|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
09-19-2006, 03:02 PM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
Vundo Infection Aftermath Help Request
Hi and thanks for taking an interest in my issue. After a little bit of my own research I found out I was infected with the malware known as "Vundo". Firstly, to remove this malware, I was advised to run - VundoFix.exe which I can confirm I have done and can also confirm that about 8 files were located and apparently deleted, that of course though was only after the tool rebooted my system and deleted the files in a state where my operating system had not fully opened up, i.e. explorer.exe not being run. I then thought perhaps it was a good idea to run the Symantec tool called "FixVundo.exe" which once run gave me the following screen
The total number of the scanned files: 108166 The number of deleted files: 0 The Number of viral processes terminated: 1 The Number of viral processes suspended: 1 The Number of viral threads terminated: 0 The Number of registry entries fixed: 0 Now looking at the results above I grew a little concerned that termination of the process itself is not enough so I was hoping that one of your fine volunteers would be able to spare their time and assist me in this issue. I would also like to confirm that I have done as you asked in the Sticky and run CWSShredder and ensured that I meet all of the criteria prior to posting a HJT log. Here it goes, thanks again. -------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 22:00:59, on 19/09/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0006) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\Program Files\Diskeeper\DkService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\ehome\RMSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\isafe.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ehome\RMSysTry.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Documents and Settings\Lee Grieve\Desktop\FixVundo.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Lee Grieve\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - C:\WINDOWS\system32\cnewonse.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\RunOnce: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /play O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1152667750562 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1152668461343 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS1\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS2\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Last edited by creationite; 09-19-2006 at 03:03 PM. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
09-19-2006, 04:14 PM
|
#2 (permalink) |
|
Analyst, Security Team ; TSF Supporter
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP
|
Hello creationite, and welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply. Please be patient with me during this time. |
|
|
|
|
09-19-2006, 05:29 PM
|
#3 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
Fantastic, thank you for such a speedy response advising me that you are looking into this log. Take as long as you need my friend after all you are doing this out of the goodness of your heart.
Creationite |
|
|
|
|
09-19-2006, 06:04 PM
|
#4 (permalink) |
|
Analyst, Security Team ; TSF Supporter
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP
|
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- The fixes we will use are specific to your problems and should only be used for this issue on this machine. Please only use this topic to reply to. Do not start another thread. If any other issues arise let me know. The process is not instant. Please continue to review my answers until I tell you your machine is clear. Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more likely additional infections will result. Absence of symptoms does not mean that everything is clear. So lets do this to the end! ---------------------------------------- Please submit the following file to Jotti File Scan C:\WINDOWS\system32\cnewonse.dll At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit". When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread. ---------------------------------------- DOWNLOADS ATF CLEANER Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only EWIDO Please download Ewido Anti-Malware
If you are having problems with the updater, you can use this link to manually update Ewido. When you have finished updating, EXIT Ewido. ---------------------------------------- SAFE MODE RE-BOOT Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers. ---------------------------------------- FIXES AND DELETIONS Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - C:\WINDOWS\system32\cnewonse.dll Please remember to close all other windows, including browsers then click Fix checked. ---------------------------------------- UNHIDE HIDDEN FILES Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\WINDOWS\system32\cnewonse.dll ---------------------------------------- RUNNING SCANNERS ATF CLEANER Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program EWIDO
Once finished, click the Save report button, then click Save Report As and save it to your desktop. ---------------------------------------- SYSTEM RE-BOOT Reboot into Normal Mode. ---------------------------------------- ON-LINE SCANS Perform an online scan with Internet Explorer with Panda ActiveScan Click on the "Free To Use ActiveScan" located on the top right hand corner
Begin the scan by selecting My Computer
* Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- FOLLOW-UP Please return and post these items: Jotti report Ewido scan Panda scan A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode |
|
|
|
|
09-20-2006, 03:31 AM
|
#5 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
Jotti report
