|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-12-2006, 07:58 AM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 17
OS: winXP
|
***hjt Log Help!!!***
Hi guys,
Hope you can help me. I keep getting this annoying popups after I ran a file I downloaded using Limewire. My Norton-AntiVirus detected the Trojan and deleted it but the popups still occur. Plus I think it disabled the Ctrl-Alt-Del function. Attached is my HJT log. Hope to hear from you soon. Thanks in advance! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-12-2006, 12:23 PM
|
#2 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,489
OS: N/A
|
Quote:
Grab a new copy from here 1. Double-click on the file you just downloaded. 2. Click on the "Unzip" button to install the newer version. 3. It will by default install to the directory - C:\Program Files\HiJackThis\ 4. If it gives you an intro screen, just choose - Do a system scan and save a logfile. 5. If you don't get the intro screen, just hit [Scan] and then click on Save log. 6. Post & NOT attach the HiJackThis.log file
__________________
Question - what have you done for the community today? |
|
|
|
|
|
07-13-2006, 10:10 AM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 17
OS: winXP
|
here you go
sUBs,
Below is the logfile from the latest HJT version: Logfile of HijackThis v1.99.1 Scan saved at 12:08:06 AM, on 7/14/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\AccessDirect\dadapp.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Common Files\{C43EA87A-0A1F-1033-0310-040502200001}\Update.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\cm9lbGxl\command.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\PMJ151LA.BIN C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HijackThis\HijackThis.exe O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTSystem\qttask.exe" -atboottime O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: OemStartMenuData - C:\WINDOWS\system32\fp0003dme.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\cm9lbGxl\command.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing) Hope you can help. Thanks! |
|
|
|
|
07-13-2006, 10:37 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,489
OS: N/A
|
Please read this post completely before begining. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
* * * * * * Do this first ... 1. Download this file - combofix.exe 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Do not proceed with the rest of the fix if you fail to run combofix * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install CleanUp.exe (not recommended for WinXP64) Download Dr.Web CureIt & save it on desktop. We shall be using it later 'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downloading. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab.
* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *
** The scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Perform an online scan with Internet Explorer with Panda ActiveScan
*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. *Turn off the real time scanner of any existing antivirus program while performing the online scan * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? Last edited by sUBs; 07-13-2006 at 10:39 AM. |
|
|
|
|
07-14-2006, 11:18 AM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 17
OS: winXP
|
Here are the logs
sUBs,
I see some of the programs from the steps had removed the adware. But the last step, PandaScan, still detected a lot of Adware. But I don't notice the ad-popups anymore. Am I on the clear or is there anything else left to do? My original msg is too long according to the forum-post limits so I'm attaching the logfiles you requested. Thanks! 1. HJT log Logfile of HijackThis v1.99.1 Scan saved at 12:58:45 AM, on 7/15/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\AccessDirect\dadapp.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\PMJ151LA.BIN C:\Program Files\QuickTime Alternative\QTSystem\qttask.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTSystem\qttask.exe" -atboottime O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing) 2. ComboFix Start Time= Fri 07/14/2006 22:17:23.63 Running from: C:\Documents and Settings\roelle\My Documents\SunCellular ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wzcnotif * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\clsid\{EDD1F2A6-0141-431E-8E0C-864DFC6D81F7}] @="" [HKEY_CLASSES_ROOT\clsid\{EDD1F2A6-0141-431E-8E0C-864DFC6D81F7}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{EDD1F2A6-0141-431E-8E0C-864DFC6D81F7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{EDD1F2A6-0141-431E-8E0C-864DFC6D81F7}\InprocServer32] @="C:\\WINDOWS\\system32\\uyerenv.dll" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * FILES REMOVED: C:\WINDOWS\SYSTEM32\enl6l13s1.dll C:\WINDOWS\SYSTEM32\guard.tmp C:\WINDOWS\SYSTEM32\ilengine.dll C:\WINDOWS\SYSTEM32\it50_32.dll C:\WINDOWS\SYSTEM32\iysmsnap.dll C:\WINDOWS\SYSTEM32\JFSH400.DLL C:\WINDOWS\SYSTEM32\kmd103.dll C:\WINDOWS\SYSTEM32\LZCMP11n.DLL C:\WINDOWS\SYSTEM32\n48o0el3ehq.dll C:\WINDOWS\SYSTEM32\uyerenv.dll Granting sedebugprivilege to Administrators ... successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\drsmartload1.exe C:\drsmartload45z.exe C:\drsmartload46z.exe C:\drsmartload849a.exe C:\drsmartload849z.exe C:\Mendoza1.exe C:\dfndre_5.exe C:\nwnme_5.exe C:\kybrde_5.exe