|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
09-21-2006, 09:22 PM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP
|
Hijacked browser. Pop-ups. Trojans galore
First of all, thank you for the help. Let me know what else I can tell you:
It all started when I tried to download a PDF file at this URL http://ez-files.net/download.php?file=fbd7411b All of a sudden my McAfee Enterprise VirusScan 8.0.0 alerted me to adware being detected. And I thought I saw that it had found a trojan. Unfortunately I shut down before I could remember what exactly was happening. All I know is that the list kept getting longer. Like they were multiplying. When I rebooted, I knew something was wrong. My firefox browser opened all on it's own with popups galore, party poker, weightloss, registry cleaner, etc. Here are a few of the URLs http://www.cheappress.com/m2332111114.html http://www.goodrumor.com/a03481065.html http://www.dofact.com/m03481065.html http://www.locatebest.com/a03481065.html http://www.newsalone.com/m03481065.html I scanned my computer (in safe mode) with three different spyware programs: Adaware, Spybot, Ewido. All of them were able to get rid of most of the infected objects except for three. The reasons were always the same: something about can't delete that file because it is currently in use (memory). These were the offending objects. zestyfind look2me (Topconverting) Command Service VX2 NOTE: In the middle of my ewido scan, my McAfee virusscan said that it found and deleted a trojan. Here is the info: 9/21/2006 8:42:00 PM Deleted: C:\WINDOWS\icont.exe QUrl-3 (Trojan) ewido.exe After that, I followed your instructions. Here is what the VX2 cleaner plug-in told me in the log file: "Posssible new VX2 variant file: C:\WINDOWS\system32\q6pslg7716.dll" Here is my HijackThis Log. Below that I posted my ewido scan log: Logfile of HijackThis v1.99.1 Scan saved at 8:12:57 PM, on 9/21/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\TpShocks.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe C:\WINDOWS\MXOALDR.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.openwave.com/default.aspx R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R3 - Default URLSearchHook is missing O1 - Hosts: 127.0.0.2 rwc-ora-qa2 O1 - Hosts: 127.0.0.2 perforce O1 - Hosts: 127.0.0.2 perforce2 O1 - Hosts: 127.0.0.2 perforce3 O1 - Hosts: 127.0.0.2 perforce4 O1 - Hosts: 127.0.0.2 perforce5 O1 - Hosts: 127.0.0.2 perforce6 O1 - Hosts: 127.0.0.2 perforce7 O1 - Hosts: 127.0.0.2 perforce8 O1 - Hosts: 127.0.0.2 ptgtools O1 - Hosts: 127.0.0.2 perforce9 O1 - Hosts: 127.0.0.4 rwc-ora-qa2 O1 - Hosts: 127.0.0.5 rwc-ora-prod2 O1 - Hosts: 127.0.0.2 rwc-ldap-qa1 O1 - Hosts: 127.0.0.2 crownjewels O1 - Hosts: 127.0.0.2 p4test O1 - Hosts: 127.0.0.2 evoe O1 - Hosts: 127.0.0.2 evoe2 O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.myopwv.com O15 - Trusted Zone: *.netscaler.com O15 - Trusted Zone: *.openwave.com O15 - Trusted Zone: *.peopleclick.com O15 - Trusted Zone: *.myopwv.com (HKLM) O15 - Trusted Zone: *.netscaler.com (HKLM) O15 - Trusted Zone: *.openwave.com (HKLM) O15 - Trusted Zone: *.peopleclick.com (HKLM) O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1119451976022 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136833846531 O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://openwave.webex.com/client/T2...ex/ieatgpc.cab O16 - DPF: {FD7C00A9-E676-11D6-A08E-00E09878F0CF} (Nsload Control) - https://rwc-sslvpn.openwave.com/vpns/scripts/nsload.ocx O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\Software\..\Telephony: DomainName = myopwv.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = myopwv.com O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\q6pslg7716.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 8:56:23 PM 9/21/2006 + Scan result: C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : No action taken. C:\WINDOWS\system32\guard.tmp_tobedeleted -> Adware.Look2Me : No action taken. [2092] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : No action taken. C:\WINDOWS\iconu.exe -> Adware.Zestyfind : No action taken. :mozilla.178:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.33:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.371:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.44:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.45:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.46:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.47:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.48:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.49:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.50:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.51:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.52:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.53:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.54:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.55:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.56:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.57:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.58:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.62:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.63:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.64:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.65:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.66:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.67:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.68:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.69:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.70:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.71:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.72:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.73:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.74:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.83:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.149:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.150:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.151:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.75:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Addynamix : No action taken. :mozilla.161:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.162:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.536:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.537:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.538:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.539:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.540:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken. :mozilla.503:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adserver : No action taken. :mozilla.504:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Adserver : No action taken. :mozilla.82:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Atdmt : No action taken. :mozilla.587:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Burstbeacon : No action