I posted this earlier however it has been removed? Ewido scan --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 10:02:04 20/09/2006 + Scan result: C:\VundoFix Backups\gebyayx.dll.bad -> Adware.Virtumionde : No action taken. C:\Documents and Settings\Lee Grieve\Local Settings\Temporary Internet Files\Content.IE5\WDFWSKP4\srvphd[1].exe -> Dialer.InstantAccess.k : No action taken. C:\Documents and Settings\Lee Grieve\Local Settings\Temporary Internet Files\Content.IE5\WDFWSKP4\l11[1].exe -> Downloader.Zlob.alh : No action taken. C:\Documents and Settings\Lee Grieve\Local Settings\Temporary Internet Files\Content.IE5\RWMXJUPR\srvipo[1].exe -> Trojan.Dialer.qs : No action taken. C:\Documents and Settings\Lee Grieve\Local Settings\Temporary Internet Files\Content.IE5\RWMXJUPR\srvobv[1].exe -> Trojan.Dialer.qs : No action taken. D:\Programs\WinRAR(3.50 FINAL + CRACK)\wrar350.exe -> Trojan.KillAV.ft : No action taken. C:\VundoFix Backups\Update.exe.bad -> Trojan.Starter.65 : No action taken. ::Report end Panda scan I cannot run a panda scan as I get the following error as it appears the server is down Internal Server Error - Read The server encountered an internal error or misconfiguration and was unable to complete your request. Reference #3.15863554.1158744648.f8f16e3 A new HJT log run in Normal Mode Logfile of HijackThis v1.99.1 Scan saved at 10:27:45, on 20/09/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0006) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\Program Files\Diskeeper\DkService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\ehome\RMSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\isafe.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\ehome\RMSysTry.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\Lee Grieve\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\RunOnce: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /play O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1152667750562 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1152668461343 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS1\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS2\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper\DkService.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
09-20-2006, 09:15 AM
|
#6 (permalink) |
|
Analyst, Security Team ; TSF Supporter
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP
|
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- I don't see the Jotti report. Can you please repost it or let me know what it found I also noticed a crack program in your log. Please note that these sites pose serious security risks for your system and are known to download malicious programs without your knowledge ---------------------------------------- Please download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop. Open the SmitfraudFix folder and double-click smitfraudfix.cmd Select option #1 - Search by typing 1 and press "Enter" and a text file will appear which lists infected files (if present). Please copy/paste the content of that report into your next reply. IMPORTANT: Do NOT run option #2 OR any other option until you are directed to do so! ---------------------------------------- EWIDO [b][color=red]Please re-configure Ewido, making sure that under RECOMMENDED ACTIONS, the QUARANTINE button is checked, and the APPLY ALL ACTIONS is checked after the scan
Once finished, click the Save report button, then click Save Report As and save it to your desktop. ---------------------------------------- Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
* Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- FOLLOW-UP Please return and post these items: Jotti report - if available SmitFraud log Ewido log KAspersky scan A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode |
|
|
|
|
09-20-2006, 11:14 AM
|
#7 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
Updating this post as and when I complete each step.
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lee Grieve\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\LEEGRI~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End |
|
|
|
|
09-20-2006, 03:38 PM
|
#9 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lee Grieve\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\LEEGRI~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="about:Home" "SubscribedURL"="about:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End ------------------------------------------------------------------- I cant use the Kaspersky Online tool as it doesnt work with IE7 and / or Firefox :( ------------------------------------------------------------------- Ewido Log --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 22:37:35 20/09/2006 + Scan result: C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@qksrv[1].txt -> TrackingCookie.Qksrv : No action taken. C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken. C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.18:C:\Documents and Settings\Lee Grieve\Application Data\Mozilla\Firefox\Profiles\g1bm81vr.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.19:C:\Documents and Settings\Lee Grieve\Application Data\Mozilla\Firefox\Profiles\g1bm81vr.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\Lee Grieve\Cookies\lee_grieve@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken. ::Report end -------------------------------------------------------------------- HJT Logfile of HijackThis v1.99.1 Scan saved at 22:04:55, on 20/09/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0006) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\Program Files\Diskeeper\DkService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\ehome\RMSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\isafe.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Razer\Copperhead\razerhid.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\ehome\RMSysTry.exe C:\Program Files\Razer\Copperhead\razertra.exe C:\Program Files\Razer\Copperhead\razerofa.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Documents and Settings\Lee Grieve\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\RunOnce: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /play O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1152667750562 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1152668461343 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS1\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O17 - HKLM\System\CS2\Services\Tcpip\..\{13530439-BC88-4BA4-8BE7-B7E82FB12454}: NameServer = 212.103.224.51,212.103.224.52 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper\DkService.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
09-20-2006, 08:48 PM
|
#10 (permalink) |
|
Analyst, Security Team ; TSF Supporter
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP
|
OK, I understand about Kaspersky. One more scan to make sure we got everything. We're looking real good.
