Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Wierd virus! ...sytem32/1417376314.dll
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 02-09-2007, 07:11 AM   #1 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Cry Wierd virus! ...sytem32/1417376314.dll
Cant remove this as its running in system memory and wont let me delete.

I've got no idea what the dodgy service running is.

Heres my Hijackthis file

Logfile of HijackThis v1.99.1
Scan saved at 22:02:59, on 08/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\NewsLeecher\newsLeecher.exe
C:\WINDOWS\system32\divxsm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ALANST~1\LOCALS~1\Temp\Rar$EX00.823\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/webhp?source...lient&ie=UTF-8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...58/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~2\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iPod Service iPodseclogon (iPodseclogon) - Unknown owner - C:\WINDOWS\system32\32218.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 02-09-2007, 12:08 PM   #2 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


Hello Taki100, and welcome to TSF


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

HIJACK THIS IN TEMP FOLDER

You are running Hijack This from a temporary directory. It needs to be in a permanent folder. Please go into Windows Explorer,
click on C: then click on File > New > Folder and call it HJT , or another name of your choice. The program creates backup
files that we may need to use later. If the program is in a Temporary folder, files may be deleted by you or automatically if your
system is set to empty temp files.

----------------------------------------

DOWNLOADS


CLEANUP! version 4.52 – TEMP FILE CLEANING


Please download Cleanup! and install it. You will use this later.

Alternative link Cleanup Alt


*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.



AVG Anti-Spyware 7.5



Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"




  1. Install AVG Anti-Spyware 7.5.
  2. Double-click the icon on Desktop to launch AVG A-S 7.5
  3. On the top of the main screen click Shield
  4. Click the word active to change it to inactive
  5. On the top of the main screen click Update.
  6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.



ComboFix



1. Download this file - You MUST save it to your desktop

COMBOFIX




2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)


Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

RUNNING SCANNERS


Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files (if present)
  • Cleanup! All Users
  • Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.
Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.


AVG Anti-Spyware 7.5
  • Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
    This scan can take quite a while to run, so be prepared.
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.



  • When the scan is complete click Recommended Action and change it to Quarantine (1),
  • If not click Recommended Action and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.



Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan
  1. Click on located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

c:\combofix.txt
AVG A/S
Panda scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-10-2007, 01:48 AM   #3 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Cheers Mate.

I did all thing things you told me too and here are the resulting logs.


"Alan Stevens" - 07-02-09 20:20:44 Service Pack 2
ComboFix 07-02-08.2 - Running from: "C:\Documents and Settings\Alan Stevens\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\1417376314.dll
C:\WINDOWS\system32\472459550.dll
C:\WINDOWS\system32\drivers\npf.sys
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\Program Files\CURITY~1
C:\qoobox\purity\Program Files\CURITY~1\??curity
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0000
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0001
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0002
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0003
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0004
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0005
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0006
C:\qoobox\purity\Program Files\CURITY~1\??curity\ctxad-452.0007


((((((((((((((((((((((((((((((( Files Created from 2007-01-09 to 2007-02-09 ))))))))))))))))))))))))))))))))))