taken. :mozilla.214:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.215:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.588:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.227:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Clickbank : No action taken. :mozilla.230:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.231:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.77:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken. :mozilla.78:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken. :mozilla.79:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken. :mozilla.80:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken. :mozilla.81:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken. :mozilla.185:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.186:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.187:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.188:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.258:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.302:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.303:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.342:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Linkbuddies : No action taken. :mozilla.88:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.90:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.93:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.95:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Liveperson : No action taken. :mozilla.85:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.622:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken. :mozilla.368:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.369:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.163:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.164:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.165:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.166:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.167:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.168:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.377:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.378:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.379:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.380:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.381:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.382:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.555:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken. :mozilla.556:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken. :mozilla.557:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken. :mozilla.558:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken. :mozilla.157:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.158:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.159:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.160:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Specificclick : No action taken. :mozilla.401:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.402:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.403:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.404:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.405:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.406:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.407:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.408:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.409:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.410:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.411:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.412:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.413:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.414:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.415:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.416:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.417:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.418:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.419:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.420:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.421:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.422:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.423:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.424:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.435:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.436:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.437:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.533:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tracking101 : No action taken. :mozilla.534:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tracking101 : No action taken. :mozilla.442:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.443:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.444:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.445:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.446:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.447:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.448:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.449:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.450:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken. :mozilla.454:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.455:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.456:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.457:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.458:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.459:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.460:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.461:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.462:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.463:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.464:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.465:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.466:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.6:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.7:C:\Documents and Settings\bbleichm\Application Data\Mozilla\Firefox\Profiles\wrozsgez.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. |
|
     |
| Sponsored Links |
|
09-21-2006, 09:37 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Do a HijackThis scan & place a check next to these items and select "Fix checked":
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R3 - Default URLSearchHook is missing O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab * * * * * * 1. Download this file using either of these links http://download.bleepingcomputer.com/sUBs/combofix.exe http://www.techsupportforum.com/sectools/combofix.exe 2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
|
|
|
|
|
09-21-2006, 10:22 PM
|
#3 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP
|
ok. done. (FYI, the computer rebooted in the middle of combofix process. I'm guessing that's normal...) Thank you for the prompt service!