1. Download this file - You MUST save it to your desktop http://download.bleepingcomputer.com/sUBs/combofix.exe or http://www.techsupportforum.com/sectools/combofix.exe 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
|
|
|
|
09-21-2006, 01:35 AM
|
#11 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP Media Center Edition
|
Thanks for all the help thus far fredmh, needless to say I would of been able to fix this without your help. Here is the combofix log:
Lee Grieve - 06-09-21 8:30:33.28 Service Pack 2 ComboFix 06.09.21 - Running from: "C:\Documents and Settings\Lee Grieve\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\components C:\Program Files\Common Files\{703F68B0-07FB-2057-0413-05051104002c} ((((((((((((((((((((((((((((((( Files Created from 2006-08-21 to 2006-09-21 )))))))))))))))))))))))))))))))))) 2006-09-20 18:11 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-09-20 18:11 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-09-20 18:11 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-09-20 18:11 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-09-16 08:24 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2006-09-16 08:24 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2006-08-29 23:34 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe 2006-08-23 00:31 50,688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-08-23 00:31 5,906,432 --------- C:\WINDOWS\system32\ieframe.dll 2006-08-23 00:31 457,728 --------- C:\WINDOWS\system32\msfeeds.dll 2006-08-23 00:31 175,616 --------- C:\WINDOWS\system32\ieui.dll 2006-08-23 00:18 206,336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-08-23 00:13 11,776 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-08-23 00:11 12,288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-08-23 00:10 61,440 --------- C:\WINDOWS\system32\icardie.dll 2006-08-23 00:09 262,656 --------- C:\WINDOWS\system32\iertutil.dll 2006-08-22 23:36 380,928 --------- C:\WINDOWS\system32\ieapfltr.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-21 08:31 -------- d-------- C:\Program Files\Common Files 2006-09-20 21:52 -------- d-------- C:\Program Files\Mozilla Firefox 2006-09-20 17:21 -------- d-------- C:\Program Files\ewido anti-spyware 4.0 2006-09-19 16:56 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Azureus 2006-09-18 01:00 -------- d-------- C:\Program Files\Internet Explorer 2006-09-18 00:26 -------- d-------- C:\Program Files\Windows Defender 2006-09-17 19:51 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\LimeWire 2006-09-17 13:52 -------- d-------- C:\Program Files\RegScrubXP 2006-09-16 08:24 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-09-15 18:45 -------- d---s---- C:\Documents and Settings\Lee Grieve\Application Data\Microsoft 2006-09-08 20:25 -------- d-------- C:\Program Files\ZoneAlarm 2006-09-03 12:29 -------- d-------- C:\Program Files\PeerGuardian2 2006-09-01 22:03 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\IGN_DLM 2006-09-01 13:12 -------- d-------- C:\Program Files\MSN Messenger 2006-08-30 20:03 29853 --a------ C:\Program Files\g2a_helpalert.log 2006-08-30 18:16 -------- d-------- C:\Program Files\Registry Mechanic 2006-08-29 23:40 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\ATI 2006-08-29 23:37 -------- d-------- C:\Program Files\ATI Technologies 2006-08-25 20:23 -------- dr-h----- C:\Documents and Settings\Lee Grieve\Application Data\SecuROM 2006-08-24 21:05 -------- d-------- C:\Program Files\Common Files\Blizzard Entertainment 2006-08-23 23:38 75776 --a------ C:\WINDOWS\zllsputility.exe 2006-08-23 13:34 -------- d-------- C:\Program Files\Azureus 2006-08-23 00:31 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-08-23 00:31 225792 --a------ C:\WINDOWS\system32\webcheck.dll 2006-08-23 00:31 152064 --a------ C:\WINDOWS\system32\msls31.dll 2006-08-23 00:18 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-08-23 00:17 40448 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-08-23 00:17 105472 --a------ C:\WINDOWS\system32\url.dll 2006-08-23 00:17 100352 --a------ C:\WINDOWS\system32\occache.dll 2006-08-23 00:16 16896 --a------ C:\WINDOWS\system32\corpol.dll 2006-08-23 00:14 378368 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-08-23 00:14 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-08-23 00:13 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-08-23 00:13 