2007-02-09 20:17 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-02-09 20:17 <DIR> d-------- C:\Program Files\Grisoft
2007-02-09 20:12 <DIR> d-------- C:\HJT
2007-02-08 18:18 <DIR> d-------- C:\WINDOWS\McAfee.com
2007-02-07 18:43 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Sun
2007-02-05 18:42 <DIR> d-------- C:\Program Files\Schtrom
2007-02-03 20:14 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Application Data\Help
2007-02-03 19:17 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Adobe
2007-02-01 04:56 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-02-01 04:56 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-02-01 04:56 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-02-01 04:56 639,066 --a------ C:\WINDOWS\system32\DivX.dll
2007-01-31 21:46 <DIR> d-------- C:\Program Files\Xbox Backup Creator
2007-01-31 21:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-31 21:27 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-01-30 23:15 118,784 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-01-30 22:54 <DIR> d-------- C:\Program Files\Microsoft Windows Vista Upgrade Advisor
2007-01-30 04:56 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-01-29 17:08 0 --a------ C:\WINDOWS\system32\E6106F1D.exe
2007-01-28 19:11 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-01-28 19:11 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-01-28 19:11 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-01-28 18:20 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Phone Browser
2007-01-26 01:18 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-01-26 01:18 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-01-26 01:13 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-01-26 01:13 57,344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-01-26 01:13 53,248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-01-26 01:13 344,064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-01-26 01:13 294,912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-01-26 01:13 294,912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-01-26 01:13 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-01-16 19:57 <DIR> d-------- C:\Program Files\Elecard
2007-01-16 19:57 <DIR> d-------- C:\Program Files\Common Files\Elecard
2007-01-15 21:26 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Corel
2007-01-15 20:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Teleca(2)
2007-01-15 17:47 <DIR> d-------- C:\Program Files\DVBPortal
2007-01-13 22:10 <DIR> d-------- C:\Program Files\AC3Filter
2007-01-13 22:09 <DIR> d-------- C:\Program Files\GSpot
2007-01-11 11:47 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Real
2007-01-11 11:44 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Apple Computer
2007-01-10 21:42 <DIR> d-------- C:\DOCUME~1\ALANST~1\Application Data\NewsLeecher
2007-01-10 18:26 <DIR> d-------- C:\DOCUME~1\Anyone\Application Data\Google
2007-01-10 18:23 <DIR> d-------- C:\DOCUME~1\Anyone\Contacts
2007-01-09 21:08 <DIR> d-------- C:\WINDOWS\ie7updates


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-02-09 20:07 -------- d-------- C:\Program Files\mozilla firefox
2007-02-09 07:26 12 --a------ C:\WINDOWS\bthservsdp.dat
2007-02-08 17:44 20 --a------ C:\sccfg.sys
2007-02-07 20:46 146 --a------ C:\WINDOWS\system32\imon1.dat
2007-02-07 20:44 -------- d-------- C:\Program Files\divx
2007-02-03 19:41 1056 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-02-01 22:02 -------- d-------- C:\Program Files\google
2007-01-30 18:47 -------- d-------- C:\Program Files\newsleecher
2007-01-30 05:03 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-01-26 01:19 36624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-01-26 01:19 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-01-26 01:19 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-01-15 20:51 -------- d-------- C:\Program Files\Common Files\teleca shared
2007-01-10 20:12 -------- d-------- C:\Program Files\accurate shutdown
2007-01-09 19:14 -------- d--h----- C:\Program Files\installshield installation information
2007-01-08 17:05 -------- d-------- C:\DOCUME~1\ALANST~1\Application Data\newsbin
2007-01-08 17:04 -------- d-------- C:\Program Files\newsbin
2007-01-08 17:04 -------- d-------- C:\DOCUME~1\ALANST~1\Application Data\utorrent
2007-01-07 19:41 -------- d-------- C:\Program Files\utorrent
2007-01-06 17:42 -------- d-------- C:\Program Files\emule
2007-01-05 20:03 -------- d-------- C:\Program Files\counter-strike 1.6
2007-01-05 19:07 -------- d-------- C:\Program Files\trackmania united
2007-01-05 14:12 -------- d-------- C:\Program Files\imgburn
2007-01-05 14:12 -------- d-------- C:\DOCUME~1\ALANST~1\Application Data\imgburn
2006-12-30 21:14 -------- d-------- C:\DOCUME~1\ALANST~1\Application Data\divx
2006-12-22 19:24 -------- d-------- C:\Program Files\william hill poker
2006-12-19 21:14 -------- d-------- C:\Program Files\msn messenger
2006-12-19 20:55 10944 --a------ C:\WINDOWS\byefish.exe
2006-12-12 16:24 12288 --a------ C:\WINDOWS\system32\divxwmpexttype.dll
2006-12-10 14:02 -------- d-------- C:\Program Files\itunes
2006-12-10 14:02 -------- d-------- C:\Program Files\ipod
2006-12-10 14:01 -------- d-------- C:\Program Files\quicktime
2006-12-03 19:04 48424 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-11-27 20:44 737280 --a------ C:\WINDOWS\iun6002.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PeerGuardian"="C:\\Program Files\\PeerGuardian2\\pg2.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"SoundMan"="SOUNDMAN.EXE"
"nwiz"="nwiz.exe /install"
"CoolSwitch"="C:\\WINDOWS\\system32\\taskswitch.exe"
"DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe"
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"mspwr"="C:\\WINDOWS\\system32\\PuXpMan2.exe"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\not active]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk]
"backup"="C:\\WINDOWS\\pss\\BlueSoleil.lnkCommon Startup"
"location"="Common Startup"
"item"="BlueSoleil"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BJPSMAIN"
"hkey"="HKLM"
"command"="C:\\Program Files\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="isuspm"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\isuspm.exe -startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="issch"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LaunchApplication"
"hkey"="HKLM"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="StyleXP"
"hkey"="HKCU"
"command"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WFWIZ"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ERSvc"=dword:00000002
"StuffIt Task Manager"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="wbsys.dll"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=""