Combofix Log: bbleichm - 06-09-21 22:07:48.21 Service Pack 2 ComboFix 06.09.21 - Running from: "C:\Documents and Settings\bbleichm\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\CLSID\{03D182D8-B809-45BF-B70F-332A030ED27F}] @="" [HKEY_CLASSES_ROOT\CLSID\{03D182D8-B809-45BF-B70F-332A030ED27F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{03D182D8-B809-45BF-B70F-332A030ED27F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{03D182D8-B809-45BF-B70F-332A030ED27F}\InprocServer32] @="C:\\WINDOWS\\system32\\movcrt40.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{422A6E9B-70A3-4367-A369-7AE8893B467B}] @="" [HKEY_CLASSES_ROOT\CLSID\{422A6E9B-70A3-4367-A369-7AE8893B467B}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{422A6E9B-70A3-4367-A369-7AE8893B467B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{422A6E9B-70A3-4367-A369-7AE8893B467B}\InprocServer32] @="C:\\WINDOWS\\system32\\nvptools.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{7270B2F5-F406-487C-8BF3-1FAF65370547}] @="" [HKEY_CLASSES_ROOT\CLSID\{7270B2F5-F406-487C-8BF3-1FAF65370547}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{7270B2F5-F406-487C-8BF3-1FAF65370547}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{7270B2F5-F406-487C-8BF3-1FAF65370547}\InprocServer32] @="C:\\WINDOWS\\system32\\trpmib.dll" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * FILES REMOVED: C:\WINDOWS\system32\fpn4035qe.dll C:\WINDOWS\system32\q6pslg7716.dll C:\WINDOWS\system32\guard.tmp Granting sedebugprivilege to Administrators ... successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\Eim03.exe ((((((((((((((((((((((((((((((( Files Created from 2006-08-21 to 2006-09-21 )))))))))))))))))))))))))))))))))) 2006-09-21 14:47 299,520 --a------ C:\WINDOWS\uninst.exe 2006-09-21 12:43 365,568 --a------ C:\WINDOWS\system32\bkd.exe 2006-09-21 12:43 32,768 --a------ C:\DXC1205b.exe 2006-09-21 12:43 299,036 --a------ C:\803_104.exe 2006-09-21 12:42 424,589 --a------ C:\912_121.exe 2006-09-21 12:37 268,581 --a------ C:\WINDOWS\popupwithcast.exe 2006-09-14 00:20 7,568 --a------ C:\WINDOWS\system32\APIGUIDE.DLL 2006-09-14 00:20 405,504 --a------ C:\WINDOWS\system32\vpep3235.dll 2006-09-14 00:20 39,424 --a------ C:\WINDOWS\system32\BarVisD.dll 2006-09-14 00:20 369,664 --a------ C:\WINDOWS\system32\Dav3_32.dll 2006-09-14 00:20 249,856 --a------ C:\WINDOWS\system32\vpdf32.dll 2006-09-14 00:20 180,224 --a------ C:\WINDOWS\system32\vchart3235.dll 2006-09-14 00:20 159,744 --a------ C:\WINDOWS\system32\dwStg.dll 2006-09-14 00:20 143,360 --a------ C:\WINDOWS\system32\leon3_32.dll 2006-09-14 00:20 113,664 --a------ C:\WINDOWS\system32\apigid32.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-21 22:08 -------- d-------- C:\Program Files\Mozilla Firefox 2006-09-21 17:46 -------- d-------- C:\Program Files\ewido anti-spyware 4.0 2006-09-21 14:48 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\WinPatrol 2006-09-21 14:47 -------- d-------- C:\Program Files\BillP Studios 2006-09-21 12:55 -------- d-------- C:\Program Files\Lavasoft 2006-09-21 12:55 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\Lavasoft 2006-09-21 12:47 -------- d-------- C:\Program Files\DeluxeCommunications 2006-09-21 12:43 32135 ---hs---- C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe 2006-09-21 12:43 -------- d-------- C:\Program Files\Common Files 2006-09-21 12:37 -------- d-------- C:\Program Files\popupwithcast 2006-09-20 22:15 -------- d-------- C:\Program Files\Nortel Networks 2006-09-19 23:10 -------- d-------- C:\Program Files\Foxit Software 2006-09-14 15:36 -------- d-------- C:\Program Files\Writer's Blocks 3 Trial 2006-08-26 21:09 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\SmartFTP 2006-08-14 17:52 78848 --a------ C:\WINDOWS\system32\nswCB.dll 2006-07-23 09:02 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\Help 2006-07-12 15:18 188490 --a------ C:\WINDOWS\system32\atasnt40.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey" "Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\"" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe" "QCTRAY"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE" "QCWLICON"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" "UC_Start"="C:\\Program Files\\IBM\\Updater\\\\ucstartup.exe" "TpShocks"="TpShocks.exe" "BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor" "BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.EXE" "BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor" "BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "MaxtorOneTouch"="C:\\Program Files\\Maxtor\\OneTouch\\utils\\Onetouch.exe" "MXOBG"="C:\\WINDOWS\\MXOALDR.