C:\WINDOWS\drsmartload2.dat C:\WINDOWS\newname.dat C:\WINDOWS\keyboard1.dat C:\MTE3NDI6ODoxNg.exe C:\warebundle2.exe C:\warebundlenew.exe C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\MTE3NDI6ODoxNg.exe C:\WINDOWS\SYSTEM32\atmtd.dll C:\WINDOWS\SYSTEM32\atmtd.dll._ C:\Program Files\network monitor C:\Program Files\Common Files\misc001 C:\Program Files\Common Files\simtest C:\Program Files\Common Files\svchostsys C:\Documents and Settings\LocalService\Application Data\NetMon C:\WINDOWS\cm9lbGxl (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-14 00:07:14 ( .D... ) "C:\Program Files\HijackThis" 2006-07-12 21:27:54 578560 ( A.... ) "C:\Installer.exe" 2006-07-12 21:27:20 248 ( A.... ) "C:\WINDOWS\SYSTEM32\n.bat" 2006-07-12 21:26:54 20480 ( A.... ) "C:\WINDOWS\SYSTEM32\dr.exe" 2006-07-12 21:25:56 ( .D... ) "C:\Program Files\Common Files\{C43EA87A-0A1F-1033-0310-040502200001}" 2006-07-12 21:25:52 147456 ( A.... ) "C:\WINDOWS\SYSTEM32\vbzip10.dll" 2006-07-12 21:25:50 151112 ( A.... ) "C:\WINDOWS\SYSTEM32\mc-110-12-0000137.exe" 2006-06-19 16:20:42 702768 ( ..... ) "C:\WINDOWS\SYSTEM32\WgaLogon.dll" 2006-05-15 18:24:34 466944 ( A.... ) "C:\WINDOWS\SYSTEM32\capicom.dll" 2004-02-03 09:45:50 18562 ( A.... ) "C:\Program Files\INSTALL.LOG" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-07-12 22:30 1,072,062,464 C:\hiberfil.sys 2006-07-12 21:27 578,560 C:\Installer.exe 2006-07-12 21:27 248 C:\WINDOWS\system32\n.bat 2006-07-12 21:26 20,480 C:\WINDOWS\system32\dr.exe 2006-07-12 21:25 151,112 C:\WINDOWS\system32\mc-110-12-0000137.exe 2006-07-12 21:25 147,456 C:\WINDOWS\system32\vbzip10.dll 2006-06-21 10:16 499,712 C:\WINDOWS\system32\MSVCP71.DLL 2006-06-21 10:16 348,160 C:\WINDOWS\system32\MSVCR71.DLL 2006-06-21 10:16 1,060,864 C:\WINDOWS\system32\MFC71.DLL 2006-06-19 16:20 702,768 C:\WINDOWS\system32\WgaLogon.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "BCMSMMSG"="BCMSMMSG.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "DadApp"="C:\\Program Files\\Dell\\AccessDirect\\dadapp.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "QuickTime Task"="\"C:\\Program Files\\QuickTime Alternative\\QTSystem\\qttask.exe\" -atboottime" "Openwares LiveUpdate"="C:\\Program Files\\LiveUpdate\\LiveUpdate.exe" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray" "WinVNC"="\"C:\\Program Files\\TightVNC\\WinVNC.exe\" -servicehelper" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" "sys_up1"="C:\\Program Files\\Common Files\\svchostsys\\svchostsys.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "flags"=dword:00000008 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex\000] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "{C43EA87A-0A1F-1033-0310-040502200001}"="\"C:\\Program Files\\Common Files\\{C43EA87A-0A1F-1033-0310-040502200001}\\Update.exe\" mc-110-12-0000137" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Fri 07/14/2006 22:21:13.16 ComboFix ver 06.07.08 - This logfile is located at C:\ComboFix.txt Last edited by sUBs; 07-14-2006 at 11:53 AM. |
|
|
|
|
07-14-2006, 12:06 PM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,489
OS: N/A
|
3. Dr.Web
[Scan path] C:\ C:\Installer.exe is adware program Adware.Look2me C:\Documents and Settings\Administrator\NTUSER.DAT - read error C:\Documents and Settings\Administrator\NTUSER~1.LOG - read error C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - read error C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\USRCLA~1.LOG - read error C:\Documents and Settings\NetworkService\NTUSER.DAT - read error C:\Documents and Settings\NetworkService\NTUSER~1.LOG - read error C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - read error C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\USRCLA~1.LOG - read error >C:\Program Files\Altnet\Download Manager\asm.exe is adware program Adware.Altnet C:\Program Files\Altnet\Download Manager\asmps.dll is adware program Adware.Altnet C:\Program Files\AnalogX\Proxy\proxy.exe is riskware program Program.AnalogProxy - ignored C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP351\A0078186.exe is riskware program Program.RemoteAdmin - ignored C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP351\A0078187.dll is riskware program Program.RemoteAdmin - ignored C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP351\A0078188.exe is riskware program Program.RemoteAdmin - ignored >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078694.DLL is adware program Adware.Look2me C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078697.exe infected with BackDoor.IRC.Ranm - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078699.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078704.dll is adware program Adware.Look2me C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078705.exe infected with BackDoor.IRC.Ranm - deleted C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078706.exe infected with BackDoor.IRC.Ranm - deleted C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078742.dll is adware program Adware.FastSearch C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078744.exe is adware program Adware.MediaTicket >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078762.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078769.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078770.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078779.