|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-01-2007, 04:29 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: XP
|
Need to get rid of Errorsafe (and other bad stuff)
Hi folks....heres my problem(s): For a few weeks now errorsafe has been popping up about every 15 minutes...its really annoying. I get a popup box, and when I close it, MIE opens up to some antivirus webpage. I close that, a few more boxes pop up before it stops for a bit. Tried removing it with various programs with no luck. Also, I cant start my computer in safe mode. When I try, all I get is a black screen that says "safe mode" in all 4 corners and a cursor that I can move around but theres no desktop icons or anything...I think errorsafe may be just one of my problems.
Before I came here I ran a bunch of other programs, like adaware, spybot S&D, cCleaner, AVG, Rogue remover, and maybe one or 2 more...all of those programs found bad stuff. I "fixed" whatever I could with each program. Then I came here and just finished up the following: Step one: check. Didnt find any of those on my pc. Step 2: Check, Panda log included in this post. Step 3: Half check. I installed spyware blaster but not IE-Spyad because I dont use MIE, and the website said it will have no effect on Netscape, which is the browser I use. If I still need to install it, let me know and I will. Step 4: Had a few updates, installed whatever it said I needed. I already had XP SP2. Step 5: check. Ran dss, then HJT. Logs posted below. dss extra.txt is attached. Here we go: PANDA LOG: Incident Status Location Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\hggebbx.dll Adware:adware/midaddle Not disinfected c:\windows\system32\PreUninstall.exe Adware:adware/ncase Not disinfected c:\windows\system32\saieau.dat Spyware:spyware/new.net Not disinfected c:\windows\NDNuninstall5_64.exe Adware:adware/sidesearch Not disinfected c:\program files\Lycos Adware:adware/savenow Not disinfected c:\program files\Save Spyware:spyware/searchcentrix Not disinfected Windows Registry Potentially unwanted tool:application/mywebsearch Not disinfected hkey_classes_root\clsid\{147A976E-EEE1-4377-8EA7-4716E4CDD239} Adware:adware/wupd Not disinfected Windows Registry Adware:Adware/PurityScan Not disinfected C:\Documents Spyware:Cookie/Kount Not disinfected C:\Documents and Settings\Ashley\Application Data\Mozilla\Firefox\Profiles\iz8vpjxy.default\cookies.txt[.kount.com/] Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Ashley\Application Data\Mozilla\Profiles\default\uz98qyre.slt\cookies.txt[.apmebf.com/] Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Ashley\Cookies\ashley@drivecleaner[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Ashley\Cookies\ashley@image.checkmystats.com[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Ashley\Cookies\ashley@stats.drivecleaner[2].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Ashley\Cookies\ashley@winantivirus[2].txt Adware:Adware/SecurityError Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temp\wschtm35.dll Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\BZTIREQX\popup[1].htm Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\BZTIREQX\popup[2].htm Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\GY6YTUN6\popup[1].htm Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\popup[1].htm Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\popup[2].htm Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\popup[3].htm Adware:Adware/TrustIn Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\trustinbar[1].exe Adware:Adware/TrustIn Not disinfected C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\trustinbar[2].exe Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Guest\Cookies\guest@banner[1].txt Hacktool:HackTool/EvID4226 Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(15)\3ABED17Ad01[EvID4226Patch.exe] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.2o7.net/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.bs.serving-sys.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.com.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.serving-sys.