|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-03-2006, 07:00 AM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
Spyware Issues
Hey, im having a lot of spyware issues on my computer. i started having the poblem on yahoo, when i would search for something and click the link of what i would search, it would redirect me to some other site.
now there r popups as well. i ran Ad-aware and Spybot S&D plus PC Tools Anti-virus, and they all detected and cleaned things up, but now Spybot and Ad-aware freeze in the middle of their scans and i find when i reboot my PC, theres more spyware on my computer. Heres the hijack log: Logfile of HijackThis v1.99.1 Scan saved at 8:58:52 AM, on 03/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\Service.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\PC Tools AntiVirus\ScanningProcess.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\{1094D352-0640-4105-0727-040410270002}\Update.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe C:\Program Files\PC Tools AntiVirus\Monitor.exe C:\Program Files\Hiiack This\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\Yahoo!\Common\unyext.exe C:\Program Files\Outlook Express\msimn.exe R3 - URLSearchHook: (no name) - _{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O1 - Hosts: localhost 127.0.0.1 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nse336.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [keyboard] c:\\keyboard1.exe O4 - HKLM\..\Run: [mousepad] C:\\mousepad1.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\owinmpes.exe ELT001 O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe O4 - HKLM\..\Run: [{4D-D3-35-52-ZN}] C:\windows\system32\oldsregn.exe ELT001 O4 - HKLM\..\Run: [dmvaz.exe] C:\WINDOWS\system32\dmvaz.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe O4 - HKCU\..\Run: [zzzr] C:\PROGRA~1\COMMON~1\zzzr\zzzrm.exe O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\Ciampa\LOCALS~1\Temp\stdrun165632.exe O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing) O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing) O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O15 - Trusted Zone: *.elitemediagroup.net O15 - Trusted Zone: *.mmohsix.com O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/apop/def...ploader_v6.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CCS\Services\Tcpip\..\{3E62BA68-2FB4-4F82-BEE2-D0B54DD350F1}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 O17 - HKLM\System\CS1\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 O17 - HKLM\System\CS2\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\mv2ul9f91.dll (file missing) O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe ive also removed any spyware from add/remove programs a couple of time. any help would be greatly appreciated Vinny |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-04-2006, 02:46 PM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi Vinny and welcome to the Security Forum.
You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply. You may want to print out these instructions for reference, since you will have to restart your computer during the fix. Please download FixWareout or use this alternate location. Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal. When your system reboots, follow the prompts. Afterwards, HijackThis will launch (if it doesn't, please launch it manually). Please click Scan, and check the following items: O17 - HKLM\System\CCS\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CCS\Services\Tcpip\..\{3E62BA68-2FB4-4F82-BEE2-D0B54DD350F1}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 O17 - HKLM\System\CS1\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 O17 - HKLM\System\CS2\Services\Tcpip\..\{385FA9DE-6095-44A0-ADF0-3D96AB168742}: NameServer = 85.255.113.126,85.255.112.229 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.126 85.255.112.229 Please remember to close all other windows, including browsers then click Fix checked. At the end of the fix, you may need to restart your computer again. Perform an online scan with Internet Explorer with Panda ActiveScan Click on the "Free To Use ActiveScan" located on the top right hand corner. 1. Click Check Now and a "pop up" window will appear. *Please ensure that your pop up blocker doesn't block it * 2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place * Begin the scan by selecting My Computer
*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. *Turn off the real time scanner of any existing antivirus program while performing the online scan Finally, please post the contents of the logfile C:\fixwareoutreport.txt, along with a new HijackThis log and the results of the Panda scan.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-04-2006, 09:48 PM
|
#3 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
spyware issues
All the scans were completed.