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078780.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078808.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078809.dll is adware program Adware.Look2me C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078818.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078819.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078820.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078821.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078822.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078823.exe is adware program Adware.MediaTicket C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078824.exe is adware program Adware.DollarRevenue C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078825.exe infected with Trojan.Click.1206 - deleted C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078826.exe infected with Trojan.DownLoader.10308 - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078827.exe infected with Trojan.DownLoader.5013 - deleted C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078828.exe is adware program Adware.Look2me C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078829.exe is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078831.exe infected with Trojan.DownLoader.5013 - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078835.DLL is adware program Adware.Look2me C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078839.old infected with Trojan.DnsChange - deleted C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078842.exe infected with Trojan.Starter.62 - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078846.dll infected with Trojan.Proxy.493 - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078847.exe infected with Trojan.Proxy.493 - deleted >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078850.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078851.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078852.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078853.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078854.DLL is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078855.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078856.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078857.dll is adware program Adware.Look2me >C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078892.exe probably infected with WIN.SCRIPT.WORM.Virus C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078897.exe infected with Trojan.Starter.65 - deleted C:\WINDOWS\Setup.exe infected with BackDoor.IRC.Ranm - deleted C:\WINDOWS\SYSTEM32\dr.exe is adware program Adware.DollarRevenue C:\WINDOWS\SYSTEM32\p2pnetworking.exe infected with BackDoor.IRC.Ranm - deleted C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT - read error C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG - read error C:\WINDOWS\SYSTEM32\CONFIG\SAM - read error C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG - read error C:\WINDOWS\SYSTEM32\CONFIG\SECURITY - read error C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG - read error C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE - read error C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG - read error C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM - read error C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG - read error ----------------------------------------------------------------------------- Scan statistics ----------------------------------------------------------------------------- Objects scanned: 152799 Infected objects found: 14 Objects with modifications found: 0 Suspicious objects found: 1 Adware programs found: 34 Dialer programs found: 0 Joke programs found: 0 Riskware programs found: 0 Hacktool programs found: 0 Objects cured: 0 Objects deleted: 14 Objects renamed: 0 Objects moved: 0 Objects ignored: 4 Scan speed: 395 Kb/s Scan time: 01:28:01 ----------------------------------------------------------------------------- C:\Installer.exe - moved C:\Program Files\Altnet\Download Manager\asm.exe - moved C:\Program Files\Altnet\Download Manager\asmps.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078694.DLL - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078699.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078704.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078742.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078744.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078762.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078769.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078770.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078779.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP356\A0078780.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078808.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078809.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078818.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078819.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078820.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078821.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078822.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078823.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078824.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078828.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078829.