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinPatrol"="C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\winpatrol.exe" "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce] "AAW"="" "SpybotSnD"="" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,d8,01,00,00,00,00,00,00,d9,01,00,00,00,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Communicator"="\"C:\\Program Files\\Microsoft Office Communicator\\Communicator.exe\"" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Communicator"="\"C:\\Program Files\\Microsoft Office Communicator\\Communicator.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20060921-220359-811 O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab backup-20060921-220359-262 R3 - Default URLSearchHook is missing backup-20060921-220359-789 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = Completion time: Thu 09/21/2006 22:12:39.11 ComboFix.txt ******************************************** HJT Log: Logfile of HijackThis v1.99.1 Scan saved at 10:16:09 PM, on 9/21/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\TpShocks.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\MXOALDR.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.openwave.com/default.aspx R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = O1 - Hosts: 127.0.0.2 rwc-ora-qa2 O1 - Hosts: 127.0.0.2 perforce O1 - Hosts: 127.0.0.2 perforce2 O1 - Hosts: 127.0.0.2 perforce3 O1 - Hosts: 127.0.0.2 perforce4 O1 - Hosts: 127.0.0.2 perforce5 O1 - Hosts: 127.0.0.2 perforce6 O1 - Hosts: 127.0.0.2 perforce7 O1 - Hosts: 127.0.0.2 perforce8 O1 - Hosts: 127.0.0.2 ptgtools O1 - Hosts: 127.0.0.2 perforce9 O1 - Hosts: 127.0.0.4 rwc-ora-qa2 O1 - Hosts: 127.0.0.5 rwc-ora-prod2 O1 - Hosts: 127.0.0.2 rwc-ldap-qa1 O1 - Hosts: 127.0.0.2 crownjewels O1 - Hosts: 127.0.0.2 p4test O1 - Hosts: 127.0.0.2 evoe O1 - Hosts: 127.0.0.2 evoe2 O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.myopwv.com O15 - Trusted Zone: *.netscaler.com O15 - Trusted Zone: *.openwave.com O15 - Trusted Zone: *.peopleclick.com O15 - Trusted Zone: *.myopwv.com (HKLM) O15 - Trusted Zone: *.netscaler.com (HKLM) O15 - Trusted Zone: *.openwave.com (HKLM) O15 - Trusted Zone: *.peopleclick.com (HKLM) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1119451976022 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136833846531 O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://openwave.webex.com/client/T2...ex/ieatgpc.cab O16 - DPF: {FD7C00A9-E676-11D6-A08E-00E09878F0CF} (Nsload Control) - https://rwc-sslvpn.openwave.com/vpns/scripts/nsload.ocx O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\Software\..\Telephony: DomainName = myopwv.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = myopwv.com O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE |
|
|
|
|
09-22-2006, 06:01 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Excellent, your pop ups should have abated
 Before fixing anything, Please download the Suspicious File Packer → http://www.safer-networking.org/files/sfp.zip Unzip it to the desktop and run it. Paste the following list of bad files into the Suspicious File Packer window: C:\WINDOWS\system32\bkd.exeAllow SFP to pack the files. This will generate a CAB archive on your desktop. Please submit it to this site → http://www.bleepingcomputer.com/subm....php?channel=4 Please include a link to this topic in the message. * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools → Folder Options → View tab.
* * * * * * * Next, perform an online scan using Internet Explorer at http://www.kaspersky.com/service?chapter=161739400 Answer Yes, when prompted to install an ActiveX component.
* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from:
__________________
|
|
|
|
|
09-22-2006, 10:21 AM
|
#5 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP
|
Again, thank you for the clear instructions. No issues so far. (And no more popups!) Looks like there are still plenty of ugly files on my computer, but I can't say that performance is affected noticably.