Here is the Fixwareout report: Fixwareout ver 1.003 Last edited 8/11/2006 Post this report in the forums please Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\smomd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AAC44C78B8C-E2FA-26D4-576E-EBF9FBB4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\3 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\owt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif ... Microsoft (R) Windows Script Host Version 5.6 Random Runs removed from HKLM "dmoms.exe"=- ... PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names... * csr.exe C:\WINDOWS\System32\CSERY.EXE »»»»» Search five digit cs, dm and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\CSERY.EXE 51 271 2006-07-28 C:\WINDOWS\SYSTEM32\DMOMS.EXE 61 965 2004-08-04 Other suspects. Directory of C:\WINDOWS\system32 {00422582-2E19-4239-9F87-44A72C22FD65}.exe {C3D075D8-54B0-44C7-82C1-AC630A3799AB}.exe »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool. C:\WINDOWS\System32\service.exe Here is the Hijack report after i deleted the items you told me: Logfile of HijackThis v1.99.1 Scan saved at 11  11 PM, on 04/10/2006Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\PC Tools AntiVirus\ScanningProcess.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\{1094D352-0640-4105-0727-040410270002}\Update.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\winstall.exe C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe C:\Program Files\Hiiack This\HijackThis.exe R3 - URLSearchHook: (no name) - _{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsb108.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe O4 - HKLM\..\Run: [{4D-D3-35-52-ZN}] C:\windows\system32\oldsregn.exe ELT001 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\Ciampa\LOCALS~1\Temp\stdrun165632.exe O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/apop/def...ploader_v6.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe And here is the Panda Scan log: Incident Status Location Adware:Adware/Maxifiles Not disinfected C:\Program Files\Common Files\{1094D352-0640-4105-0727-040410270002}\Update.exe Adware:adware/adsmart Not disinfected c:\windows\system32\kernels8.exe Virus:trj/srchspy.a Disinfected Operating system Virus:w32/locksky.au.worm Disinfected Operating system Adware:adware/mirar Not disinfected c:\windows\system32\WinNB58.dll Virus:trj/torpig.a Disinfected Operating system Adware:adware/spysheriff Not disinfected c:\winstall.exe Adware:adware/dollarrevenue Not disinfected c:\windows\gimmygames.dat Adware:adware/portalscan Not disinfected c:\program files\common files\Slmss Adware:adware/savenow Not disinfected Windows Registry Adware:adware/adrotator Not disinfected Windows Registry Potentially unwanted tool:application/kill&clean Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BF69DF00-2734-477F-8257-27CD04F88779} Adware:adware/powerstrip Not disinfected Windows Registry Adware:adware/sidesearch Not disinfected Windows Registry Adware:adware/dyfuca Not disinfected Windows Registry Adware:Adware/BraveSentry Not disinfected C:\Documents and Settings\Ciampa\Application Data\Install.dat Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@247realmedia[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@ad.yieldmanager[2].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@ads.pointroll[1].txt Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@adtech[2].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@apmebf[1].txt Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@as-us.falkag[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@bs.serving-sys[2].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@c.enhance[1].txt Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@findwhat[1].txt Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@qksrv[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@questionmarket[1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@server.iad.liveperson[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@serving-sys[2].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@statcounter[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@tribalfusion[1].txt Adware:Adware/CommAd Not disinfected C:\WINDOWS\Q2hyaXN0b3BoZXIgQ2lhbXBh\kZ1VurhXva1CtrK0kZ51vr11.vbs Virus:Trj/Ruins.MB Disinfected C:\WINDOWS\system32\csery.exe Virus:Trj/Ruins.MB Disinfected C:\WINDOWS\system32\dmoms.exe Potentially unwanted tool:Application/Kill&Clean Not disinfected C:\WINDOWS\system32\{00422582-2E19-4239-9F87-44A72C22FD65}.exe[KillAndClean.exe] Potentially unwanted tool:Application/Kill&Clean Not disinfected C:\WINDOWS\system32\{00422582-2E19-4239-9F87-44A72C22FD65}.exe[KillAndCleanUpdate.exe] Adware:Adware/QuickWeb Keep me posted, Thanks. Vin |
|
|
|
|
10-05-2006, 03:06 PM
|
#4 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi again Vinny
Good work – one down – quite a lot to do in this one, so read everything carefully and work your way through it step by step. Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below. Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean. Show Hidden Files Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option. Downloads Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later. *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Download Ewido Anti-Malware This is a 30 day trial
If you are having problems with the updater, you can use this link to manually update Ewido. When you have finished updating, EXIT Ewido. Please download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop. Do not use it yet! Please download the Brute Force Uninstaller to your desktop.
Save it in the same folder you made earlier (c:BFU). Do not do anything with these yet! Download this file - combofix.exe to your desktop. Alternative download location here. IMPORTANT - You must place combofix on your desktop!! Double click combofix.exe & follow the prompts. When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply Note: Do not mouseclick combofix's window while it's running. That may cause it to stall. Reboot Reboot your system in Safe Mode.
