|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-01-2007, 06:05 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 9
OS: XP
|
POP-UPS I can't get rid of! Hijackthis Log
I am gtting Popups on IE and on Firefox
Please help it is annoying the hell outta me Here is my Log Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 9:59:03 PM, on 1/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RegSrvc.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Ipwindows\ipwins.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\All Blacks Desktop Alert\All Blacks Desktop Alert.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\DOCUME~1\Owner\LOCALS~1\Temp\_All Blacks Desktop Alert.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\xymqnamp.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {923A294D-B7D9-E20D-F1DB-B2DEB4B408C0} - C:\WINDOWS\system32\ggxbfvr.dll (file missing) O2 - BHO: (no name) - {A782E194-EA97-4F2A-99C1-8EB42A0B519E} - C:\WINDOWS\system32\urqolmk.dll O2 - BHO: (no name) - {C56E2A4A-B782-B30A-F1DB-B2DEB4B759C3} - C:\WINDOWS\system32\fxcstlnb.dll (file missing) O2 - BHO: (no name) - {F53187E0-44B0-4C3B-B7EC-24634111862D} - C:\WINDOWS\system32\gebbx.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\vinjrlxh.dll",setvm O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Aaou] "C:\WINDOWS\ICROSO~1\msconfig.exe" -vt yazb O4 - HKCU\..\Run: [Rwedczvt] "C:\Program Files\Common Files\?ystem\spoolsv.exe" 99001396 O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Policies\Explorer\Run: [{F00F7581-05D7-1033-1201-03030915003d}] "C:\Program Files\Common Files\{F00F7581-05D7-1033-1201-03030915003d}\Update.exe" mc-110-12-0000140 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: All Blacks Desktop Alert.lnk = C:\Program Files\All Blacks Desktop Alert\All Blacks Desktop Alert.exe O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O20 - Winlogon Notify: gebbx - C:\WINDOWS\system32\gebbx.dll O20 - Winlogon Notify: urqolmk - C:\WINDOWS\SYSTEM32\urqolmk.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\Win32\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\RpcSandraSrv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 11715 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-06-2007, 07:07 PM
|
#3 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
1. Download this file -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
04-10-2007, 02:03 AM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 9
OS: XP
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Here is the CimboFix Log
"Owner" - 07-04-10 17:36:05 Service Pack 2 ComboFix - Running from: "C:\Documents and Settings\Owner\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\Common Files\Yazzle1396OinUninstaller.exe C:\WINDOWS\system32\tmp83.tmp C:\Program Files\winupdates\a.zip C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\wcpsvsu.exe C:\Program Files\inetget2 C:\Program Files\winupdates C:\Program Files\Common Files\{300F7~1 C:\Program Files\Common Files\{F00F7~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-04 09:49 132,116 --a------ C:\WINDOWS\system32\isghjchv.dll 2007-04-02 16:51 132,116 --a------ C:\WINDOWS\system32\ilsbnxhu.dll 2007-04-02 14:36 48,708 --a------ C:\WINDOWS\system32\wsylqgdx.dll 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-02 11:17 132,116 --a------ C:\WINDOWS\system32\uerslcax.dll 2007-04-02 10:54 132,116 --a------ C:\WINDOWS\system32\qvkpvjdg.dll 2007-04-01 10:21 519,666 ---hs---- C:\WINDOWS\system32\xbbeg.ini2 2007-03-30 20:27 523,217 ---hs---- C:\WINDOWS\system32\xbbeg.bak2 2007-03-29 19:19 76,412 --a------ C:\WINDOWS\system32\wokfnkcy.dll 2007-03-29 19:18 523,684 ---hs---- C:\WINDOWS\system32\xbbeg.bak1 2007-03-29 19:18 48,708 --a------ C:\WINDOWS\system32\xymqnamp.dll 2007-03-29 19:18 280,676 ---h----- C:\WINDOWS\system32\gebbx.dll 2007-03-29 19:13 26,694 --a------ C:\WINDOWS\system32\urqolmk.dll 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-25 14:26 41 --a------ C:\WINDOWS\system32\dceecee0_s.dll 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:08 77 --a------ C:\WINDOWS\system32\n.bat 2007-03-03 20:07 90112 --a------ C:\WINDOWS\system32\smsc.exe 2007-03-03 20:07 63 --a------ C:\WINDOWS\system32\yyd.bat 