Kapersky and HJT logs are below... -------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, September 22, 2006 10:15:02 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 22/09/2006 Kaspersky Anti-Virus database records: 225605 -------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 50737 Number of viruses found: 23 Number of infected objects: 90 / 0 Number of suspicious objects: 3 Duration of the scan process: 00:58:33 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20060921_Time-221055031_EnterceptExceptions.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20060921_Time-221055031_EnterceptRules.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_OPWV-BBLEICHM.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_OPWV-BBLEICHM.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\bbleichm\Cookies\index.dat Object is locked skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/WINDOWS/system32/bkd.exe/InpB/DxcBho.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/WINDOWS/system32/bkd.exe/InpB/DxcCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/WINDOWS/system32/bkd.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/WINDOWS/system32/bkd.exe Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/DXC1205b.exe Infected: not-a-virus:AdWare.Win32.SurfSide.ax skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab/C:/912_121.exe Infected: Trojan-PSW.Win32.LdPinch.arr skipped C:\Documents and Settings\bbleichm\Desktop\requested-files[2006-09-22_08_55].cab CAB: infected - 6 skipped C:\Documents and Settings\bbleichm\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/benbb/14 Mar 2003 03:49 from jamie:Accuracy of this information..html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\bbleichm\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: suspicious - 1 skipped C:\Documents and Settings\bbleichm\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\bbleichm\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\bbleichm\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\bbleichm\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 17:34 from Yahoo! Mail Virus Protection <mail-antivi/27 Jan 2004 14:34 to benbb@sbcglobal.net:Hello/file.zip/file.htm .scr Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 17:34 from Yahoo! Mail Virus Protection <mail-antivi/27 Jan 2004 14:34 to benbb@sbcglobal.net:Hello/file.zip Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 21:14 from Yahoo! Mail Virus Protection <mail-antivi/27 Jan 2004 18:14 to benbb@sbcglobal.net:Paskbhpxqfhhgm/text.zip/text.pif Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 21:14 from Yahoo! Mail Virus Protection <mail-antivi/27 Jan 2004 18:14 to benbb@sbcglobal.net:Paskbhpxqfhhgm/text.zip Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 19:45 from Mail Administrator:Mail System Error - Re/27 Jan 2004 19:29 to ray@yahoo.com:test/document.zip/document.htm .scr Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/Deleted Items/27 Jan 2004 19:45 from Mail Administrator:Mail System Error - Re/27 Jan 2004 19:29 to ray@yahoo.com:test/document.zip Infected: Email-Worm.Win32.Mydoom.a skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst/Personal Folders/benbb/14 Mar 2003 03:49 from jamie:Accuracy of this information..html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\bbleichm\My Documents\backup.pst Mail MS Mail: infected - 6, suspicious - 1 skipped C:\Documents and Settings\bbleichm\NTUSER.DAT Object is locked skipped C:\Documents and Settings\bbleichm\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\DeluxeCommunications\DxcCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\Program Files\Yahoo!\Messenger\ypager.log Object is locked skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc2.exe/InpB/DxcBho.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc2.exe/InpB/DxcCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc2.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc2.exe CAB: infected - 3 skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc3.exe Infected: not-a-virus:AdWare.Win32.SurfSide.ax skipped C:\RECYCLER\S-1-5-21-1482476501-682003330-1801674531-26653\Dc4.exe Infected: Trojan-PSW.Win32.LdPinch.arr skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019199.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019200.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019202.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019203.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019204.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019219.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019223.dll Infected: not-a-virus:AdWare.Win32.Ucmore skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019226.dll Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019228.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019229.exe Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019230.exe Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019231.exe/unknown2.bin Infected: not-a-virus:AdWare.Win32.Ucmore.e skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019231.exe/UCMTSAIE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019231.exe/IUCMORE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019231.exe ZIP: infected - 3 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019231.exe WiseSFX Dropper: infected - 3 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019232.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019233.dll Infected: Trojan-Downloader.Win32.Dyfuca.gen skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019234.exe Infected: Trojan-Downloader.Win32.Dyfuca.ey skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019235.