HijackThis Entries Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any) R3 - URLSearchHook: (no name) - _{A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file) O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsb108.dll O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe O4 - HKLM\..\Run: [{4D-D3-35-52-ZN}] C:\windows\system32\oldsregn.exe ELT001 O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\Ciampa\LOCALS~1\Temp\stdrun165632.exe O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) Please remember to close all other windows, including browsers then click Fix checked. File Deletions Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\WINDOWS\System32\service.exe <- - Be careful - look for the correct filename C:\Program Files\Common Files\{1094D352-0640-4105-0727-040410270002} C:\WINDOWS\system32\{00422582-2E19-4239-9F87-44A72C22FD65}.exe C:\WINDOWS\system32\{C3D075D8-54B0-44C7-82C1-AC630A3799AB}.exe c:\windows\system32\kernels8.exe c:\windows\system32\WinNB58.dll c:\program files\common files\Slmss Run SmitfraudFix Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool. Select option #2 - Clean by typing 2 and press Enter. Wait for the tool to complete and disk cleanup to finish. You will be prompted : " Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter. The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question " Replace infected file?" by typing Y and hit Enter. A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode. The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply. Run CleanUp! *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows: Click Options Move the slider button down to Custom CleanUp! Check the following:
Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted. Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility. Go to Control Panel click Display > Desktop > Customize Desktop > Web > Now, Uncheck Everything and delete if present: • "Security Info" • "Warning Message" • "Security Desktop" • "Warning Homepage" • "Desktop Uninstall" Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK. Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin. Run Ewido Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
NOTE: Ewido scan may require an hour. Run the Brute Force Uninstaller Then, please go to Start > My Computer and navigate to the C:\BFU folder.
SmitfraudFix - Additional Items Open the SmitfraudFix folder and double-click smitfraudfix.cmd Select option #3 - Delete Trusted zone by typing 3 and press Enter **Note** This will remove all entries in the "Trusted Zone" - if you want them back, you have to add them back to the Trusted Sites again. Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection. Online Scan Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner Next Click on Launch Kaspersky Anti-Virus Web Scanner You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
Now under select a target to scan: Select My Computer
* Turn off the real time scanner of any existing antivirus program while performing the online scan Logs required combofix.txt rapport.txt Ewido Log Kaspersky Log HijackThis Log Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced from Normal Mode.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-06-2006, 07:07 PM
|
#5 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
Spyware Issues
Hey, thanks for all the help. My computer is running much better and that windows bubble saying my computer is infected stops popping up which is a good start.
here r all the logs Combofix: Ciampa - 06-10-05 22:51:04.25 Service Pack 2 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Ciampa\Desktop" ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\Ciampa\Application Data\Dxcknwrd.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\Ciampa\Application Data\Install.dat C:\WINDOWS\system32\aaa00000.sys C:\WINDOWS\system32\kernels8.exe C:\WINDOWS\system32\WinNB58.dll C:\winstall.exe C:\Program Files\Common Files\{1094D352-0640-4105-0727-040410270002} ((((((((((((((((((((((((((((((( Files Created from 2006-09-05 to 2006-10-05 )))))))))))))))))))))))))))))))))) 2006-10-05 22:43 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-10-04 16:25 32,768 --a------ C:\WINDOWS\system32\six.exe 2006-09-29 13:02 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2006-09-29 13:02 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2006-09-28 11:30 830 --a------ C:\WINDOWS\system32\winpfg32.sys 2006-09-28 11:29 1,233 --a------ C:\WINDOWS\system32\joc0e388.sys 2006-09-28 09:24 75,264 --a------ C:\WINDOWS\system32\nsu22.dll 2006-09-22 10:36 53,248 --a------ C:\WINDOWS\uni_7eh.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-05 22:53 -------- d-a------ C:\Program Files\Common Files 2006-10-05 22:43 -------- d-------- C:\Program Files\Grisoft 2006-10-05 22:13 -------- d-------- C:\Program Files\PC Tools AntiVirus 2006-10-04 23:24 -------- d-------- C:\Program Files\Spybot 2006-10-04 23:24 -------- d-------- C:\Program Files\QuickTime 2006-10-04 23:17 -------- d-------- C:\Program Files\iTunes 2006-10-04 23:17 -------- d-------- C:\Program Files\Internet Explorer 2006-10-04 23:17 -------- d-------- C:\Program Files\Hiiack This 2006-09-29 18:13 -------- d-------- C:\Program Files\Messenger 2006-09-29 18:12 -------- d-------- C:\Program Files\Windows Media Player 2006-09-29 18:02 -------- d-------- C:\Program Files\Outlook Express 2006-09-29 18:02 -------- d-------- C:\Program Files\Common Files\System 2006-09-29 09:42 -------- d-------- C:\Documents and Settings\Ciampa\Application Data\PC Tools 2006-09-06 15:43 -------- d-------- C:\Program Files\MSN Messenger 2006-09-03 23:37 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 05:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-08 21:31 98304 --a------ C:\WINDOWS\W2BNEUnin.exe 2006-08-08 21:31 2829 --a------ C:\WINDOWS\W2BNEUnin.pif 2006-07-28 17:43 45568 --a------ C:\WINDOWS\system32\{C3D075D8-54B0-44C7-82C1-AC630A3799AB}.exe 2006-07-28 17:43 424718 --a------ C:\WINDOWS\system32\{00422582-2E19-4239-9F87-44A72C22FD65}.exe 2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot" "SHS"="\"C:\\Program Files\\Rogers\\SelfHealing\\SHS.exe\" /background" "Update Manager"="\"C:\\Program Files\\Rogers\\Update Manager\\UpdateManager.exe\" /background" "Winsvr"="C:\\DOCUME~1\\Ciampa\\LOCALS~1\\Temp\\stdrun165632.exe" "PCTAVApp"="\"C:\\Program Files\\PC Tools AntiVirus\\PCTAV.exe\" /MONITORSCAN" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\\Program Files\\Creative\\SB Live! 24-bit\\Surround Mixer\\CTSysVol.exe /r" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "POINTER"="point32.