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
@="0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
bthsvcs REG_MULTI_SZ BthServ\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_DRIVER
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_GUARD


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\BitComet.job


********************************************************************

catchme 0.1 W2K/XP - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\windowfx3.ini 0 bytes
C:\WINDOWS\Windows Update Setup Files
C:\WINDOWS\Windows Update Setup Files\filelist.dat 24 bytes
C:\WINDOWS\Windows Update Setup Files\iesetup.dir 0 bytes
C:\WINDOWS\Windows Update.log 49152 bytes
C:\WINDOWS\WindowsShell.Manifest 4096 bytes
C:\WINDOWS\WindowsUpdate.log 1404928 bytes
C:\WINDOWS\winhelp.exe 258048 bytes
C:\WINDOWS\winhlp32.exe 286720 bytes
C:\WINDOWS\winnt.bmp 49152 bytes
C:\WINDOWS\winnt256.bmp 49152 bytes
C:\WINDOWS\WINNT32.LOG 32768 bytes
C:\WINDOWS\WinSxS
C:\WINDOWS\WinSxS\InstallTemp
C:\WINDOWS\WinSxS\Manifests
C:\WINDOWS\WinSxS\Policies
C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a
C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da
C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d
C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9841.0_x-ww_18171213
C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.10.0_x-ww_d8862ba3
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0
C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790
C:\WINDOWS\WMFDist11.log 57344 bytes
C:\WINDOWS\wmp11.log 40960 bytes
C:\WINDOWS\wmsetup.log 151552 bytes
C:\WINDOWS\wmsetup10.log 20480 bytes
C:\WINDOWS\WMSysPr9.prx 319488 bytes
C:\WINDOWS\WMSysPrx.prx 303104 bytes
C:\WINDOWS\wsdu.log 152 bytes
C:\WINDOWS\Wudf01000Inst.log 28672 bytes
C:\WINDOWS\XP2.bmp 978944 bytes
C:\WINDOWS\xpsp1hfm.log 8192 bytes
C:\WINDOWS\yacs.log 4096 bytes
C:\WINDOWS\YAHELITE.INI 8192 bytes
C:\WINDOWS\YAHELITE_IGNORE.INI 4096 bytes
C:\WINDOWS\YahSho.ini 24 bytes
C:\WINDOWS\YAHVOX_ignore.ini 16 bytes
C:\WINDOWS\_default.pif 712 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 53

********************************************************************

Completion time: 07-02-09 20:25:11

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 22:44:21 09/02/2007

+ Scan result:



C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/Casino.exe -> Adware.Casino : Ignored.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/casino.exe -> Adware.Casino : Ignored.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/UCMIE.dll -> Adware.Ucmore : Ignored.
C:\WINDOWS\system32\iifdeca.dll -> Adware.Virtumonde : Ignored.
C:\WINDOWS\Downloaded Program Files\AXWebMonProj1.ocx -> Backdoor.Ghost.34 : Cleaned with backup (quarantined).
C:\Program Files\Camfrog\Camfrog Video Chat 3.4\patch.exe -> Dropper.Delf.qo : Cleaned with backup (quarantined).
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.125:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.126:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.127:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.142:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.145:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.16:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.17:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.253:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.254:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.41:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
D:\Documents and Settings\MCX3\Cookies\mcx3@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.23:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.24:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.26:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.27:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.28:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.304:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.306:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.64:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.66:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.266:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.267:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.268:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.269:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.270:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.45:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.49:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.28:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.29:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.30:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.31:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.32:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@servedby.advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@servedby.advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.359:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Adviva : Cleaned.
:mozilla.36:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.40:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.57:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@bfast[1].txt -> TrackingCookie.Bfast : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.74:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.76:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.279:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.280:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.281:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.131:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@com[2].txt -> TrackingCookie.Com : Cleaned.
:mozilla.21:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.9:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
D:\Documents and Settings\MCX3\Cookies\mcx3@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.255:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.259:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.260:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.261:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.262:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.263:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.264:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.265:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.358:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.319:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.322:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.55:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@sel.as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.312:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.115:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.217:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.218:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.225:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.227:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.230:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.233:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.311:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.116:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.117:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.118:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.31:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.35:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.96:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.97:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@ehg-autotrader.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@ehg-hotgroup.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@ehg-idg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@counter.hitslink[2].txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.275:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Information : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.313:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.109:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.110:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.30:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.175:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.176:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.116:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.144:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@popunder.paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.320:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.276:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.33:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.34:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.35:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.36:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.37:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.38:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
D:\Documents and Settings\Taki\Cookies\taki@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@counter10.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.10:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.11:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.22:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.23:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.345:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.355:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.146:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.147:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.148:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@spylog[2].txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.20:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\t2pdcnmg.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.283:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.286:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.32:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.73:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.75:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.105:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.314:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.315:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.316:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.317:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.318:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.321:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.72:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.133:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.19:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.20:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.20:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.120:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.121:D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.14:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.8:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.272:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.273:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.274:C:\Documents and Settings\Anyone\Application Data\Mozilla\Firefox\Profiles\2q9p6dgf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\7,25,2005_20,46,26.zip/alan stevens@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\NoAdware\NoAdwareBackup\8,9,2005_20,8,29.zip/alan stevens@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP605\A0134927.dll -> Trojan.Ceda.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP601\A0132169.exe -> Trojan.ProcKill.DJ : Cleaned with backup (quarantined).


::Report end

Activescan

Incident Status Location

Virus:Bck/IRCbot.ZX Disinfected Operating system
Potentially unwanted tool:application/altnet Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\cookies.txt[.atdmt.com/]
Virus:Bck/IRCbot.ZX Disinfected C:\WINDOWS\system32\1417376314.dll
Potentially unwanted tool:Application/CloseApp Not disinfected C:\WINDOWS\system32\closeapp.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\iifdeca.dll
Spyware:Cookie/888 Not disinfected D:\Documents and Settings\Taki\Application Data\Mozilla\Firefox\Profiles\e1m2yejc.default\cookies.txt[.888.com/]
Hacktool:HackTool/Flood Not disinfected H:\xbox\XBINS-TIRC.rar[web\nHTMLn_2.92.dll]


Logfile of HijackThis v1.99.1
Scan saved at 08:47:19, on 10/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...58/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~2\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iPod Service iPodseclogon (iPodseclogon) - Unknown owner - C:\WINDOWS\system32\32218.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

I'll let you know how things go mate!!! Cheers for the help
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-10-2007, 11:34 AM   #4 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------


The dll file you originally complained about, as well as a Purity infection have been deleted. However, some junk still remains.


----------------------------------------

This file looks suspicious and there is not enough information about it to make a proper call. So:

Please submit the following file to Jotti File Scan

C:\WINDOWS\byefish.exe

At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box.
Then click "submit".

When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread.

----------------------------------------

FIXES AND DELETIONS


Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =



Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

Delete the following Files indicated in RED if they still exist.