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019236.exe Infected: not-a-virus:AdWare.Win32.MediaMotor.o skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019238.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019239.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019240.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019241.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019251.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019253.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019254.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019257.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019258.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019260.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019261.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019262.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019263.exe RarSFX: infected - 6 skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019269.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019272.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019281.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019297.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019307.exe Infected: Trojan-Downloader.Win32.Adload.fp skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019309.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019310.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019318.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019319.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019331.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019332.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019347.exe Infected: not-a-virus:AdWare.Win32.Zestyfind skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019350.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019351.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019357.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019358.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019359.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ay skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019362.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019363.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019372.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019377.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019389.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019390.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019405.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019406.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019425.exe Infected: not-a-virus:AdWare.Win32.AdURL.c skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019426.exe Infected: not-a-virus:AdWare.Win32.Zestyfind skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019475.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP267\A0019476.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{72C79714-65DD-43F0-9213-02637B0923A2}\RP268\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ****************************************************** ****************************************************** Logfile of HijackThis v1.99.1 Scan saved at 10:19:40 AM, on 9/22/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\TpShocks.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINDOWS\MXOALDR.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Yahoo!\Messenger\YPager.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.openwave.com/default.aspx R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = O1 - Hosts: 127.0.0.2 rwc-ora-qa2 O1 - Hosts: 127.0.0.2 perforce O1 - Hosts: 127.0.0.2 perforce2 O1 - Hosts: 127.0.0.2 perforce3 O1 - Hosts: 127.0.0.2 perforce4 O1 - Hosts: 127.0.0.2 perforce5 O1 - Hosts: 127.0.0.2 perforce6 O1 - Hosts: 127.0.0.2 perforce7 O1 - Hosts: 127.0.0.2 perforce8 O1 - Hosts: 127.0.0.2 ptgtools O1 - Hosts: 127.0.0.2 perforce9 O1 - Hosts: 127.0.0.4 rwc-ora-qa2 O1 - Hosts: 127.0.0.5 rwc-ora-prod2 O1 - Hosts: 127.0.0.2 rwc-ldap-qa1 O1 - Hosts: 127.0.0.2 crownjewels O1 - Hosts: 127.0.0.2 p4test O1 - Hosts: 127.0.0.2 evoe O1 - Hosts: 127.0.0.2 evoe2 O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.myopwv.com O15 - Trusted Zone: *.netscaler.com O15 - Trusted Zone: *.openwave.com O15 - Trusted Zone: *.peopleclick.com O15 - Trusted Zone: *.myopwv.com (HKLM) O15 - Trusted Zone: *.netscaler.com (HKLM) O15 - Trusted Zone: *.openwave.com (HKLM) O15 - Trusted Zone: *.peopleclick.com (HKLM) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1119451976022 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136833846531 O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://openwave.webex.com/client/T2...ex/ieatgpc.cab O16 - DPF: {FD7C00A9-E676-11D6-A08E-00E09878F0CF} (Nsload Control) - https://rwc-sslvpn.openwave.com/vpns/scripts/nsload.ocx O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\Software\..\Telephony: DomainName = myopwv.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = myopwv.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = myopwv.com O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE |
|
|
|
|
09-22-2006, 10:39 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Desktop\requested-files[2006-09-22_08_55].cab
This is the file I had you create with the Suspicious File Packer. Please delete it. Then delete your existing copy of combofix & grab an updated copy from here: http://www.techsupportforum.com/sectools/combofix.exe Run it & post the resultant log.
__________________
|
|
|
|
|
09-22-2006, 11:15 AM
|
#7 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP
|
Ok. Problem.