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[.xiti.com/] Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cookies.txt[stat.onestat.com/] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Owner\Desktop\SmitfraudFix\Process.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8CKOBM85\ffa_mv20070611[1] Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HOMKV0JN\nauj_20070613_1[1] Adware:Adware/TrustIn Not disinfected C:\Documents and Settings\Owner\My Documents\aaa\111\7WHv3ccfng.rar[crack.exe] Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Potentially unwanted tool:Application/KillApp.A Not disinfected C:\hp\bin\Terminator.exe Adware:Adware/MediaTickets Not disinfected C:\Program Files\Outerinfo\OiUninstaller.exe Adware:Adware/SaveNow Not disinfected C:\Program Files\Save\ffext.mod Virus:Malware Generic Disinfected C:\Program Files\TGTSoft\StyleXP\ECLSXP21.exe Virus:Malware Generic Disinfected C:\Program Files\TGTSoft\StyleXP\stylexpv2.01keygeneclipse.zip[StyleXP201/ECLSXP21.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-3543578137-367442929-502361721-1003\Dc262.zip[SmitfraudFix/Process.exe] Virus:Trj/Shutdown.Z Disinfected C:\RECYCLER\S-1-5-21-3543578137-367442929-502361721-1003\Dc262.zip[SmitfraudFix/restart.exe] Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\abrvarbc.dll Adware:Adware/ISearch Not disinfected C:\WINDOWS\system32\HyperLinker.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\mljigfd.dll Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\taskmgr.dll Adware:Adware/FindWhatever Not disinfected C:\WINDOWS\system32\unregister.exe Virus:Malware Generic Disinfected C:\WINDOWS\system32\VIC32.DLL DSS MAIN TEXT LOG Deckard's System Scanner v20070611.50 Run by Owner on 2007-07-01 at 18:59:57 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 72: 2007-07-01 23:00:05 UTC - RP664 - Deckard's System Scanner Restore Point 71: 2007-07-01 22:55:04 UTC - RP663 - Software Distribution Service 3.0 70: 2007-06-30 19:07:25 UTC - RP662 - System Checkpoint 69: 2007-06-29 06:08:24 UTC - RP661 - Made by Registry Mechanic 68: 2007-06-28 04:23:09 UTC - RP660 - System Checkpoint -- First Restore Point -- 1: 2007-04-03 05:03:00 UTC - RP593 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 7:02:19 PM, on 7/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hphmon05.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\LTMSG.exe C:\WINDOWS\system32\ps2.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AdsGone\adsgone.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Owner\Desktop\dss.exe C:\PROGRA~1\HIJACK~1\Owner.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) O2 - BHO: (no name) - {066A2CDC-319E-4460-BA45-C24562CD51AA} - C:\WINDOWS\system32\hggebbx.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\bovnjcet.dll O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll O2 - BHO: (no name) - {53D006A8-DC46-4648-A97E-A46AF5C73C3E} - C:\WINDOWS\system32\ddcyv.dll O2 - BHO: (no name) - {F02EE046-5EDB-0C2F-D592-7AA2D8F23A95} - (no file) O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\nwhikdfu.dll",forkonce O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [TClockEx] C:\Program Files\tclockex\TCLOCKEX.EXE O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: AdsGone 2004.lnk = ? O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_2us.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: ddcyv - C:\WINDOWS\system32\ddcyv.dll O20 - Winlogon Notify: hggebbx - C:\WINDOWS\SYSTEM32\hggebbx.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\evwenlky.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- File Associations ----------------------------------------------------------- .bat - batfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153 .hlp - hlpfile - DefaultIcon - C:\WINDOWS\hh.exe,0 .inf - inffile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151 .ini - inifile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151 .reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1 .txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,-152 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 SbcpHid - c:\windows\system32\drivers\sbcphid.sys R1 StyleXPHelper - c:\program files\tgtsoft\stylexp\stylexphelper.exe <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> R3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt> S3 ASPI (Advanced SCSI Programming Interface Driver) - c:\windows\system32\drivers\aspi32.sys <Not Verified; Adaptec; Adaptec's ASPI Layer> S3 DVC (USB DVC Svc) - c:\windows\system32\drivers\dvc.sys <Not Verified; Your Corporation; Your Product Name> S3 NPF (NetGroup Packet Filter Driver) - c:\windows\system32\drivers\npf.sys <Not Verified; CACE Technologies; WinPcap Netgroup Packet Filter Driver> S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing) S3 SYMIDSCO - c:\windows\system32\drivers\symidsco.