2007-03-03 20:07 40106 --a------ C:\WINDOWS\system32\x.dat 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Aaou"="\"C:\\WINDOWS\\ICROSO~1\\msconfig.exe\" -vt yazb" "Rwedczvt"="\"C:\\Program Files\\Common Files\\?ystem\\spoolsv.exe\" 99001396" "IpWins"="C:\\Program Files\\Ipwindows\\ipwins.exe" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" @="" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsgPlus" "hkey"="HKLM" "command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{A782E194-EA97-4F2A-99C1-8EB42A0B519E}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"=dword:00000000 "NoLogoff"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 "NoActiveDesktop"=dword:00000001 "NoWindowsUpdate"=dword:00000000 "StartMenuLogOff"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbx HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqolmk [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SCDEMU Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 17:54:12 C:\ComboFix-quarantined-files.txt ... 07-04-10 17:54 And the new hijack this log Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 6:03:04 PM, on 10/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RegSrvc.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe O2 - BHO: (no name) - {0467EE5F-6632-4029-B402-C5D6A50E279E} - C:\WINDOWS\system32\gebbx.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\wsylqgdx.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {A782E194-EA97-4F2A-99C1-8EB42A0B519E} - C:\WINDOWS\system32\urqolmk.dll O2 - BHO: (no name) - {E89FDD3A-7FFC-4F80-A04C-4CF5891E9F19} - C:\WINDOWS\system32\isghjchv.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Aaou] "C:\WINDOWS\ICROSO~1\msconfig.exe" -vt yazb O4 - HKCU\..\Run: [Rwedczvt] "C:\Program Files\Common Files\?ystem\spoolsv.exe" 99001396 O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: gebbx - C:\WINDOWS\system32\gebbx.dll O20 - Winlogon Notify: urqolmk - C:\WINDOWS\SYSTEM32\urqolmk.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\Win32\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\RpcSandraSrv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 11179 bytes |
|
|
|
|
04-10-2007, 03:01 AM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
1. * IMPORTANT !!! Place combofix.exe on your Desktop
 2. Go to  → Run → paste in the single line command & click OKCode:
"%userprofile%\desktop\combofix.exe" /v isghjchv ilsbnxhu wsylqgdx uerslcax qvkpvjdg wokfnkcy xymqnamp gebbx urqolmk Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ------------------ After ComboFix has rebooted the machine, open notepad and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Code:
REGEDIT4
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Aaou"=-
"Rwedczvt"=-
"IpWins"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
@=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A782E194-EA97-4F2A-99C1-8EB42A0B519E}"=-
"{0467EE5F-6632-4029-B402-C5D6A50E279E}"=-
"{57E218E6-5A80-4f0c-AB25-83598F25D7E9}"=-
"{E89FDD3A-7FFC-4F80-A04C-4CF5891E9F19}"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"=-
"NoLogoff"=-
"ForceActiveDesktopOn"=-
"NoActiveDesktop"=-
"NoWindowsUpdate"=-
"StartMenuLogOff"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbx]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqolmk]
[-HKEY_CLASSES_ROOT\CLSID\{0467EE5F-6632-4029-B402-C5D6A50E279E}]
[-HKEY_CLASSES_ROOT\CLSID\{57E218E6-5A80-4f0c-AB25-83598F25D7E9}]
[-HKEY_CLASSES_ROOT\CLSID\{A782E194-EA97-4F2A-99C1-8EB42A0B519E}]
[-HKEY_CLASSES_ROOT\CLSID\{E89FDD3A-7FFC-4F80-A04C-4CF5891E9F19}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0467EE5F-6632-4029-B402-C5D6A50E279E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{57E218E6-5A80-4f0c-AB25-83598F25D7E9}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A782E194-EA97-4F2A-99C1-8EB42A0B519E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E89FDD3A-7FFC-4F80-A04C-4CF5891E9F19}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
Save this as fix.reg Choose to "Save type as - All Files" It should look like this:  Double click on fix.reg & allow it to merge into the registry ------------------ If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools → Folder Options → View tab.