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe " "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe" "MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe" "MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "IMEKRMIG6.1"="C:\\WINDOWS\\ime\\imkr6_1\\IMEKRMIG.EXE" "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "sachost"="C:\\WINDOWS\\sachostx.exe" "{4D-D3-35-52-ZN}"="C:\\windows\\system32\\oldsregn.exe ELT001" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,c4,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,4b,00,00,00,00,00,00,00,b5,04,00,00,c4,03,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,4b,00,00,00,00,00,00,00,b5,04,00,00,c4,03,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "ClassicShell"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "IEFilter"="{690F6A1B-8C7D-4020-92B0-AFA351689F0B}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: 05/10/2006 22:53:57.37 ComboFix.txt SmitFraudFix: SmitFraudFix v2.105 Scan done at 23:04:30.53, 05/10/2006 Run from C:\Documents and Settings\Ciampa\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\gimmygames.dat Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End Ewido: --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 7:05:35 AM 06/10/2006 + Scan result: C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005054.exe -> Adware.Agent : No action taken. C:\Documents and Settings\All Users\Application Data\AutoSearch.dll -> Adware.AutoSearch : No action taken. HKLM\SOFTWARE\Classes\Interface\{06CA2DA3-3A44-4FC7-8FD9-246C0F53407C} -> Adware.CoolWebSearch : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004029.exe -> Adware.FindSpy : No action taken. HKU\S-1-5-21-583907252-1715567821-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000001-C003-4A2F-9142-7CB1D78DE6C1} -> Adware.InternetOptimizer : No action taken. C:\WINDOWS\em.ocx -> Adware.MediaMotor : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005040.dll -> Adware.Mirar : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005103.exe -> Adware.Msnagent : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP6\A0002966.dll -> Adware.TrafficSol : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP3\A0000898.exe -> Adware.ZenoSearch : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002995.exe -> Adware.ZenoSearch : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002996.exe -> Adware.ZenoSearch : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP2\A0000126.dll -> Downloader.Agent.awb : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP2\A0000127.dll -> Downloader.Agent.awb : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004046.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002990.exe -> Downloader.Small.dnk : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002992.exe -> Downloader.Tibs.dr : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004041.exe -> Downloader.Tibs.id : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005039.exe -> Downloader.Tibs.ij : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP3\A0000893.exe -> Dropper.Agent.mu : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002993.exe -> Hijacker.Spywad.o : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004040.exe -> Proxy.Small : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002994.exe -> Trojan.Sinowal.ay : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004045.dll -> Trojan.Sinowal.az : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004044.dll -> Trojan.Sinowal.ba : No action taken. C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004047.exe -> Trojan.Small.fb : No action taken. C:\WINDOWS\uni_7eh.exe -> Trojan.VB.tg : No action taken. ::Report end Kaspersky: Friday, October 06, 2006 8:57:44 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 6/10/2006 Kaspersky Anti-Virus database records: 229359 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 48312 Number of viruses found 26 Number of infected objects 33 / 0 Number of suspicious objects 0 Duration of the scan process 00:44:54 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\AutoSearch.dll Infected: not-a-virus:AdWare.Win32.AutoSearch.b skipped C:\Documents and Settings\Ciampa\Application Data\PC Tools\PC Tools AntiVirus\Application Logs\PCToolsAntivirus.txt Object is locked skipped C:\Documents and Settings\Ciampa\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Ciampa\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Musicmatch\Jukebox\mmjbaltlog.txt Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Musicmatch\Jukebox\mmjblog.txt Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Musicmatch\MIM\Database\Default.ldb Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Application Data\Musicmatch\MIM\Database\Default.mdb Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Temp\JET6608.tmp Object is locked skipped C:\Documents and Settings\Ciampa\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Ciampa\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Ciampa\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\PC Tools AntiVirus\PCTAVService.txt Object is locked skipped C:\Program Files\PC Tools AntiVirus\~ulo Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP2\A0000126.dll Infected: Trojan-Downloader.Win32.Agent.awb skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP2\A0000127.dll Infected: Trojan-Downloader.Win32.Agent.awb skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP3\A0000893.