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078835.DLL - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078850.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078851.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078852.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078853.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078854.DLL - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078855.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078856.dll - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078857.dll - moved C:\WINDOWS\SYSTEM32\dr.exe - moved C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP357\A0078892.exe - moved ============================================================================= Total session statistics ============================================================================= Objects scanned: 153106 Infected objects found: 14 Objects with modifications found: 0 Suspicious objects found: 1 Adware programs found: 34 Dialer programs found: 0 Joke programs found: 0 Riskware programs found: 0 Hacktool programs found: 0 Objects cured: 0 Objects deleted: 14 Objects renamed: 0 Objects moved: 35 Objects ignored: 4 Scan speed: 403 Kb/s Scan time: 01:28:31 ============================================================================= 4. Online Scan Incident Status Location Potentially unwanted tool:application/bestoffer Not disinfected c:\windows\smdat32a.sys Adware:adware/dollarrevenue Not disinfected c:\windows\teller2.chk Potentially unwanted tool:application/altnet Not disinfected c:\program files\Altnet Adware:adware/commad Not disinfected Windows Registry Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078694.DLL Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078699.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078704.dll Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078742.dll Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078744.exe Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078762.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078769.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078770.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078779.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078780.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078808.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078809.dll Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078818.exe Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078819.exe Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078820.exe Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078821.exe Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078822.exe Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078823.exe Virus:Trj/Clicker.RE Disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078824.exe Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078828.exe Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078829.exe Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078835.DLL Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078850.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078851.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078852.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078853.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078854.DLL Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078855.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078856.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0078857.dll Potentially unwanted tool:Application/Altnet Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\asm.exe Potentially unwanted tool:Application/Altnet Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\asmps.dll Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\Installer.exe Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.fastclick.net/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.statcounter.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.serving-sys.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.apmebf.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.perf.overture.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.overture.com/] Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.yadro.ru/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.2o7.net/] Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.clickbank.net/] Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.data.coremetrics.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[statse.webtrendslive.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.zedo.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[c.goclick.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.advertising.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[servedby.advertising.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.atwola.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.as-us.falkag.net/] Spyware:Cookie/888 Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.888.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.com.com/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.hitbox.com/] Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.cs.sexcounter.com/] Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.paycounter.com/] Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.sexlist.com/] Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[landing.domainsponsor.com/] Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.valueclick.com/] Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.maxserving.com/] Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.burstnet.