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-08-23 00:13 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-08-23 00:13 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-08-23 00:13 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-08-23 00:13 122880 --a------ C:\WINDOWS\system32\advpack.dll 2006-08-23 00:10 35328 --a------ C:\WINDOWS\system32\imgutil.dll 2006-08-23 00:07 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-08-22 23:37 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-08-22 23:30 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-08-21 13:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 10:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-20 19:30 -------- d-------- C:\Program Files\ATC for Battlefield 2 2006-08-20 13:27 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\IMVU 2006-08-19 20:44 -------- d---s---- C:\Program Files\Xfire 2006-08-19 10:27 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Opera 2006-08-19 07:54 -------- d-------- C:\Program Files\CureROM 2006-08-19 07:48 29184 --a------ C:\WINDOWS\system32\AH6XL32.dll 2006-08-18 22:59 18048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2006-08-18 22:59 165376 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2006-08-11 22:33 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\My Games 2006-08-11 22:24 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2006-08-10 20:54 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Media Player Classic 2006-08-10 20:53 -------- d-------- C:\Program Files\QuickTime Alternative 2006-08-10 20:53 -------- d-------- C:\Program Files\Media Player Classic 2006-08-10 20:50 -------- d-------- C:\Program Files\Common Files\Real 2006-08-10 20:50 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Real 2006-08-10 20:20 -------- d-------- C:\Program Files\QuickTime 2006-08-10 19:46 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-08-08 22:31 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Adobe 2006-08-08 21:58 -------- d---s---- C:\Program Files\Adobe 2006-08-08 21:57 -------- d-------- C:\Program Files\Common Files\Adobe 2006-08-02 23:12 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll 2006-08-02 23:08 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll 2006-08-02 23:07 1681920 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2006-08-02 23:02 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll 2006-08-02 23:02 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll 2006-08-02 23:02 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll 2006-08-02 23:02 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe 2006-08-02 23:02 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll 2006-08-02 23:01 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe 2006-08-02 23:00 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL 2006-08-02 22:55 2373088 --a------ C:\WINDOWS\system32\ati3duag.dll 2006-08-02 22:51 2354720 --a------ C:\WINDOWS\system32\ativvaxx.dll 2006-08-02 22:49 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll 2006-08-02 22:45 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll 2006-08-02 22:41 208896 --a------ C:\WINDOWS\system32\atikvmag.dll 2006-08-02 22:40 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll 2006-08-02 22:40 17408 --a------ C:\WINDOWS\system32\atitvo32.dll 2006-08-02 22:35 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll 2006-08-01 10:59 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-07-31 22:59 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Google 2006-07-31 12:42 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared 2006-07-30 19:27 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Mozilla 2006-07-30 19:20 -------- d-------- C:\Program Files\Download Manager 2006-07-30 14:50 241890 --a------ C:\WINDOWS\A Tale in the Desert Uninstaller.exe 2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll 2006-07-28 18:49 -------- d-------- C:\Program Files\XviD 2006-07-28 18:16 -------- d-------- C:\Program Files\Gspot Video 2006-07-28 18:10 -------- d-------- C:\Program Files\CyberLink 2006-07-28 18:09 -------- d-------- C:\Program Files\PowerDVD 2006-07-27 14:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-26 22:41 -------- d-------- C:\Program Files\Windows Media Player 2006-07-24 21:56 -------- d-------- C:\Program Files\Razer 2006-07-22 10:10 