--------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
--------------- When all that is done, run Combofix once more & post the resultant log. In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
04-10-2007, 06:39 AM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Code:
"%userprofile%\desktop\combofix.exe" /v isghjchv ilsbnxhu wsylqgdx uerslcax qvkpvjdg wokfnkcy xymqnamp gebbx urqolmk PASTE it into the`Run' box as depicted in picture below
__________________
Question - what have you done for the community today? |
|
|
|
|
04-10-2007, 07:05 AM
|
#8 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 9
OS: XP
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Hijack this log
Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 11:03:00 PM, on 10/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\RegSrvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\Win32\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007\RpcSandraSrv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 10540 bytes Online Scan ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, April 10, 2007 10:41:38 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/04/2007 Kaspersky Anti-Virus database records: 293477 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 114602 Number of viruses found: 8 Number of infected objects: 37 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:02:58 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\cert8.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\history.dat Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\key3.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\parent.lock Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\search.sqlite Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\backups\backup-20070410-180724-565.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\Documents and Settings\Owner\Desktop\backups\backup-20070410-180724-768.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\Documents and Settings\Owner\Desktop\backups\backup-20070410-180724-826.dll Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Owner\Desktop\backups\backup-20070410-180725-735.dll Infected: Packed.Win32.Klone.j skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143126-133.dll Infected: Packed.Win32.Klone.j skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143126-766.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143126-771.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143149-457.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143149-788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143632-294.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143632-771.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\backup-20070402-143653-689.dll Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\vg2mm3bn.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\QooBox\Quarantine\WINDOWS\system32\gebbx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\QooBox\Quarantine\WINDOWS\system32\ilsbnxhu.dll.vir Infected: Packed.Win32.Klone.j skipped C:\QooBox\Quarantine\WINDOWS\system32\isghjchv.dll.vir Infected: Packed.Win32.Klone.j skipped C:\QooBox\Quarantine\WINDOWS\system32\qvkpvjdg.dll.vir Infected: Packed.Win32.Klone.j skipped C:\QooBox\Quarantine\WINDOWS\system32\uerslcax.dll.vir Infected: Packed.Win32.Klone.j skipped C:\QooBox\Quarantine\WINDOWS\system32\urqolmk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\QooBox\Quarantine\WINDOWS\system32\wokfnkcy.dll.vir Infected: Trojan-Spy.Win32.VBStat.h skipped C:\QooBox\Quarantine\WINDOWS\system32\wsylqgdx.dll.vir Infected: Trojan.Win32.BHO.g skipped C:\QooBox\Quarantine\WINDOWS\system32\xymqnamp.dll.vir Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP701\A0098686.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111096.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111097.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111098.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111099.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111100.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111101.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111102.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111103.