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[statse.webtrendslive.com/S153949] Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.adviva.net/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.247realmedia.com/] Spyware:Cookie/TeensForCash Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.teensforcash.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.belnk.com/] Spyware:Cookie/Lop Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.mp3search.ru/] Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.adopt.hbmediapro.com/] Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.revenue.net/] Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.as-eu.falkag.net/] Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.toplist.cz/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.ehg-eline.hitbox.com/] Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[stat.onestat.com/] Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.targetnet.com/] Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.bravenet.com/] Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[c3.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.gostats.com/] Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.z1.adserver.com/] Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[searchportal.information.com/] Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.bluestreak.com/] Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.centrport.net/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.ehg.hitbox.com/] Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.bfast.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[server.iad.liveperson.net/hc/29285195] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[server.iad.liveperson.net/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.ath.belnk.com/] Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[server.iad.liveperson.net/hc/15527479] Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.counter.hitslink.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\roelle\Application Data\Mozilla\Firefox\Profiles\lxtubknm.default\cookies.txt[.statse.webtrendslive.com/dcsajnkbj11e5hmi283hr30a8_2c7p] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-42e537af-211adaa3.zip[Gummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-6bfcc9d0-3a7c7be9.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-6bfcc9d0-3a7c7be9.zip[NewURLClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-6bfccd6c-75b98c37.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-6bfccd6c-75b98c37.zip[NewURLClassLoader.class] Virus:Trj/Shinwow.C Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load.jar-7caae630-647131ee.zip[Matrix.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load.jar-7caae630-647131ee.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load2.jar-7fdf563c-6dd8d3cc.zip[Matrix.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\roelle\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load2.jar-7fdf563c-6dd8d3cc.zip[Dummy.class] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@ad.yieldmanager[2].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@ads.pointroll[1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@advertising[1].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@apmebf[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@atdmt[1].txt Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@bfast[2].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@bluestreak[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@bs.serving-sys[1].txt Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@casalemedia[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@doubleclick[1].txt Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@fastclick[1].txt Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@hitbox[2].txt Spyware:Cookie/Linksynergy Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@linksynergy[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@mediaplex[1].txt Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@qksrv[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@realmedia[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@serving-sys[2].txt Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@spylog[2].txt Spyware:Cookie/Versiontracker Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@versiontracker[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\roelle\Cookies\roelle@zedo[2].txt Potentially unwanted tool:Application/AnalogX-Proxy.A Not disinfected C:\Program Files\AnalogX\Proxy\proxy.exe Virus:Eicar.Mod Renamed C:\Program Files\Common Files\Symantec Shared\VirusDefs\20030624.004\HH[pocketpcdefs1.zip] Virus:Eicar.Mod Renamed C:\Program Files\Common Files\Symantec Shared\VirusDefs\20030624.004\HH[pocketpcdefs1.zip][savce.def] Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\SYSTEM32\mc-110-12-0000137.exe Virus:W32/Sdbot.HLL.worm Disinfected C:\z.rar[Setup.exe]
__________________
Question - what have you done for the community today? |
|
|
|
|
07-14-2006, 12:10 PM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,489
OS: N/A
|