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\Macromedia 2006-07-21 20:51 -------- d-------- C:\Documents and Settings\Lee Grieve\Application Data\CyberLink 2006-07-21 09:24 72704 --a------ C:\WINDOWS\system32\hlink.dll 2006-07-14 16:52 121856 --------- C:\WINDOWS\system32\xmllite.dll 2006-07-14 11:47 218624 --a------ C:\WINDOWS\system32\uxtheme.dll 2006-07-12 21:08 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2006-07-12 02:54 62 --ahs---- C:\Documents and Settings\Lee Grieve\Application Data\desktop.ini 2006-07-12 02:10 0 -rahs---- C:\MSDOS.SYS 2006-07-12 02:10 0 -rahs---- C:\IO.SYS 2006-07-12 02:10 0 --a------ C:\CONFIG.SYS 2006-07-12 02:10 0 --a------ C:\AUTOEXEC.BAT 2006-06-29 10:20 1669632 --a------ C:\WINDOWS\system32\msvidctl.dll 2006-06-29 10:17 456192 --a------ C:\WINDOWS\system32\encdec.dll 2006-06-29 10:17 291840 --a------ C:\WINDOWS\system32\sbe.dll 2006-06-29 10:16 235008 --------- C:\WINDOWS\system32\psisdecd.dll 2006-06-29 08:05 26112 --------- C:\WINDOWS\system32\idndl.dll 2006-06-29 08:05 23552 --------- C:\WINDOWS\system32\normaliz.dll 2006-06-28 17:59 24576 --------- C:\WINDOWS\system32\nlsdl.dll 2006-06-22 06:06 69120 --a------ C:\WINDOWS\system32\ciodm.dll 2006-06-22 06:06 1435648 --a------ C:\WINDOWS\system32\query.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce] "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /play" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe" "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe" "CTHelper"="CTHELPER.EXE" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /run" "DiskeeperSystray"="\"C:\\Program Files\\Diskeeper\\DkIcon.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "razer"="C:\\Program Files\\Razer\\Copperhead\\razerhid.exe" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\"" "Zone Labs Client"="\"C:\\Program Files\\ZoneAlarm\\zlclient.exe\"" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,de,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,a2,03,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,a2,03,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\MP Scheduled Scan.job Completion time: 21/09/2006 8:33:09.56 ComboFix.txt |
|
|
|
|
09-21-2006, 09:50 AM
|
#12 (permalink) |
|
Analyst, Security Team ; TSF Supporter
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP
|
Good job. Your logs are clean. Please complete the next "housekeeping steps" and read through the information below
---------------------------------------- P2P - I see you have P2P software installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Limewire BitTorrent ---------------------------------------- Windows XP - Reset Hidden Files
---------------------------------------- Clean-out and Reset System Restore This will clean out any junk or malicious files left behind in System Restore
This will create a new Restore Point. ---------------------------------------- RE-ENABLE ANTI-SPYWARE APPLICATIONS If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them ---------------------------------------- Please read through the following information to help protect your computer in the future. KEEP YOUR OPERATING SYSTEM UPDATED Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. ENABLE WINDOWS AUTO UPDATE Go to Start>Run - type wuaucpl.cpl tick on the checkbox - "Keep my computer up to date" Under settings, choose "Automatically download the updates, and install them on the schedule that I specify". Click on "OK". TOOLS TO HELP KEEP YOUR SYSTEM CLEAN Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs: SpywareBlaster to help prevent spyware from installing in the first place.
SpywareGuard to catch and block spyware before it can execute. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
A tutorial for IE-SPYAD can be found here MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser) which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem. It also shows what problems were encountered with each site. ANTI-VIRUS AND FIREWALL PROGRAMS ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial Here are some very good free Antivirus products which are available: If you do not have a firewall, here are 4 free ones available for personal use: INFORMATIONAL READING In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:
Please respond one more time and let me know you received this post so it can be marked resolved |
|
|
|
| Thread Tools | |
|
|