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111104.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gl skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111106.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111126.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111126.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\A0111126.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{E9CDD440-2479-4740-82D3-57FEB8AC552B}\RP707\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\dkeomxbd.dll Infected: Trojan.Win32.BHO.g skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\xeebxdgo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped C:\WINDOWS\Temp\Perflib_Perfdata_240.dat Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_6ac.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Comboxfix Scan 1 "Owner" - 07-04-10 5:36:05 Service Pack 2 ComboFix - Running from: "C:\Documents and Settings\Owner\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\Common Files\Yazzle1396OinUninstaller.exe C:\WINDOWS\system32\tmp83.tmp C:\Program Files\winupdates\a.zip C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\wcpsvsu.exe C:\Program Files\inetget2 C:\Program Files\winupdates C:\Program Files\Common Files\{300F7~1 C:\Program Files\Common Files\{F00F7~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-04 09:49 132,116 --a------ C:\WINDOWS\system32\isghjchv.dll 2007-04-02 16:51 132,116 --a------ C:\WINDOWS\system32\ilsbnxhu.dll 2007-04-02 14:36 48,708 --a------ C:\WINDOWS\system32\wsylqgdx.dll 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-02 11:17 132,116 --a------ C:\WINDOWS\system32\uerslcax.dll 2007-04-02 10:54 132,116 --a------ C:\WINDOWS\system32\qvkpvjdg.dll 2007-04-01 10:21 519,666 ---hs---- C:\WINDOWS\system32\xbbeg.ini2 2007-03-30 20:27 523,217 ---hs---- C:\WINDOWS\system32\xbbeg.bak2 2007-03-29 19:19 76,412 --a------ C:\WINDOWS\system32\wokfnkcy.dll 2007-03-29 19:18 523,684 ---hs---- C:\WINDOWS\system32\xbbeg.bak1 2007-03-29 19:18 48,708 --a------ C:\WINDOWS\system32\xymqnamp.dll 2007-03-29 19:18 280,676 ---h----- C:\WINDOWS\system32\gebbx.dll 2007-03-29 19:13 26,694 --a------ C:\WINDOWS\system32\urqolmk.dll 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-25 14:26 41 --a------ C:\WINDOWS\system32\dceecee0_s.dll 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:08 77 --a------ C:\WINDOWS\system32\n.bat 2007-03-03 20:07 90112 --a------ C:\WINDOWS\system32\smsc.exe 2007-03-03 20:07 63 --a------ C:\WINDOWS\system32\yyd.bat 2007-03-03 20:07 40106 --a------ C:\WINDOWS\system32\x.dat 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Aaou"="\"C:\\WINDOWS\\ICROSO~1\\msconfig.exe\" -vt yazb" "Rwedczvt"="\"C:\\Program Files\\Common Files\\?ystem\\spoolsv.exe\" 99001396" "IpWins"="C:\\Program Files\\Ipwindows\\ipwins.exe" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" @="" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsgPlus" "hkey"="HKLM" "command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{A782E194-EA97-4F2A-99C1-8EB42A0B519E}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"=dword:00000000 "NoLogoff"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 "NoActiveDesktop"=dword:00000001 "NoWindowsUpdate"=dword:00000000 "StartMenuLogOff"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbx HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqolmk [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SCDEMU Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 17:54:12 C:\ComboFix-quarantined-files.txt ... 07-04-10 17:54 Combofix 2 "Owner" - 07-04-10 22:52:43 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Owner\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 20:19 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-04-10 20:00 123,972 --a------ C:\WINDOWS\system32\xeebxdgo.dll 2007-04-10 18:26 48,708 --a------ C:\WINDOWS\system32\dkeomxbd.dll 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" |
|
|
|
|
04-10-2007, 07:41 AM
|
#9 (permalink) | ||
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Logs are incomplete. Altogether, you should have completed 3 ComboFix runs:
The first one, performed on 07-04-10 17:36:05 is in post #4. You should should post 2 fresh ComboFix logs now: * One after running the %userprofile% command. * The other, after completing the Kaspersky scan. These are the logs that was posted: Quote:
 Quote:
To properly assess the current situation of your machine, I shall need to view all the logs. Thanks
__________________
Question - what have you done for the community today? |
||
|
|
|
|
04-10-2007, 07:50 AM
|
#10 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 9
OS: XP
|
Re: POP-UPS I can't get rid of! Hijackthis Log
COMBOFIX 1
"Owner" - 07-04-10 17:36:05 Service Pack 2 ComboFix - Running from: "C:\Documents and Settings\Owner\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\Common Files\Yazzle1396OinUninstaller.exe C:\WINDOWS\system32\tmp83.tmp C:\Program Files\winupdates\a.zip C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\wcpsvsu.exe C:\Program Files\inetget2 C:\Program Files\winupdates C:\Program Files\Common Files\{300F7~1 C:\Program Files\Common Files\{F00F7~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-04 09:49 132,116 --a------ C:\WINDOWS\system32\isghjchv.dll 2007-04-02 16:51 132,116 --a------ C:\WINDOWS\system32\ilsbnxhu.dll 2007-04-02 14:36 48,708 --a------ C:\WINDOWS\system32\wsylqgdx.dll 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-02 11:17 132,116 --a------ C:\WINDOWS\system32\uerslcax.dll 2007-04-02 10:54 132,116 --a------ C:\WINDOWS\system32\qvkpvjdg.dll 2007-04-01 10:21 519,666 ---hs---- C:\WINDOWS\system32\xbbeg.ini2 2007-03-30 20:27 523,217 ---hs---- C:\WINDOWS\system32\xbbeg.bak2 2007-03-29 19:19 76,412 --a------ C:\WINDOWS\system32\wokfnkcy.dll 2007-03-29 19:18 523,684 ---hs---- C:\WINDOWS\system32\xbbeg.bak1 2007-03-29 19:18 48,708 --a------ C:\WINDOWS\system32\xymqnamp.dll 2007-03-29 19:18 280,676 ---h----- C:\WINDOWS\system32\gebbx.dll 2007-03-29 19:13 26,694 --a------ C:\WINDOWS\system32\urqolmk.dll 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-25 14:26 41 --a------ C:\WINDOWS\system32\dceecee0_s.dll 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:08 77 --a------ C:\WINDOWS\system32\n.bat 2007-03-03 20:07 90112 --a------ C:\WINDOWS\system32\smsc.exe 2007-03-03 20:07 63 --a------ C:\WINDOWS\system32\yyd.bat 2007-03-03 20:07 40106 --a------ C:\WINDOWS\system32\x.dat 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Aaou"="\"C:\\WINDOWS\\ICROSO~1\\msconfig.exe\" -vt yazb" "Rwedczvt"="\"C:\\Program Files\\Common Files\\?ystem\\spoolsv.exe\" 99001396" "IpWins"="C:\\Program Files\\Ipwindows\\ipwins.exe" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" @="" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsgPlus" "hkey"="HKLM" "command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{A782E194-EA97-4F2A-99C1-8EB42A0B519E}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"=dword:00000000 "NoLogoff"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 "NoActiveDesktop"=dword:00000001 "NoWindowsUpdate"=dword:00000000 "StartMenuLogOff"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbx HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqolmk [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SCDEMU Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 17:54:12 C:\ComboFix-quarantined-files.txt ... 07-04-10 17:54 COMBOFIX 2 "Owner" - 07-04-10 19:48:39 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Owner\desktop" Command switches used :: /v isghjchv ilsbnxhu wsylqgdx uerslcax qvkpvjdg wokfnkcy xymqnamp gebbx urqolmk (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\isghjchv.dll C:\WINDOWS\system32\ilsbnxhu.dll C:\WINDOWS\system32\wsylqgdx.dll C:\WINDOWS\system32\uerslcax.dll C:\WINDOWS\system32\qvkpvjdg.dll C:\WINDOWS\system32\wokfnkcy.dll C:\WINDOWS\system32\xymqnamp.dll C:\WINDOWS\system32\gebbx.dll C:\WINDOWS\system32\urqolmk.dll C:\WINDOWS\system32\xbbeg.bak1 C:\WINDOWS\system32\xbbeg.bak2 C:\WINDOWS\system32\xbbeg.ini C:\WINDOWS\system32\xbbeg.ini2 C:\WINDOWS\system32\xbbeg.tmp * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 20:00 123,972 --a------ C:\WINDOWS\system32\xeebxdgo.dll 2007-04-10 18:26 48,708 --a------ C:\WINDOWS\system32\dkeomxbd.dll 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-25 14:26 41 --a------ C:\WINDOWS\system32\dceecee0_s.dll 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:08 