Please read the rest of this post completely before begining the fix.
Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards. SpywareBlaster 3.5.1 - Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain Please download the file attached - regdel.zip Double-click the file within & allow it to merge with the Registry. This will remove some malware entries from the Registry * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab.
* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. * * * * * * * * * Reboot & post fresh copies of the following logs 1. Combofix 2. HJT
__________________
Question - what have you done for the community today? Last edited by sUBs; 07-20-2006 at 12:55 AM. |
|
|
|
|
07-19-2006, 09:51 AM
|
#8 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 17
OS: winXP
|
fresh logs
sUBs,
Below is the latest ComboFix and HJT logs: 1. Combofix Start Time= Wed 07/19/2006 23:46:34.99 Running from: C:\Documents and Settings\roelle\My Documents\SunCellular QuickScan did not find any signs of infected files (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-19 23:32:16 ( .D... ) "C:\Program Files\SpywareBlaster" 2006-07-19 08:02:20 ( .D... ) "C:\Program Files\DIFX" 2006-07-19 08:01:28 ( .D... ) "C:\Program Files\Common Files\Nokia" 2006-07-19 08:01:04 ( .D... ) "C:\Program Files\Common Files\PCSuite" 2006-07-19 08:00:52 ( .D... ) "C:\Program Files\Nokia" 2006-07-18 11:55:50 ( .D... ) "C:\Documents and Settings\roelle\Application Data\PlayFirst" 2006-07-18 11:54:38 ( .D... ) "C:\Program Files\BFG" 2006-07-15 01:40:28 ( .D..R ) "C:\Documents and Settings\roelle\Application Data\Brother" 2006-07-15 01:26:14 ( .D... ) "C:\Program Files\Brother" 2006-07-15 01:23:30 ( .D... ) "C:\Program Files\Common Files\ScanSoft Shared" 2006-07-15 01:23:22 ( .D... ) "C:\Program Files\ScanSoft" 2006-07-14 00:07:14 ( .D... ) "C:\Program Files\HijackThis" 2006-06-19 16:20:42 702768 ( ..... ) "C:\WINDOWS\SYSTEM32\WgaLogon.dll" 2006-05-19 20:59:42 148480 ( A.... ) "C:\WINDOWS\SYSTEM32\dnsapi.dll" 2006-05-19 20:59:42 111616 ( A.... ) "C:\WINDOWS\SYSTEM32\dhcpcsvc.dll" 2006-05-19 20:59:42 94720 ( A.... ) "C:\WINDOWS\SYSTEM32\iphlpapi.dll" 2006-05-15 18:24:34 466944 ( A.... ) "C:\WINDOWS\SYSTEM32\capicom.dll" 2006-04-27 10:33:10 207872 ( A.... ) "C:\WINDOWS\SYSTEM32\DAAPI.dll" 2006-04-27 10:03:08 243712 ( A.... ) "C:\WINDOWS\SYSTEM32\ConnAPI.dll" 2006-04-27 10:02:52 60416 ( A.... ) "C:\WINDOWS\SYSTEM32\NclTools.dll" 2004-02-03 09:45:50 18562 ( A.... ) "C:\Program Files\INSTALL.LOG" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-07-19 08:00 48,128 C:\WINDOWS\system32\nmwcdcls.dll 2006-07-19 08:00 4,608 C:\WINDOWS\system32\nmwcdlog.dll 2006-07-19 08:00 31,232 C:\WINDOWS\system32\nmwcdcocls.dll 2006-07-15 01:26 81,920 C:\WINDOWS\system32\BrWebIns.dll 2006-07-15 01:26 65,536 C:\WINDOWS\system32\BRWEBUP.EXE 2006-07-15 01:26 57,344 C:\WINDOWS\system32\brsvc01a.exe 2006-07-15 01:26 52,224 C:\WINDOWS\system32\brinsstr.dll 2006-07-15 01:26 45,056 C:\WINDOWS\system32\brss01a.exe 2006-07-15 01:26 37,888 C:\WINDOWS\system32\BrUSi05a.dll 2006-07-15 01:26 258,048 C:\WINDOWS\system32\bsplmf01.dll 2006-07-15 01:26 188,416 C:\WINDOWS\system32\PDRVINST.DLL 2006-07-15 01:26 147,456 C:\WINDOWS\brunin03.dll 2006-07-15 01:26 131,072 C:\WINDOWS\system32\bsplmf01.exe 2006-07-15 01:26 121,856 C:\WINDOWS\system32\BrWia05a.dll 2006-07-15 00:16 73,728 C:\WINDOWS\system32\asuninst.exe 2006-07-15 00:16 11,776 C:\WINDOWS\system32\ZPORT4AS.dll 2006-07-15 00:10 1,072,062,464 C:\hiberfil.sys 2006-06-21 10:16 499,712 C:\WINDOWS\system32\MSVCP71.DLL 2006-06-21 10:16 348,160 C:\WINDOWS\system32\MSVCR71.DLL 2006-06-21 10:16 1,060,864 C:\WINDOWS\system32\MFC71.DLL 2006-06-19 16:20 702,768 C:\WINDOWS\system32\WgaLogon.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "BCMSMMSG"="BCMSMMSG.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "DadApp"="C:\\Program Files\\Dell\\AccessDirect\\dadapp.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "QuickTime Task"="\"C:\\Program Files\\QuickTime Alternative\\QTSystem\\qttask.exe\" -atboottime" "Openwares LiveUpdate"="C:\\Program Files\\LiveUpdate\\LiveUpdate.exe" "WinVNC"="\"C:\\Program Files\\TightVNC\\WinVNC.exe\" -servicehelper" "SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot" "PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe" "IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe" "SetDefPrt"="C:\\Program Files\\Brother\\Brmfl05a\\BrStDvPt.exe" "ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Wed 07/19/2006 23:46:50.29 ComboFix ver 06.07.08 - This logfile is located at C:\ComboFix.txt ComboFix.2006-07-19.234634.txt 2. HJT Logfile of HijackThis v1.99.1 Scan saved at 11:48:57 PM, on 7/19/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\AccessDirect\dadapp.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\QuickTime Alternative\QTSystem\qttask.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\PMJ151LA.BIN C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Common Files\PCSuite\Services\NclBTHandler.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Program Files\HijackThis\HijackThis.exe O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTSystem\qttask.exe" -atboottime O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing) |
|
|
|
|
07-19-2006, 10:13 AM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,489
OS: N/A
|
Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