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP3\A0000898.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP6\A0002966.dll Infected: not-a-virus:AdWare.Win32.TrafficSol.c skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002990.exe Infected: Trojan-Downloader.Win32.Small.dnk skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002992.exe Infected: Trojan-Downloader.Win32.Tibs.dr skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002993.exe Infected: Trojan-Clicker.Win32.Spywad.o skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002994.exe Infected: Trojan-PSW.Win32.Sinowal.ay skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002995.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0002996.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.s skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004029.exe Infected: not-a-virus:AdWare.Win32.FindSpy.a skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004039.dll Infected: Trojan-Spy.Win32.Small.ez skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004040.exe Infected: Trojan-Spy.Win32.Small.ez skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004041.exe Infected: Trojan-Downloader.Win32.Tibs.id skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004044.dll Infected: Trojan-PSW.Win32.Sinowal.ba skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004045.dll Infected: Trojan-PSW.Win32.Sinowal.az skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004046.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP7\A0004047.exe Infected: Trojan.Win32.Small.fb skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005039.exe Infected: Trojan-Downloader.Win32.Tibs.ij skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005040.dll Infected: not-a-virus:AdWare.Win32.Mirar.a skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005041.exe Infected: not-virus:Hoax.Win32.Renos.ff skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005054.exe Infected: not-a-virus:AdWare.Win32.Agent.y skipped C:\System Volume Information\_restore{993CABA7-7E82-49F6-A485-6341BD6A8DDE}\RP8\A0005103.exe Infected: not-a-virus:AdWare.Win32.Msnagent.b skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\em.ocx Infected: Trojan-Dropper.Win32.VB.dq skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\six.exe Infected: not-virus:Hoax.Win32.Renos.ff skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\uni_7eh.exe Infected: Trojan.Win32.VB.tg skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped F:\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN/clientax.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped F:\BearShare\Installer\BSInstall5.2.5.1.exe/WISE0026.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped F:\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFX: infected - 2 skipped F:\BearShare\Installer\BSInstall5.2.5.1.exe WiseSFX Dropper: infected - 2 skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. HiJack: Logfile of HijackThis v1.99.1 Scan saved at 9:07:27 PM, on 06/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PC Tools AntiVirus\ScanningProcess.exe C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Hiiack This\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsa10AB.dll O2 - BHO: Banner Rotator - {E954DB82-1533-4714-92F2-59C98D5C18CC} - C:\WINDOWS\system32\brrotate.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [adstart] "iexplore.exe" "http://iesettingsupdate" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/apop/def...ploader_v6.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe pretty long post...keep me posted thanks! Vin |
|
|
|
|
10-07-2006, 09:37 AM
|
#6 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi again Vinny
Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below. Disable AVG Anti Spyware's Guard Please disable AVG Anti Spyware's Guard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
Download CWShredder and run it. Click Check for Update. Click on 'Fix' (it will automatically fix anything it finds for you) and then click OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit. Reboot Reboot your system in Safe Mode.
HijackThis Entries Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any) O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsa10AB.dll O2 - BHO: Banner Rotator - {E954DB82-1533-4714-92F2-59C98D5C18CC} - C:\WINDOWS\system32\brrotate.dll O4 - HKLM\..\Run: [adstart] "iexplore.exe" "http://iesettingsupdate" Please remember to close all other windows, including browsers then click Fix checked. File Deletions Delete the following Files indicated in RED if they still exist. C:\WINDOWS\system32\nsa10AB.dll C:\WINDOWS\system32\brrotate.dll C:\WINDOWS\system32\ehlzi.dll C:\WINDOWS\system32\ehlzic.exe C:\WINDOWS\system32\qrkyfc.exe C:\Documents and Settings\All Users\Application Data\AutoSearch.dll C:\WINDOWS\em.ocx C:\WINDOWS\system32\six.exe C:\WINDOWS\system32\joc0e388.sys C:\WINDOWS\system32\nsu22.dll C:\WINDOWS\uni_7eh.exe Reboot Reboot your system in Normal Mode. Please run combofix again. Run another online scan with Panda. Logs required combofix.txt Panda Log HijackThis Log Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced from Normal Mode.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-07-2006, 02:57 PM
|
#7 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
spyware issues
my computer is running better than before. im not sure if my harddrive is messed up because of the spyware, but it is really loud when it loads sometimes, and it also sounds as if it is having trouble reading some stuff. but ptoblems i can actually see r popups when i open webpages.