I deleted the .cab file and the old version of combofix. I also downloaded the new version from the link you posted. When I run the new combofix it pops open a window that says: "combofix.ese has encountered a problem and needs to close. We are sorry for the inconvenience." I gives me the option to Debug or Close. Any suggestions? ben |
|
|
|
|
09-22-2006, 11:20 AM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
That copy got corrupted when I uploaded it. Try downloading it from here:
http://download.bleepingcomputer.com/sUBs/combofix.exe
__________________
|
|
|
|
|
09-22-2006, 11:30 AM
|
#9 (permalink) |
|
Registered User
Join Date: Sep 2006
Posts: 7
OS: XP
|
Yes. That one worked. Here is the log:
bbleichm - 06-09-22 11:23:44.98 Service Pack 2 ComboFix 06.09.23 - Running from: "C:\Documents and Settings\bbleichm\Desktop" Command switches used :: ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\DeluxeCommunications\Dxc.exe C:\Program Files\DeluxeCommunications\DxcCore.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((( Files Created from 2006-08-22 to 2006-09-22 )))))))))))))))))))))))))))))))))) 2006-09-14 00:20 7,568 --a------ C:\WINDOWS\system32\APIGUIDE.DLL 2006-09-14 00:20 405,504 --a------ C:\WINDOWS\system32\vpep3235.dll 2006-09-14 00:20 39,424 --a------ C:\WINDOWS\system32\BarVisD.dll 2006-09-14 00:20 369,664 --a------ C:\WINDOWS\system32\Dav3_32.dll 2006-09-14 00:20 249,856 --a------ C:\WINDOWS\system32\vpdf32.dll 2006-09-14 00:20 180,224 --a------ C:\WINDOWS\system32\vchart3235.dll 2006-09-14 00:20 159,744 --a------ C:\WINDOWS\system32\dwStg.dll 2006-09-14 00:20 143,360 --a------ C:\WINDOWS\system32\leon3_32.dll 2006-09-14 00:20 113,664 --a------ C:\WINDOWS\system32\apigid32.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-22 10:26 -------- d-------- C:\Program Files\Mozilla Firefox 2006-09-22 09:05 -------- d-------- C:\Program Files\Common Files 2006-09-21 17:46 -------- d-------- C:\Program Files\ewido anti-spyware 4.0 2006-09-21 14:48 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\WinPatrol 2006-09-21 14:47 -------- d-------- C:\Program Files\BillP Studios 2006-09-21 12:55 -------- d-------- C:\Program Files\Lavasoft 2006-09-21 12:55 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\Lavasoft 2006-09-20 22:15 -------- d-------- C:\Program Files\Nortel Networks 2006-09-19 23:10 -------- d-------- C:\Program Files\Foxit Software 2006-09-14 15:36 -------- d-------- C:\Program Files\Writer's Blocks 3 Trial 2006-08-26 21:09 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\SmartFTP 2006-07-23 09:02 -------- d-------- C:\Documents and Settings\bbleichm\Application Data\Help 2006-07-12 15:18 188490 --a------ C:\WINDOWS\system32\atasnt40.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey" "Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\"" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe" "QCTRAY"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE" "QCWLICON"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" "UC_Start"="C:\\Program Files\\IBM\\Updater\\\\ucstartup.exe" "TpShocks"="TpShocks.exe" "BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor" "BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.EXE" "BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor" "BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "MaxtorOneTouch"="C:\\Program Files\\Maxtor\\OneTouch\\utils\\Onetouch.exe" "MXOBG"="C:\\WINDOWS\\MXOALDR.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,bd,00,00,00,00,00,00,00,f4,02,00,00,00,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Communicator"="\"C:\\Program Files\\Microsoft Office Communicator\\Communicator.exe\"" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Communicator"="\"C:\\Program Files\\Microsoft Office Communicator\\Communicator.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\!ewido] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ewido" "hkey"="HKLM" "command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WinPatrol] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winpatrol" "hkey"="HKLM" "command"="C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\winpatrol.exe" "inimapping"="0" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: Fri 09/22/2006 11:26:45.84 ComboFix.txt ComboFix2.txt |
|
|
|
|
09-22-2006, 11:38 AM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
|
|
|
|
|
09-22-2006, 12:00 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Ewido is trialware. That's why I didnt list it.
There's no need to uninstall it. It will still be functional after the expiry of the trial period.
__________________
|
|
|
|
| Thread Tools | |
|
|