C:\WINDOWS\iun6002.exe

C:\WINDOWS\system32\iifdeca.dll
C:\WINDOWS\system32\E6106F1D.exe


>>>If the files resist deletion, boot into Safe Mode and delete
----------------------------------------


ON-LINE SCANS


Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
    We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

[b]Jotti report
Kaspersky scan


Please let me know how your system is behaving.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-11-2007, 05:02 AM   #5 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


ok so i did all that and the .dll file still seems to be popping up and making itself an svchost.exe file. Once i remove this file from task manager nod32 stops it restarting one but it pops up every so often saying its found the 1417376314.dll. I stop the kasperksy scan when it started on my second OS as im not using tht at the mo

Jotti

Service load:
0% 100%
File: byefish.exe
Status:
OK
MD5 53f75a6539203fbdc17b149f3d7d1466
Packers detected:
-
Scanner results
Scan taken on 10 Feb 2007 19:46:46 (GMT)
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, February 10, 2007 10:50:02 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 10/02/2007
Kaspersky Anti-Virus database records: 266758
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
L:\
M:\
N:\
O:\
P:\
X:\
Y:\

Scan Statistics:
Total number of scanned objects: 182295
Number of viruses found: 25
Number of infected objects: 38 / 0
Number of suspicious objects: 0
Duration of the scan process: 02:46:13

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Alan Stevens\Application Data\Adobe\Acrobat\7.0\organizer70\files.MYD Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Adobe\Acrobat\7.0\organizer70\files.MYI Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Adobe\Acrobat\7.0\Taki.err Object is locked skipped
C:\Documents and Settings\Alan Stevens\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\Acr3403.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\Adobelm_Cleanup.0001.dir.0000\~efe2.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\Adobelm_Cleanup.0001.dir.0002\~efe2.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\~DF959A.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\ntuser.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\AntiPhishing\6D68D760-5380-40B8-A88E-13A27707960C.dat Object is locked skipped
C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\infected\2HYLMZBA.NQF Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\Program Files\ESET\infected\4ROP05CA.NQF Infected: Trojan-Dropper.Win32.Agent.ahx skipped
C:\Program Files\ESET\infected\5W2CIVCA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\A30RCWDA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0023.BIN/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0023.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.EZula.bc skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0035.BIN Infected: not-a-virus:AdWare.Win32.Gator.1050 skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF WiseSFX: infected - 4 skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF PE-Crypt.XorPE: infected - 4 skipped
C:\Program Files\ESET\infected\AFS0ARDA.NQF Infected: Trojan-Proxy.Win32.Wopla.ac skipped
C:\Program Files\ESET\infected\BPVAHCDA.NQF Infected: not-a-virus:AdWare.Win32.Virtumonde.bs skipped
C:\Program Files\ESET\infected\CJXUV2BA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\DF5XYMAA.NQF Infected: IM-Worm.Win32.Kelvir.bp skipped
C:\Program Files\ESET\infected\DPJARWBA.NQF Infected: not-a-virus:AdWare.Win32.EliteBar.ba skipped
C:\Program Files\ESET\infected\E2OUATCA.NQF Infected: Trojan.Win32.Zapchast.cp skipped
C:\Program Files\ESET\infected\HPAKWRDA.NQF Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Program Files\ESET\infected\IT2T5FBA.NQF Infected: Trojan-Downloader.Win32.IstBar.lq skipped
C:\Program Files\ESET\infected\JPY1ZLBA.NQF Infected: Trojan-Clicker.Win32.Costrat.ae skipped
C:\Program Files\ESET\infected\JT33A2AA.NQF Infected: not-virus:Hoax.Win32.Renos.gc skipped
C:\Program Files\ESET\infected\MBNUKDCA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\NM3JDLBA.NQF Infected: Trojan-Dropper.Win32.Pakes skipped
C:\Program Files\ESET\infected\PUJ312BA.NQF Infected: Rootkit.Win32.Agent.cf skipped
C:\Program Files\ESET\infected\RXE3SYAA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\SHS54VDA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\TYFS2LBA.NQF Infected: Trojan.Win32.Agent.vg skipped
C:\Program Files\ESET\infected\U4LJUNAA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.em skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0004 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF NSIS: infected - 3 skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF PE-Crypt.XorPE: infected - 3 skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\PeerGuardian2\history.db Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP603\A0133518.bat Infected: Trojan.BAT.Zapchast skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP610\A0135412.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bs skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP610\A0135418.dll Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP610\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{BB105614-C67C-47CB-8DDB-8CC873C1E94E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\1417376314.dll Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\closeapp.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan was interrupted by user!
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-11-2007, 10:37 AM   #6 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