here r the logs: Combofix Ciampa - 06-10-07 14:49:25.54 Service Pack 2 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Ciampa\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-09-07 to 2006-10-07 )))))))))))))))))))))))))))))))))) 2006-10-05 22:43 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-09-29 13:02 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2006-09-29 13:02 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2006-09-28 11:30 830 --a------ C:\WINDOWS\system32\winpfg32.sys 2006-09-28 09:24 75,264 --a------ C:\WINDOWS\system32\nsm10E0.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-07 14:26 -------- d-------- C:\Program Files\PC Tools AntiVirus 2006-10-07 14:19 -------- d-------- C:\Program Files\Hiiack This 2006-10-05 23:03 -------- d-a------ C:\Program Files\Common Files 2006-10-05 22:43 -------- d-------- C:\Program Files\Grisoft 2006-10-04 23:24 -------- d-------- C:\Program Files\Spybot 2006-10-04 23:24 -------- d-------- C:\Program Files\QuickTime 2006-10-04 23:17 -------- d-------- C:\Program Files\iTunes 2006-10-04 23:17 -------- d-------- C:\Program Files\Internet Explorer 2006-09-29 18:13 -------- d-------- C:\Program Files\Messenger 2006-09-29 18:12 -------- d-------- C:\Program Files\Windows Media Player 2006-09-29 18:02 -------- d-------- C:\Program Files\Outlook Express 2006-09-29 18:02 -------- d-------- C:\Program Files\Common Files\System 2006-09-29 09:42 -------- d-------- C:\Documents and Settings\Ciampa\Application Data\PC Tools 2006-09-06 15:43 -------- d-------- C:\Program Files\MSN Messenger 2006-09-03 23:37 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 05:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-08 21:31 98304 --a------ C:\WINDOWS\W2BNEUnin.exe 2006-08-08 21:31 2829 --a------ C:\WINDOWS\W2BNEUnin.pif 2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot" "SHS"="\"C:\\Program Files\\Rogers\\SelfHealing\\SHS.exe\" /background" "Update Manager"="\"C:\\Program Files\\Rogers\\Update Manager\\UpdateManager.exe\" /background" "PCTAVApp"="\"C:\\Program Files\\PC Tools AntiVirus\\PCTAV.exe\" /MONITORSCAN" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\\Program Files\\Creative\\SB Live! 24-bit\\Surround Mixer\\CTSysVol.exe /r" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "POINTER"="point32.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe " "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe" "MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe" "MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "IMEKRMIG6.1"="C:\\WINDOWS\\ime\\imkr6_1\\IMEKRMIG.EXE" "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "IEFilter"="{690F6A1B-8C7D-4020-92B0-AFA351689F0B}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: 07/10/2006 14:50:18.39 ComboFix.txt ComboFix2.txt Panda Incident Status Location Adware:adware/savenow Not disinfected Windows Registry Adware:adware/adrotator Not disinfected Windows Registry Potentially unwanted tool:application/kill&clean Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BF69DF00-2734-477F-8257-27CD04F88779} Adware:adware/mirar Not disinfected Windows Registry Adware:adware/powerstrip Not disinfected Windows Registry Adware:adware/sidesearch Not disinfected Windows Registry Adware:adware/dyfuca Not disinfected Windows Registry Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@2o7[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@ads.pointroll[2].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@apmebf[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@atdmt[2].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@c.enhance[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@doubleclick[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@mediaplex[1].txt Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@qksrv[2].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ciampa\Cookies\ciampa@questionmarket[1].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ciampa\Desktop\SmitfraudFix\Process.exe Adware:Adware/CommAd Not disinfected C:\WINDOWS\Q2hyaXN0b3BoZXIgQ2lhbXBh\kZ1VurhXva1CtrK0kZ51vr11.vbs Hijack Logfile of HijackThis v1.99.1 Scan saved at 4:56:57 PM, on 07/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\PC Tools AntiVirus\ScanningProcess.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Hiiack This\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsm10E0.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/apop/def...ploader_v6.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe also, what does "run hijack this in normal mode" mean? and what have i been running it in? Vin |
|
|
|
|
10-07-2006, 04:09 PM
|
#8 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi again
Your logs have been run from Normal Mode which is fine, i.e, normal boot up rather than Safe Mode. Some users do run a log from Safe Mode but this does not show us all the running processes, so I include that line just in case. Please delete the following file and folder C:\WINDOWS\system32\nsm10E0.dll C:\WINDOWS\Q2hyaXN0b3BoZXIgQ2lhbXBh Note: If they resist you may have to boot to Safe Mode to delete them. Are you still getting pop ups? Can you tell me what they say or what they are advertising?
