\WINDOWS\opuc.dll 2008-07-19 04:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 04:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 04:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 04:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 04:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 04:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 04:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 04:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-27 13:19 1,571,001 ----a-w C:\WINDOWS\system32\sisgl.dll 2008-06-27 13:02 3,467,264 ----a-w C:\WINDOWS\system32\sisgrv.dll 2008-06-27 12:54 9,728 ----a-w C:\WINDOWS\system32\SiSPIns2.dll 2008-06-27 12:53 49,152 ----a-w C:\WINDOWS\system32\SiSBase.dll 2008-06-27 12:53 258,048 ----a-w C:\WINDOWS\system32\SiSParse.dll 2008-06-27 12:53 172,032 ----a-w C:\WINDOWS\system32\SiSInst.dll 2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll . snapshot@2008-09-08_ 9.37.01.54 . + 2005-10-21 02:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . Reg Loading Points. . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-07 413696] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "SoundMan"="SOUNDMAN.EXE" [2005-02-23 C:\WINDOWS\SOUNDMAN.EXE] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193] HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 471040] [HKLM\~\startupfolder\C:^Documents and Settings^RLM^Start Menu^Programs^Startup^palmOne Registration.lnk] path=C:\Documents and Settings\RLM\Start Menu\Programs\Startup\palmOne Registration.lnk backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= R3 cmuda2;C-Media USB Audio Interface;C:\WINDOWS\system32\drivers\cmuda2.sys [2004-01-06 705536] . Contents of the 'Scheduled Tasks' folder . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-09 18:34:35 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\WLTRYSVC.EXE C:\WINDOWS\system32\BCMWLTRY.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\WLTRAY.EXE C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-09-09 18:38:06 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-10 00:38:00 ComboFix2.txt 2008-09-08 15:37:25 Pre-Run: 25,750,130,688 bytes free Post-Run: 25,694,490,624 bytes free 235 --- E O F --- 2008-09-05 23:54:24 Forgot to save the Kaspersky log, but it didn't find any threats. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:07:09 PM, on 09/09/08 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\palmOne\Hotsync.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite....x/qtplugin.cab O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1219680942680 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1219841271531 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7660 bytes |
|
|
|
|
09-10-2008, 01:26 PM
|
#8 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Howdy there
Things are looking better from here. let me know how things are running now. Please download Malwarebytes Anti-Malware (MBAM) and save it to your desktop. alternate download link 1 alternate download link 2
Post back with the resulting log and an update on how things are
__________________
If we have helped you then please consider donating Proud Member of ASAP & UNITE Since 2007 |
|
|
|
|
09-10-2008, 06:55 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2005
Location: Utah
Posts: 45
OS: Windows XP SP3
|
Re: trojan 135.exe attacking windows explorer
Hello sjb007,
All looks good, and it seems to be functioning really well too. Thank you! Malwarebytes' Anti-Malware 1.28 Database version: 1137 Windows 5.1.2600 Service Pack 3 09/10/08 6:52:55 PM mbam-log-2008-09-10 (18-52-55).txt Scan type: Quick Scan Objects scanned: 40536 Time elapsed: 4 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) |
|
|
|
|
09-10-2008, 10:08 PM
|
#10 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Great work Rochelle
Your logs are looking clear. Lets tidy up after ourselves Go start menu select run (vista users press windows key & r) to bring up the run dialog. In the command line type in combofix /u - Note the space between combofix & /u) This will clear out the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Now that you appear to be free from malware lets help you stay that way! Update windows on a regular basis - If you do not have automatic updates enabled then Visit Microsoft's Update Page and update your computer from there Update your virus checker on a regular basis - It is no use having a virus checker with out of date definitions. Keep an eye on your firewall. check what it wants to allow, do not simply allow everything, If there is any processes that you are unsure of then dont be afraid to ask for advice. For more information on firewalls read this article here Make your Internet Explorer more secure - This can be done by following these simple instructions: Open Internet Explorer, click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialise and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. Safer Browsing Use software such as Trendprotect or Sitehound to help you stay away from unsuspecting sites that have malicious purposes. Use Spywareblaster to help prevent the installation of unwanted BHO's (Browser Helper Objects) Use an alternative browser Other browsers tend to be more secure than IE as they do not make use of active x objects, active x objects can be used by spyware as an infection point on your computer. Safer non active x browsers include Opera browser and, more recently, Firefox browser. Computer Maintenance Malware can breed in temporary locations. Use a program such as ccleaner slim to clear out temporary files your computer on a regular basis. Scan your computer regularly for malware Scan on a regular basis to keep your computer clean, free software such as Spybot's Search & Destroy and Adaware 2007 Free by Lavasoft can help you keep clear. These products are scan on demand and do not have active back ground scanning. These two products can be installed together without any complications. Other alternative software that runs under licience and monitors your computer continuously in the background for malware is Malwarebytes Anti-Malware (MBAM) - Please note that this product can also be run as free without a licience but the background protection will not be active. I have included some security related articles that I advise you read through in your own time. These articles will give you tips and advice on preveting malware, and how to stay safe whilst browsing the internet. -> So How Did I Get Infected In First Place - By TonyKlein -> How to prevent Malware - By miekiemoes -> I'm not pulling your leg, honest - By Sandi Hardmeie **Kindly respond one more time and let me know if we may consider this thread resolved.
__________________
If we have helped you then please consider donating Proud Member of ASAP & UNITE Since 2007 |
|
|
|
|
09-11-2008, 08:26 AM
|
#12 (permalink) |
|
Analyst, Security Team
|
Re: trojan 135.exe attacking windows explorer
Only too glad to help...
I will now stop monitoring this thread for replies. Good luck and happy surfin Rochelle 
__________________
If we have helped you then please consider donating Proud Member of ASAP & UNITE Since 2007 |
|
|
|
| Thread Tools | |
|
|