I'm not sure I understand why you stopped Kaspersky as it is reporting 25 viruses and 38 objects but it was stopped before it could
log them. This indicates your system could be seriously infected but I can't tell without the information.

The original file (1417376314.dll) was deleted by ComboFix. If it is coming back, then there is someting in there which is causing it.

Please complete these next steps.

----------------------------------------


Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
    We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

SYSTEM REPAIR ENGINEER

Please download this tool >http://www.kztechs.com/sreng/sreng2.zip]System Repair Engineer


  • Extract it to it's own folder & double click SREng.exe to run it

  • Select 'Smart Scan' & tick "Verify Digital Signatures"

  • Click on the [Scan] button

  • When finished, click on the [Save Reports] button & save the log to Desktop

  • Attach the log in your next reply. Dont post it


Note: You may have to rename SREngLog.log to SREngLog.txt before attaching

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

[b]
Kaspersky scan
SREng log (attached)

Please let me know how your system is behaving.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-12-2007, 02:42 PM   #7 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Ok sorry about that. Last time i did the scan the virus was eating up 78% of my CPU.I did it all this time though. Sorry about that. I had a look through the kaspersky scan and it looks like its Trojan-PSW.Win32.Ceda.b thats causing the major problem.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 12, 2007 9:22:32 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 12/02/2007
Kaspersky Anti-Virus database records: 267092
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
L:\
M:\
N:\
O:\
P:\
X:\
Y:\

Scan Statistics:
Total number of scanned objects: 223684
Number of viruses found: 26
Number of infected objects: 42 / 0
Number of suspicious objects: 0
Duration of the scan process: 03:33:29