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-08-2006, 09:58 PM
|
#9 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
There r still some popups when certain pages open, like this one.
the popups ive noticed r a download for AOL safety and secutiry centre http://daol.aol.com and one for partypoker.com the computer seems to be running fine, but the hard drive is still kinda loud sometimes, almost sounds as if its been damaged. Vinny |
|
|
|
|
10-09-2006, 02:51 PM
|
#10 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi Vinny
Sounds like your hard drive may be on the way out. make sure you have all data backed up. I'm not seeing anything that would account for the pop ups though. Please run combofix again and post back with the log - no need for an HJT log just now.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-11-2006, 03:20 PM
|
#11 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
spyware issues
Thanks for all your help...there is still the odd popup, im thinking i may just copy My Docs, and program files and format my C: drive over the weekend.
Here's the combofix log again: Ciampa - 06-10-11 16:48:18.54 Service Pack 2 ComboFix 06.10.11 - Running from: "C:\Documents and Settings\Ciampa\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-09-11 to 2006-10-11 )))))))))))))))))))))))))))))))))) 2006-10-10 10:39 78,848 --a------ C:\WINDOWS\system32\nss5D.dll 2006-10-10 10:39 78,848 --a------ C:\WINDOWS\system32\nsc5FD.dll 2006-10-10 10:39 78,848 --a------ C:\WINDOWS\system32\nsc45.dll 2006-09-29 13:02 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2006-09-29 13:02 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2006-09-28 11:30 830 --a------ C:\WINDOWS\system32\winpfg32.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-10 23:36 -------- d-------- C:\Program Files\PC Tools AntiVirus 2006-10-07 16:56 -------- d-------- C:\Program Files\Hiiack This 2006-10-07 15:04 -------- d-------- C:\Program Files\Spybot 2006-10-07 15:04 -------- d-------- C:\Program Files\QuickTime 2006-10-07 15:03 -------- d-------- C:\Program Files\MSN Messenger 2006-10-07 14:59 -------- d-------- C:\Program Files\iTunes 2006-10-07 14:58 -------- d-------- C:\Program Files\Internet Explorer 2006-10-05 23:03 -------- d-a------ C:\Program Files\Common Files 2006-10-05 22:43 -------- d-------- C:\Program Files\Grisoft 2006-09-29 18:13 -------- d-------- C:\Program Files\Messenger 2006-09-29 18:12 -------- d-------- C:\Program Files\Windows Media Player 2006-09-29 18:02 -------- d-------- C:\Program Files\Outlook Express 2006-09-29 18:02 -------- d-------- C:\Program Files\Common Files\System 2006-09-29 09:42 -------- d-------- C:\Documents and Settings\Ciampa\Application Data\PC Tools 2006-09-03 23:37 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 05:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-08 21:31 98304 --a------ C:\WINDOWS\W2BNEUnin.exe 2006-08-08 21:31 2829 --a------ C:\WINDOWS\W2BNEUnin.pif 2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot" "SHS"="\"C:\\Program Files\\Rogers\\SelfHealing\\SHS.exe\" /background" "Update Manager"="\"C:\\Program Files\\Rogers\\Update Manager\\UpdateManager.exe\" /background" "PCTAVApp"="\"C:\\Program Files\\PC Tools AntiVirus\\PCTAV.exe\" /MONITORSCAN" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\\Program Files\\Creative\\SB Live! 24-bit\\Surround Mixer\\CTSysVol.exe /r" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "POINTER"="point32.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe " "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe" "MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe" "MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "IMEKRMIG6.1"="C:\\WINDOWS\\ime\\imkr6_1\\IMEKRMIG.EXE" "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "IEFilter"="{690F6A1B-8C7D-4020-92B0-AFA351689F0B}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: 11/10/2006 16:49:16.42 ComboFix.txt i'm also having a bit of a problem with my folder options. whenever i change the view of a folder (ex. change from thumbnails to tiles) it changes all of my folders to that view. the checkbox that asks if u want to do this isnt checked. ive reset my folder options a few times, but it still happens. any ideas? Vinny |
|
|
|
|
10-11-2006, 04:19 PM
|
#12 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi Vinny
Still some files to be deleted. C:\WINDOWS\system32\nss5D.dll C:\WINDOWS\system32\nsc5FD.dll C:\WINDOWS\system32\nsc45.dll C:\WINDOWS\system32\winpfg32.sys Note: If they resist you may have to boot to Safe Mode to delete them. The folders thing sounds like a Windows issue – let’s hold off on that one here. You’d probably be better posting in the XP Forum for that. Once you've deleted those files run combofix again and post the log.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-13-2006, 08:53 PM
|
#13 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
i deleted those files but i cant run combofix, when i double click it, it asks to run it, i click run, and the window opens and closes right away.