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 StyleXPService - "c:\program files\tgtsoft\stylexp\stylexpservice.exe" <Not Verified; ; StyleXPService Module> S2 DomainService - c:\windows\system32\evwenlky.exe /service (file missing) S3 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "c:\program files\winpcap\rpcapd.exe" -d -f "c:\program files\winpcap\rpcapd.ini" <Not Verified; CACE Technologies; Remote Packet Capture Daemon> -- Scheduled Tasks ------------------------------------------------------------- 2007-07-01 19:02:00 412 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job 2007-06-25 07:48:00 300 --a------ C:\WINDOWS\Tasks\Ad-aware 6.job -- Files created between 2007-06-01 and 2007-07-01 ----------------------------- 2007-07-01 18:46:16 0 d-------- C:\Program Files\SpywareBlaster 2007-07-01 16:45:18 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-07-01 16:45:12 0 d-------- C:\WINDOWS\LastGood 2007-07-01 16:18:27 128576 --a------ C:\WINDOWS\system32\nwhikdfu.dll 2007-07-01 16:13:21 128576 -----n--- C:\WINDOWS\system32\csqbkayp.dll 2007-07-01 14:58:44 0 d-------- C:\Documents and Settings\Owner\Application Data\Grisoft 2007-07-01 14:58:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-07-01 13:04:05 128576 --a------ C:\WINDOWS\system32\qnjiglhd.dll 2007-06-30 13:17:23 128576 --a------ C:\WINDOWS\system32\lsjjiino.dll 2007-06-29 15:02:00 128576 --a------ C:\WINDOWS\system32\jirkvrba.dll 2007-06-29 11:02:52 128576 --a------ C:\WINDOWS\system32\kyopwljo.dll 2007-06-29 01:58:40 1356 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-29 01:58:04 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-06-29 01:58:04 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-06-29 01:58:03 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-06-29 01:54:22 128576 --a------ C:\WINDOWS\system32\vttaauky.dll 2007-06-29 01:38:51 0 d-------- C:\Program Files\RogueRemover 2007-06-29 01:38:19 128576 -----n--- C:\WINDOWS\system32\vlbkkbai.dll 2007-06-29 00:34:17 0 d-------- C:\Program Files\Enigma Software Group 2007-06-27 13:20:39 128576 --a------ C:\WINDOWS\system32\xpyujbwl.dll 2007-06-26 11:07:39 66112 --a------ C:\WINDOWS\system32\bovnjcet.dll 2007-06-25 00:52:15 66176 --a------ C:\Documents and Settings\Ashley\ps.exe <Not Verified; @; z> 2007-06-25 00:51:02 31254 --a------ C:\WINDOWS\system32\mljigfd.dll 2007-06-25 00:50:19 66048 --a------ C:\Documents and Settings\Ashley\x.exe <Not Verified; Soeperman Enterprises Ltd.; BFU> 2007-06-25 00:50:17 159744 --a------ C:\Documents and Settings\Ashley\rm.exe <Not Verified; tingtong; xcvv> 2007-06-24 16:38:39 1863032 ---hs---- C:\WINDOWS\system32\vycdd.ini2 2007-06-23 02:27:24 62560 --a------ C:\WINDOWS\system32\abrvarbc.dll 2007-06-23 02:17:43 1856605 ---hs---- C:\WINDOWS\system32\vycdd.bak2 2007-06-22 14:17:36 1871774 ---hs---- C:\WINDOWS\system32\vycdd.bak1 2007-06-22 14:17:28 266336 --a------ C:\WINDOWS\system32\ddcyv.dll 2007-06-22 14:14:01 0 d-------- C:\bintheredunthat 2007-06-22 14:12:24 31254 --a------ C:\WINDOWS\system32\hggebbx.dll 2007-06-22 14:11:48 0 d--hs---- C:\Documents and Settings\Owner\Complete 2007-06-15 13:42:03 0 d-------- C:\New Samples 2007-06-06 01:28:17 0 d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2007-06-06 01:28:16 0 d-------- C:\Program Files\DVD Shrink 2007-06-06 00:46:18 0 d-------- C:\Documents and Settings\Owner\Application Data\ImgBurn 2007-06-06 00:45:28 0 d-------- C:\Program Files\ImgBurn 2007-06-06 00:40:22 0 d-------- C:\Documents and Settings\Owner\Application Data\Common Files 2007-06-03 12:48:32 0 d-------- C:\Documents and Settings\Owner\Application Data\U3 -- Find3M Report --------------------------------------------------------------- 2007-07-01 18:19:35 0 d-------- C:\Program Files\tclockex 2007-07-01 18:19:07 0 d-------- C:\Program Files\ScreenPrint32 v3 2007-07-01 18:00:22 0 d-------- C:\Program Files\AdsGone 2007-06-28 00:05:32 0 d-------- C:\Program Files\GIANT Company Software 2007-06-26 11:10:45 352137 --a------ C:\swlist.reg 2007-06-25 13:57:32 0 d-------- C:\Program Files\Morpheus 2007-06-19 03:02:46 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> 2007-06-13 12:59:50 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM 2007-06-12 15:18:06 0 d-------- C:\Program Files\Common Files\?ystem 2007-06-12 15:18:06 0 d-------- C:\Program Files\Common Files\??stem 2007-06-11 10:33:10 0 d-------- C:\Program Files\Yahoo! 2007-06-11 10:32:44 0 dr-h----- C:\Documents and Settings\Owner\Application Data\yahoo! 2007-06-11 10:29:29 0 d-------- C:\Program Files\Windows Live Toolbar 2007-06-11 10:27:44 0 d-------- C:\Program Files\Soulseek 2007-06-11 10:25:09 0 d-------- C:\Program Files\NASA 2007-06-11 10:23:21 0 d-------- C:\Program Files\mIRC 2007-06-11 10:17:13 0 d-------- C:\Program Files\KaZaA Lite 2007-06-11 10:16:27 0 d-------- C:\Program Files\Easy DVD Creator 2007-06-11 10:15:42 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-06-11 10:14:48 0 d-------- C:\Program Files\Common Files\AOL 2007-06-06 00:40:09 0 d-------- C:\Documents and Settings\Owner\Application Data\HP 2007-05-31 11:41:44 0 d-------- C:\Program Files\Western Digital Technologies 2007-05-31 00:59:35 0 d-------- C:\Program Files\CCleaner 2007-05-31 00:44:39 0 d-------- C:\Program Files\MSXML 4.0 2007-05-31 00:31:35 0 d-------- C:\Program Files\Messenger 2007-05-30 23:51:35 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe 2007-05-30 23:51:35 0 d-------- C:\Documents and Settings\Owner\Application Data\?dobe 2007-05-30 23:51:24 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-30 23:51:24 0 d-------- C:\Program Files\Common Files\?dobe 2007-05-30 23:51:24 0 d-------- C:\Program Files\Common Files\?dobe 2007-05-30 23:50:08 0 d-------- C:\Program Files\Astonsoft 2007-05-30 23:50:08 0 d-------- C:\Documents and Settings\Owner\Application Data\DeepBurner Pro 2007-05-30 23:50:07 0 d-------- C:\Program Files\MediaMonkey 2007-05-30 23:50:07 0 d-------- C:\Documents and Settings\Owner\Application Data\Walgreens 2007-05-30 23:50:07 0 d-------- C:\Documents and Settings\Owner\Application Data\Ashampoo 2007-05-30 23:50:03 0 d-------- C:\Program Files\Media Player Classic 2007-05-30 23:48:30 0 d-------- C:\Program Files\QuickTime Alternative 2007-05-30 23:48:09 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-30 23:48:09 0 d-------- C:\Program Files\Ahead2 2007-05-22 10:26:11 0 d-------- C:\Program Files\OpenOffice.org1.1.2 2007-05-08 15:43:47 5 --a------ C:\WINDOWS\system32\SySVid.dat 2007-05-08 15:36:54 0 d-------- C:\Program Files\SuperAudiotool 2007-05-08 15:36:39 3082 --a------ C:\WINDOWS\system32\affv11300p4now.sys 2007-05-06 15:36:07 0 d-------- C:\Program Files\?dobe 2007-05-06 13:40:54 0 d-------- C:\Program Files\Xilisoft 2007-05-06 04  23 0 d-------- C:\Program Files\ImTOO2007-05-06 03:43:24 0 d-------- C:\Program Files\Ashampoo 2007-05-04 03:09:45 0 d-------- C:\Program Files\ATP -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {066A2CDC-319E-4460-BA45-C24562CD51AA} C:\WINDOWS\system32\hggebbx.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} C:\WINDOWS\system32\bovnjcet.dll {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll {53D006A8-DC46-4648-A97E-A46AF5C73C3E} C:\WINDOWS\system32\ddcyv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "AutoTKit"="C:\\hp\\bin\\AUTOTKIT.EXE" "HPHmon05"="C:\\WINDOWS\\System32\\hphmon05.exe" "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe" "LTMSG"="LTMSG.exe 7" "PS2"="C:\\WINDOWS\\system32\\ps2.exe" "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb12.exe" "ScreenPrint32"="C:\\Program Files\\ScreenPrint32 v3\\ScreenPrint32.exe -startup" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "icq.com"="rundll32.exe \"C:\\WINDOWS\\system32\\nwhikdfu.dll\",forkonce" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "TClockEx"="C:\\Program