77 --a------ C:\WINDOWS\system32\n.bat 2007-03-03 20:07 90112 --a------ C:\WINDOWS\system32\smsc.exe 2007-03-03 20:07 63 --a------ C:\WINDOWS\system32\yyd.bat 2007-03-03 20:07 40106 --a------ C:\WINDOWS\system32\x.dat 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Aaou"="\"C:\\WINDOWS\\ICROSO~1\\msconfig.exe\" -vt yazb" "Rwedczvt"="\"C:\\Program Files\\Common Files\\?ystem\\spoolsv.exe\" 99001396" "IpWins"="C:\\Program Files\\Ipwindows\\ipwins.exe" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" @="" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsgPlus" "hkey"="HKLM" "command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"=dword:00000000 "NoLogoff"=dword:00000000 "NoWindowsUpdate"=dword:00000000 "StartMenuLogOff"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 20  26C:\ComboFix-quarantined-files.txt ... 07-04-10 20:06 C:\ComboFix2.txt ... 07-04-10 17:54 Combofix 3 "Owner" - 07-04-10 17:36:05 Service Pack 2 ComboFix - Running from: "C:\Documents and Settings\Owner\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\Common Files\Yazzle1396OinUninstaller.exe C:\WINDOWS\system32\tmp83.tmp C:\Program Files\winupdates\a.zip C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\WINDOWS\system32\wcpsvsu.exe C:\Program Files\inetget2 C:\Program Files\winupdates C:\Program Files\Common Files\{300F7~1 C:\Program Files\Common Files\{F00F7~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\qoobox\purity\Program Files\Common Files\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1 C:\qoobox\purity\WINDOWS\RACLE~1 C:\qoobox\purity\WINDOWS\YSTEM~1 C:\qoobox\purity\WINDOWS\ICROSO~1\?icrosoft C:\qoobox\purity\WINDOWS\system32\SCURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-04 09:49 132,116 --a------ C:\WINDOWS\system32\isghjchv.dll 2007-04-02 16:51 132,116 --a------ C:\WINDOWS\system32\ilsbnxhu.dll 2007-04-02 14:36 48,708 --a------ C:\WINDOWS\system32\wsylqgdx.dll 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-02 11:17 132,116 --a------ C:\WINDOWS\system32\uerslcax.dll 2007-04-02 10:54 132,116 --a------ C:\WINDOWS\system32\qvkpvjdg.dll 2007-04-01 10:21 519,666 ---hs---- C:\WINDOWS\system32\xbbeg.ini2 2007-03-30 20:27 523,217 ---hs---- C:\WINDOWS\system32\xbbeg.bak2 2007-03-29 19:19 76,412 --a------ C:\WINDOWS\system32\wokfnkcy.dll 2007-03-29 19:18 523,684 ---hs---- C:\WINDOWS\system32\xbbeg.bak1 2007-03-29 19:18 48,708 --a------ C:\WINDOWS\system32\xymqnamp.dll 2007-03-29 19:18 280,676 ---h----- C:\WINDOWS\system32\gebbx.dll 2007-03-29 19:13 26,694 --a------ C:\WINDOWS\system32\urqolmk.dll 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics 2007-03-10 09:05 786,432 --ah----- C:\DOCUME~1\TEMP\NTUSER.DAT 2007-03-10 09:05 <DIR> d--h----- C:\DOCUME~1\TEMP\WLANProfiles (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-25 14:26 41 --a------ C:\WINDOWS\system32\dceecee0_s.dll 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:08 77 --a------ C:\WINDOWS\system32\n.bat 2007-03-03 20:07 90112 --a------ C:\WINDOWS\system32\smsc.exe 2007-03-03 20:07 63 --a------ C:\WINDOWS\system32\yyd.bat 2007-03-03 20:07 40106 --a------ C:\WINDOWS\system32\x.dat 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Aaou"="\"C:\\WINDOWS\\ICROSO~1\\msconfig.exe\" -vt yazb" "Rwedczvt"="\"C:\\Program Files\\Common Files\\?ystem\\spoolsv.exe\" 99001396" "IpWins"="C:\\Program Files\\Ipwindows\\ipwins.exe" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" @="" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsgPlus" "hkey"="HKLM" "command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{A782E194-EA97-4F2A-99C1-8EB42A0B519E}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"=dword:00000000 "NoLogoff"=dword:00000000 "ForceActiveDesktopOn"=dword:00000000 "NoActiveDesktop"=dword:00000001 "NoWindowsUpdate"=dword:00000000 "StartMenuLogOff"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbx HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqolmk [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SCDEMU Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 17:54:12 C:\ComboFix-quarantined-files.txt ... 07-04-10 17:54 |
|
|
|
|
04-10-2007, 07:58 AM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Thanks for the repost.