Heres the Hijack log: Logfile of HijackThis v1.99.1 Scan saved at 10:53:04 PM, on 13/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\PC Tools AntiVirus\ScanningProcess.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Hiiack This\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsi17.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/apop/def...ploader_v6.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O21 - SSODL: IEFilter - {690F6A1B-8C7D-4020-92B0-AFA351689F0B} - C:\WINDOWS\system32\IEFilter.dll (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe |
|
|
|
|
10-14-2006, 09:48 AM
|
#14 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi Vinny
Let’s dig deeper… Gmer Download GMER and extract it to your desktop. Double-click gmer.exe to run it and select the rootkit tab. Press scan. When it has finished, press copy and paste the log back here. Blacklight Download and run Blacklight Note that you must have local administrative privileges to run the program. Click Scan. BlackLight will use Windows Explorer (the desktop process) to scan for hidden items. Your anti-virus software or personal firewall might display a warning that says Blacklight (blbeta.exe) is trying to manipulate the Windows Explorer process (explorer.exe). If you want to continue the scan, you should allow BlackLight to do this. When it finishes, click Next. You may get a screen similar to the picture below. Click on Close. BlackLight beta will create a log file called "fsbl-<date-and-time>.log". By default, the log file is in the same directory as the executable. Please post the log.  I therefore need the logs from Gmer and Blacklight.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-16-2006, 02:27 PM
|
#15 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
heres the 2 logs but it doesnt seem like there is much info.
Backlight Log: 10/16/06 15:36:36 [Info]: BlackLight Engine 1.0.47 initialized 10/16/06 15:36:36 [Info]: OS: 5.1 build 2600 (Service Pack 2) 10/16/06 15:36:37 [Note]: 7019 4 10/16/06 15:36:37 [Note]: 7005 0 10/16/06 15:36:41 [Note]: 7006 0 10/16/06 15:36:41 [Note]: 7011 188 10/16/06 15:36:41 [Note]: 7026 0 10/16/06 15:36:42 [Note]: 7026 0 10/16/06 15:36:55 [Note]: FSRAW library version 1.7.1020 10/16/06 16:24:29 [Note]: 7007 0 GMER: GMER 1.0.11.11390 - http://www.gmer.net Rootkit 2006-10-16 14:48:47 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.11 ---- SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwClose SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwCreateProcess SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwCreateProcessEx SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwCreateSection SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwOpenProcess SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwQueryInformationFile SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwSetInformationProcess SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS ZwTerminateProcess SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[284] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[285] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[286] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[287] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[288] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[289] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[290] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[291] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[292] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[293] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[294] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[295] SSDT \??\C:\PROGRA~1\PCTOOL~1\KLIF.SYS SSDT[296] ---- Files - GMER 1.0.11 ---- ADS ... ADS ... ---- EOF - GMER 1.0.11 ---- |
|
|
|
|
10-16-2006, 03:20 PM
|
#16 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Hi Vinny
To be honest I wasn't expecting to see anything. And I was correct. Are you still getting some pop ups? Is there anything else happening that's out of the normal routine?
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
10-16-2006, 05:01 PM
|
#17 (permalink) |
|
Registered User
Join Date: Mar 2006
Posts: 14
OS: WinXP
|
its weird, i only get popups on some sites, the only site i can say i get a popup everytime is this site here, but i do check this more frequently than others right now. while typing this message i got a popup for search007.
|
|
|
|
| Thread Tools | |
|
|
and select alcanshorty.bfu