Files\\tclockex\\TCLOCKEX.EXE" "STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "SpybotSnD"="\"C:\\Program Files\\Spybot - Search & Destroy\\SpybotSD.exe\" /autocheck" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoClose"=dword:00000000 "StartMenuLogOff"=dword:00000000 "NoLogOff"=dword:00000000 "NoRun"=dword:00000000 "NoFind"=dword:00000000 "NoChangeStartMenu"=dword:00000000 "NoSetFolders"=dword:00000000 "NoNetSetup"=dword:00000000 "NoPrinters"=dword:00000000 "NoViewOnDrive"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{066A2CDC-319E-4460-BA45-C24562CD51AA}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyv HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggebbx HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] "location"="Common Startup" "item"="America Online 9.0 Tray Icon" "backup"="C:\\WINDOWS\\pss\\America Online 9.0 Tray Icon.lnkCommon Startup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk] "location"="Common Startup" "command"="C:\\PROGRA~1\\UPDATE~1\\137903\\Program\\BACKWE~1.EXE -startup" "item"="Updates from HP" "backup"="C:\\WINDOWS\\pss\\Updates from HP.lnkCommon Startup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Organize.lnk] "backup"="C:\\WINDOWS\\pss\\Organize.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\HPORGA~1\\bin\\DISPLA~1.EXE \"-application\" \"core.hp.main/application.xml\" \"-appname\" \"eLife\"" "item"="Organize" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^spamsubtract.lnk] "backup"="C:\\WINDOWS\\pss\\spamsubtract.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\INTERM~1\\SPAMSU~1\\SpamSub.exe -q" "item"="spamsubtract" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmtask" "hkey"="HKLM" "command"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScreenPrint32] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ScreenPrint32" "hkey"="HKLM" "command"="C:\\Program Files\\ScreenPrint32 v3\\ScreenPrint32.exe -startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Shareaza" "hkey"="HKCU" "command"="\"C:\\Program Files\\Shareaza\\Shareaza.exe\" -tray" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SLock] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SpyLock" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K] Shell\AutoRun\command K:\LaunchU3.exe -a [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3a9f5a4-12bb-11dc-b482-00038a000015}] Shell\AutoRun\command K:\wd_windows_tools\setup.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb4dcb1c-1065-11dc-b47e-00038a000015}] Shell\AutoRun\command K:\LaunchU3.exe -a -- Hosts ----------------------------------------------------------------------- 127.0.0.1 ads.datingyes.com 127.0.0.1 adserver2.mediainsight.de 127.0.0.1 adserver3.eudora.com 127.0.0.1 adserver4.eudora.com 127.0.0.1 adlink.deh.nl 127.0.0.1 advert.stealth.nl 127.0.0.1 www.banneroverdrive.com #[Adcycle] 127.0.0.1 ad.120-gen.tbn.ru 127.0.0.1 ad.3ad.doubleclick.net 5642 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-07-01 at 19:03:25 --------- HIJACKTHIS LOG: Logfile of HijackThis v1.99.1 Scan saved at 7:05:48 PM, on 7/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hphmon05.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\LTMSG.exe C:\WINDOWS\system32\ps2.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AdsGone\adsgone.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\nwhikdfu.dll",forkonce O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [TClockEx] C:\Program Files\tclockex\TCLOCKEX.EXE O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: AdsGone 2004.lnk = ? O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_2us.cab O20 - AppInit_DLLs: O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\evwenlky.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe Thanks in advance for ANY help! Steve |
|
     |
| Sponsored Links |
|
07-01-2007, 05:11 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Need to get rid of Errorsafe (and other bad stuff)
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
|
|
|
|
|
07-01-2007, 06:23 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: XP
|
Re: Need to get rid of Errorsafe (and other bad stuff)
Ok sUBs, done. ComboFix ran for about 40 minutes before I got a log, I thought it had locked up...