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\cert8.db Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\history.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\key3.db Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\parent.lock Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Alan Stevens\Application Data\Mozilla\Firefox\Profiles\ykcy1uol.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Alan Stevens\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\History\History.IE5\MSHist012007021220070213\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\~DF6A6A.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temp\~DFBCF6.tmp Object is locked skipped
C:\Documents and Settings\Alan Stevens\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\ntuser.dat Object is locked skipped
C:\Documents and Settings\Alan Stevens\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\AntiPhishing\6D68D760-5380-40B8-A88E-13A27707960C.dat Object is locked skipped
C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\infected\2HYLMZBA.NQF Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\Program Files\ESET\infected\4ROP05CA.NQF Infected: Trojan-Dropper.Win32.Agent.ahx skipped
C:\Program Files\ESET\infected\5W2CIVCA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\A30RCWDA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0023.BIN/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0023.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.EZula.bc skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF/WISE0035.BIN Infected: not-a-virus:AdWare.Win32.Gator.1050 skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF WiseSFX: infected - 4 skipped
C:\Program Files\ESET\infected\AE2O0VCA.NQF PE-Crypt.XorPE: infected - 4 skipped
C:\Program Files\ESET\infected\AFS0ARDA.NQF Infected: Trojan-Proxy.Win32.Wopla.ac skipped
C:\Program Files\ESET\infected\BPVAHCDA.NQF Infected: not-a-virus:AdWare.Win32.Virtumonde.bs skipped
C:\Program Files\ESET\infected\CJXUV2BA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\DF5XYMAA.NQF Infected: IM-Worm.Win32.Kelvir.bp skipped
C:\Program Files\ESET\infected\DPJARWBA.NQF Infected: not-a-virus:AdWare.Win32.EliteBar.ba skipped
C:\Program Files\ESET\infected\E2OUATCA.NQF Infected: Trojan.Win32.Zapchast.cp skipped
C:\Program Files\ESET\infected\HPAKWRDA.NQF Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Program Files\ESET\infected\IT2T5FBA.NQF Infected: Trojan-Downloader.Win32.IstBar.lq skipped
C:\Program Files\ESET\infected\JPY1ZLBA.NQF Infected: Trojan-Clicker.Win32.Costrat.ae skipped
C:\Program Files\ESET\infected\JT33A2AA.NQF Infected: not-virus:Hoax.Win32.Renos.gc skipped
C:\Program Files\ESET\infected\MBNUKDCA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\NM3JDLBA.NQF Infected: Trojan-Dropper.Win32.Pakes skipped
C:\Program Files\ESET\infected\PUJ312BA.NQF Infected: Rootkit.Win32.Agent.cf skipped
C:\Program Files\ESET\infected\RXE3SYAA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\SHS54VDA.NQF Infected: Trojan.Win32.Dialer.oy skipped
C:\Program Files\ESET\infected\TYFS2LBA.NQF Infected: Trojan.Win32.Agent.vg skipped
C:\Program Files\ESET\infected\U4LJUNAA.NQF Infected: Trojan-Downloader.Win32.Small.ayl skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.em skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF/data0004 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF NSIS: infected - 3 skipped
C:\Program Files\ESET\infected\WIWL1HCA.NQF PE-Crypt.XorPE: infected - 3 skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\PeerGuardian2\history.db Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP603\A0133518.bat Infected: Trojan.BAT.Zapchast skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP610\A0135418.dll Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\System Volume Information\_restore{13B9AB68-59DA-40B9-BB5C-495E69A9E7CC}\RP611\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\1417376314.dll Infected: Trojan-PSW.Win32.Ceda.b skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\closeapp.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
H:\Programs and games\Mirc 6.16 Crack.zip/mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
H:\Programs and games\Mirc 6.16 Crack.zip/mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
H:\Programs and games\Mirc 6.16 Crack.zip ZIP: infected - 2 skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
H:\xbox\XBINS-TIRC.rar/Xbins.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped
H:\xbox\XBINS-TIRC.rar RAR: infected - 1 skipped
I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
X:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Y:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.
Attached Files
File Type: txt SREngLOG.txt (54.1 KB, 1 views)
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-12-2007, 10:00 PM   #8 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


[color=green]This bloody dll just does not want to go away. We'll have to try another tool.[color]

----------------------------------------

You appear to have crack software on your system (H:\Programs and games\Mirc 6.16 Crack.zip/mirc616.exe/data0001.bin) This type of
software will always leave your system suseptable to repeat infection

----------------------------------------


AVENGER


1. Please download The Avenger to your Desktop.
  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):


Code:
Files to Delete:
C:\WINDOWS\system32\1417376314.dll 	
C:\WINDOWS\system32\closeapp.exe
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage
the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.


4. The Avenger will automatically do the following:
  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip


5. Please copy/paste the content of c:\avenger.txt at the end of this fix.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-13-2007, 01:07 PM   #9 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Ok. I deleted the mirc stuff and ran avenger.my svchost still seems to be working overtime even though im not doin anything

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vios^fqf

*******************

Script file located at: \??\C:\Documents and Settings\pbhwrjfb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\1417376314.dll deleted successfully.
File C:\WINDOWS\system32\closeapp.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-13-2007, 08:21 PM   #10 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


The remaining infected files look like their in you ESET program, possibly in a folder marked "infected". Look in that program foldeer and delete these NQF files:

C:\Program Files\ESET\ \2HYLMZBA.NQF
C:\Program Files\ESET\ \4ROP05CA.NQF
C:\Program Files\ESET\ \5W2CIVCA.NQF
C:\Program Files\ESET\ \A30RCWDA.NQF
C:\Program Files\ESET\ \AE2O0VCA.NQF
C:\Program Files\ESET\ \AE2O0VCA.NQF
C:\Program Files\ESET\ \AFS0ARDA.NQF
C:\Program Files\ESET\ \BPVAHCDA.NQF
C:\Program Files\ESET\ \CJXUV2BA.NQF
C:\Program Files\ESET\ \DF5XYMAA.NQF
C:\Program Files\ESET\ \DPJARWBA.NQF
C:\Program Files\ESET\ \E2OUATCA.NQF
C:\Program Files\ESET\ \HPAKWRDA.NQF
C:\Program Files\ESET\ \IT2T5FBA.NQF
C:\Program Files\ESET\ \JPY1ZLBA.NQF
C:\Program Files\ESET\ \JT33A2AA.NQF
C:\Program Files\ESET\ \MBNUKDCA.NQF
C:\Program Files\ESET\ \NM3JDLBA.NQF
C:\Program Files\ESET\ \PUJ312BA.NQF
C:\Program Files\ESET\ \RXE3SYAA.NQF
C:\Program Files\ESET\ \SHS54VDA.NQF
C:\Program Files\ESET\ \TYFS2LBA.NQF
C:\Program Files\ESET\ \U4LJUNAA.NQF
C:\Program Files\ESET\ \WIWL1HCA.NQF
C:\Program Files\ESET\ \WIWL1HCA.NQF
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-14-2007, 12:52 PM   #11 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Ok just deleted those but i still keep getting the original dll file popping up on my antivirus
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-14-2007, 01:23 PM   #12 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


Looks like a real stubborn one, just won't let go.

Please post the AV log which is showing the dll.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-14-2007, 03:02 PM   #13 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Here you go.Thanks for the help by the way. Ive attached a the log
Attached Files
File Type: txt New Text Document.txt (8.8 KB, 3 views)
Last edited by Taki100; 02-14-2007 at 03:04 PM.
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-14-2007, 09:47 PM   #14 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


The file has been deleted and is currently in your Anti-Virus program's Quarantine folder where it will not harm your system.
Delete the contents of Quarantine.


Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below.


----------------------------------------

Windows XP - Reset Hidden Files

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore
  • To turn off System Restore click Start > Right Click My Computer > Properties.
  • Click the System Restore tab and Check
  • "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
  • When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

  • Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
  • Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
  • Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

Clear IE's Cookies and Cache
  • Close all instances of Outlook Express and Internet Explorer.
  • Go to Control Panel » Internet Options » General tab.
  • Click the Delete Cookies.
  • Next to it, Click the Delete Files button.
  • When prompted, place a check in: Delete all offline content, click OK.


RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.


KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.


ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".


ENABLE WINDOWS AUTO UPDATE

From within Internet Explorer click on the Tools menu and then click on Internet Options.
  • Select the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Select Custom Level .
      • Change 'Download signed ActiveX controls' to Prompt
      • Change 'Download unsigned ActiveX controls' to Disable
      • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
      • Change 'Installation of desktop items' to Prompt
      • Change 'Launching programs and files in an IFRAME' to Prompt
      • Change 'Navigate sub-frames across different domains' to Prompt
      • When all these changes have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Select OK to exit the Internet Properties page.



TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
  • After you have updated, click the button - enable protection for all unprotected items


SpywareGuard to catch and block spyware before it can execute.


SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here


IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
  • From within the folder, double-click install.bat
  • Select Option #2 - Install the new IE-SPYAD list.
  • Then return to the main menu.
  • Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here


MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
  • Click Next, click Next, select the option:
    "Show Extracted files"
  • Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.


MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.


ANTI-VIRUS AND FIREWALL PROGRAMS


ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:



If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls


INFORMATIONAL READING


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:



Please respond one more time and let me know you received this post so it can be marked resolved



If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-15-2007, 10:55 AM   #15 (permalink)
Registered User
 
Join Date: Feb 2007
Posts: 8
OS: XP


Ok mate. I've dont that. I'll see how things go. Thanks again!
Taki100 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 02-15-2007, 11:27 AM   #16 (permalink)
Analyst, Security Team ; TSF Supporter
 
fredmh's Avatar
 
Join Date: May 2006
Location: Phila,Pa
Posts: 2,335
OS: XP


Your welcome.
__________________
fredmh is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 01:41 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85