Please delete the following files/folders: * C:\Documents and Settings\Owner\Desktop\backups\ * C:\Documents and Settings\Owner\Desktop\Downloads-Installers\backups\ * C:\QooBox\ * C:\WINDOWS\system32\dkeomxbd.dll * C:\WINDOWS\system32\xeebxdgo.dll Let me know if any resist deletion. I shall require a fresh Combofix log after this. How's the machine behaving now? Much better? 
__________________
Question - what have you done for the community today? |
|
|
|
|
04-10-2007, 08:03 AM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
This is to be performed after you have posted the required log.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
Question - what have you done for the community today? |
|
|
|
|
04-10-2007, 08:16 AM
|
#14 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 9
OS: XP
|
Re: POP-UPS I can't get rid of! Hijackthis Log
COMBOFIX LOG
"Owner" - 07-04-11 0:10:16 Service Pack 2 ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Owner\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2007-03-11 to 2007-04-11 )))))))))))))))))))))))))))))))))) 2007-04-10 20:19 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-04-10 17:14 <DIR> d-------- C:\Program Files\PowerISO 2007-04-10 16:13 <DIR> d-------- C:\Program Files\BitLord 2007-04-08 20:59 <DIR> d-------- C:\Program Files\IrfanView 2007-04-04 12:02 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-04 12:02 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-04-04 12:02 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-04 12:02 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-04-04 12:02 <DIR> d-------- C:\Program Files\OpenAL 2007-04-04 12:01 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-04 11:58 <DIR> d-------- C:\Program Files\Codemasters 2007-04-04 11:58 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\InstallShield 2007-04-02 13:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-02 11:20 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-02 11:20 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-02 11:20 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-02 11:19 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-02 11:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-02 11:18 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-02 11:18 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-03-29 18:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-03-13 20:51 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-13 20:51 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-13 20:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-11 15:09 <DIR> d-------- C:\Program Files\EvilLyrics (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-04 11:58 -------- d--h----- C:\Program Files\installshield installation information 2007-04-02 13:28 -------- d-------- C:\Program Files\quicktime 2007-04-02 13:28 -------- d-------- C:\Program Files\itunes 2007-04-02 13:28 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-04-02 13:27 -------- d-------- C:\Program Files\msn messenger 2007-04-02 13:27 -------- d-------- C:\Program Files\messenger plus! live 2007-03-13 20:52 -------- d-------- C:\Program Files\divx 2007-03-09 01:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-09 01:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-09 01:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 23:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-03 20:05 147456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-03-03 20:05 0 --a------ C:\WINDOWS\system32\taskkill.exe 2007-02-23 14:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe 2007-02-23 14:29 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-02-23 14:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-23 14:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-23 14:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-02-23 14:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-02-23 14:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-02-23 14:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-02-23 14:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-02-23 14:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-23 14:25 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-23 14:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll 2007-02-23 14:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-02-23 14:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll 2007-02-23 14:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-02-23 14:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-02-23 14:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-18 09:24 -------- d-------- C:\Program Files\b2bpoker 2007-02-18 09:23 -------- d-------- C:\Program Files\wordbiz 2007-02-16 11:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe 2007-02-12 17:59 -------- d-------- C:\Program Files\microsoft games 2007-01-22 10:57 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-01-19 11:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "AGRSMMSG"="AGRSMMSG.exe" "PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "D-Link AirPlus G"="C:\\Program Files\\D-Link\\AirPlus G\\AirGCFG.exe" "ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] "backup"="C:\\WINDOWS\\pss\\SpeedUpMyPC.lnkCommon Startup" "location"="Common Startup" "item"="SpeedUpMyPC" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DATALA~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TRAYAP~1" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-11 0:15:57 C:\ComboFix-quarantined-files.txt ... 07-04-11 00:15 C:\ComboFix2.txt ... 07-04-10 22:58 C:\ComboFix3.txt ... 07-04-10 20:06 |
|
|
|
|
04-10-2007, 08:22 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,479
OS: N/A
|
Re: POP-UPS I can't get rid of! Hijackthis Log
Looks good. The machine is cleansed of malware.
Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