Anyway, here ya go: ComboFix Log: "Owner" - 2007-07-01 20:37:00 - ComboFix 07-07-02.3 - Service Pack 2 (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\abrvarbc.dll C:\WINDOWS\system32\bovnjcet.dll C:\WINDOWS\system32\dromnynw.dll C:\WINDOWS\system32\jirkvrba.dll C:\WINDOWS\system32\kyopwljo.dll C:\WINDOWS\system32\lsjjiino.dll C:\WINDOWS\system32\nwhikdfu.dll C:\WINDOWS\system32\qnjiglhd.dll C:\WINDOWS\system32\rvtokfif.dll C:\WINDOWS\system32\vlbkkbai.dll C:\WINDOWS\system32\vttaauky.dll C:\WINDOWS\system32\xpyujbwl.dll C:\WINDOWS\system32\mljigfd.dll C:\WINDOWS\system32\vycdd.bak1 C:\WINDOWS\system32\vycdd.bak2 C:\WINDOWS\system32\vycdd.ini C:\WINDOWS\system32\vycdd.ini2 C:\WINDOWS\system32\vycdd.tmp C:\WINDOWS\system32\abrvkrij.ini C:\WINDOWS\system32\ojlwpoyk.ini C:\WINDOWS\system32\oniijjsl.ini C:\WINDOWS\system32\ufdkihwn.ini C:\WINDOWS\system32\dhlgijnq.ini C:\WINDOWS\system32\fifkotvr.ini C:\WINDOWS\system32\iabkkblv.ini C:\WINDOWS\system32\ykuaattv.ini C:\WINDOWS\system32\lwbjuypx.ini C:\WINDOWS\system32\vycdd.bak1 C:\WINDOWS\system32\vycdd.bak2 C:\WINDOWS\system32\vycdd.ini C:\WINDOWS\system32\vycdd.ini2 C:\WINDOWS\system32\vycdd.tmp C:\WINDOWS\system32\vycdd.bak1 C:\WINDOWS\system32\vycdd.bak2 C:\WINDOWS\system32\vycdd.ini C:\WINDOWS\system32\vycdd.ini2 C:\WINDOWS\system32\vycdd.tmp C:\WINDOWS\system32\ddcyv.dll C:\WINDOWS\system32\hggebbx.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Owner\APPLIC~1.\appatc~1 C:\DOCUME~1\Owner\APPLIC~1.\asembl~1 C:\DOCUME~1\Owner\APPLIC~1.\asks~1 C:\DOCUME~1\Owner\APPLIC~1.\crosof~1 C:\DOCUME~1\Owner\APPLIC~1.\crosof~1.net C:\DOCUME~1\Owner\APPLIC~1.\curity~1 C:\DOCUME~1\Owner\APPLIC~1.\dobe~1 C:\DOCUME~1\Owner\APPLIC~1.\ecurit~1 C:\DOCUME~1\Owner\APPLIC~1.\fnts~1 C:\DOCUME~1\Owner\APPLIC~1.\fnts~2 C:\DOCUME~1\Owner\APPLIC~1.\icroso~1.net C:\DOCUME~1\Owner\APPLIC~1.\mantec~1 C:\DOCUME~1\Owner\APPLIC~1.\mcroso~1 C:\DOCUME~1\Owner\APPLIC~1.\racle~1 C:\DOCUME~1\Owner\APPLIC~1.\racle~2 C:\DOCUME~1\Owner\APPLIC~1.\scurit~1 C:\DOCUME~1\Owner\APPLIC~1.\smante~1 C:\DOCUME~1\Owner\APPLIC~1.\ssembl~1 C:\DOCUME~1\Owner\APPLIC~1.\sstem~1 C:\DOCUME~1\Owner\APPLIC~1.\sstem3~1 C:\DOCUME~1\Owner\APPLIC~1.\wnsxs~1 C:\DOCUME~1\Owner\APPLIC~1.\ymbols~1 C:\DOCUME~1\Owner\MYDOCU~1.\appatc~1 C:\DOCUME~1\Owner\MYDOCU~1.\asembl~1 C:\DOCUME~1\Owner\MYDOCU~1.\asks~1 C:\DOCUME~1\Owner\MYDOCU~1.\asks~2 C:\DOCUME~1\Owner\MYDOCU~1.\curity~1 C:\DOCUME~1\Owner\MYDOCU~1.\dobe~1 C:\DOCUME~1\Owner\MYDOCU~1.\dobe~2 C:\DOCUME~1\Owner\MYDOCU~1.\ecurit~1 C:\DOCUME~1\Owner\MYDOCU~1.\fnts~1 C:\DOCUME~1\Owner\MYDOCU~1.\icroso~1 C:\DOCUME~1\Owner\MYDOCU~1.\icroso~1.net C:\DOCUME~1\Owner\MYDOCU~1.\icroso~2 C:\DOCUME~1\Owner\MYDOCU~1.\mbols~1 C:\DOCUME~1\Owner\MYDOCU~1.\ppatch~1 C:\DOCUME~1\Owner\MYDOCU~1.\pppatc~1 C:\DOCUME~1\Owner\MYDOCU~1.\racle~1 C:\DOCUME~1\Owner\MYDOCU~1.\racle~2 C:\DOCUME~1\Owner\MYDOCU~1.\smante~1 C:\DOCUME~1\Owner\MYDOCU~1.\ssembl~1 C:\DOCUME~1\Owner\MYDOCU~1.\sstem~1 C:\DOCUME~1\Owner\MYDOCU~1.\sstem3~1 C:\DOCUME~1\Owner\MYDOCU~1.\stem~1 C:\DOCUME~1\Owner\MYDOCU~1.\tsks~1 C:\DOCUME~1\Owner\MYDOCU~1.\wnsxs~1 C:\DOCUME~1\Owner\MYDOCU~1.\ymante~1 C:\DOCUME~1\Owner\MYDOCU~1.\ymbols~1 C:\Program Files\asks~1 C:\Program Files\Common Files\asks~1 C:\Program Files\Common Files\crosof~1 C:\Program Files\Common Files\curity~1 C:\Program Files\Common Files\dobe~1 C:\Program Files\Common Files\dobe~2 C:\Program Files\Common Files\ecurit~1 C:\Program Files\Common Files\fnts~1 C:\Program Files\Common Files\fnts~2 C:\Program Files\Common Files\icroso~1 C:\Program Files\Common Files\icroso~1.net C:\Program Files\Common Files\ppatch~1 C:\Program Files\Common Files\racle~1 C:\Program Files\Common Files\scurit~1 C:\Program Files\Common Files\sembly~1 C:\Program Files\Common Files\sks~1 C:\Program Files\Common Files\smbols~1 C:\Program Files\Common Files\ssembl~1 C:\Program Files\Common Files\sstem3~1 C:\Program Files\Common Files\stem~1 C:\Program Files\Common Files\tsks~1 C:\Program Files\Common Files\wnsxs~1 C:\Program Files\Common Files\ystem~1 C:\Program Files\curity~1 C:\Program Files\dobe~1 C:\Program Files\fnts~1 C:\Program Files\fnts~1\explorer.exe C:\Program Files\icroso~1 C:\Program Files\icroso~1.net C:\Program Files\outerinfo C:\Program Files\outerinfo\OiUninstaller.exe C:\Program Files\outerinfo\outerinfo.ico C:\Program Files\outerinfo\Terms.rtf C:\Program Files\ppatch~1 C:\Program Files\pppatc~1 C:\Program Files\sembly~1 C:\Program Files\sks~1 C:\Program Files\smbols~1 C:\Program Files\sstem3~1 C:\Program Files\wnsxs~1 C:\Program Files\ymbols~1 C:\Program Files\ystem~1 C:\Program Files\ystem3~1 C:\WINDOWS\asks~1 C:\WINDOWS\crosof~1.net C:\WINDOWS\crosof~1.net\javaw.exe C:\WINDOWS\ecurit~1 C:\WINDOWS\fnts~1 C:\WINDOWS\fnts~2 C:\WINDOWS\icroso~1 C:\WINDOWS\icroso~1.net C:\WINDOWS\mantec~1 C:\WINDOWS\mcroso~1.net C:\WINDOWS\NDNuninstall5_64.exe C:\WINDOWS\ppatch~1 C:\WINDOWS\pppatc~1 C:\WINDOWS\pppatc~2 C:\WINDOWS\scurit~1 C:\WINDOWS\smante~1 C:\WINDOWS\sstem3~1 C:\WINDOWS\stem~1 C:\WINDOWS\stem32~1 C:\WINDOWS\system32\appatc~1 C:\WINDOWS\system32\asembl~1 C:\WINDOWS\system32\crosof~1.net C:\WINDOWS\system32\dobe~1 C:\WINDOWS\system32\fnts~1 C:\WINDOWS\system32\mantec~1 C:\WINDOWS\system32\mcroso~1.net C:\WINDOWS\system32\pppatc~1 C:\WINDOWS\system32\racle~1 C:\WINDOWS\system32\racle~2 C:\WINDOWS\system32\sembly~1 C:\WINDOWS\system32\smante~1 C:\WINDOWS\system32\smbols~1 C:\WINDOWS\system32\sstem~1 C:\WINDOWS\system32\stem~1 C:\WINDOWS\system32\taskmgr.dll C:\WINDOWS\system32\tsks~1 C:\WINDOWS\system32\ymante~1 C:\WINDOWS\system32\ymbols~1 C:\WINDOWS\system32\ystem~1 C:\WINDOWS\system32\ystem3~1 C:\WINDOWS\wnsxs~1 C:\WINDOWS\wr.txt C:\WINDOWS\ymbols~1 C:\WINDOWS\ystem~1 ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE -------\LEGACY_NM -------\DomainService -------\nm ((((((((((((((((((((((((( Files Created from 2007-06-02 to 2007-07-02 ))))))))))))))))))))))))))))))) 2007-07-01 20:36 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-07-01 18:59 <DIR> d-------- C:\Deckard 2007-07-01 18:46 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-01 16:45 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-07-01 14:58 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-06-29 01:58 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-06-29 01:58 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-06-29 01:58 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-06-29 01:58 1,356 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-29 01:38 <DIR> d-------- C:\Program Files\RogueRemover 2007-06-29 00:34 <DIR> d-------- C:\Program Files\Enigma Software Group 2007-06-25 00:52 66,176 --a------ C:\DOCUME~1\Ashley\ps.exe 2007-06-25 00:50 66,048 --a------ C:\DOCUME~1\Ashley\x.exe 2007-06-25 00:50 159,744 --a------ C:\DOCUME~1\Ashley\rm.exe 2007-06-22 14:14 <DIR> d-------- C:\bintheredunthat 2007-06-22 14:11 <DIR> d--hs---- C:\DOCUME~1\Owner\Complete 2007-06-15 13:42 <DIR> d-------- C:\New Samples 2007-06-06 01:28 <DIR> d-------- C:\Program Files\DVD Shrink 2007-06-06 01:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink 2007-06-06 00:46 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\ImgBurn 2007-06-06 00:45 <DIR> d-------- C:\Program Files\ImgBurn 2007-06-06 00:40 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\Common Files 2007-06-05 15:43 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-06-05 15:43 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-06-05 15:43 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-06-05 15:43 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-06-05 15:43 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-06-05 15:43 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-06-05 15:43 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-06-05 15:43 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-06-05 15:43 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-06-05 15:43 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-06-05 15:43 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-06-05 15:43 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-06-05 15:43 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-06-05 15:43 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-06-03 12:48 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\U3 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-02 00:34:54 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\wsInspector 2007-07-01 22:19:35 -------- d-----w C:\Program Files\tclockex 2007-07-01 22:19:07 -------- d-----w C:\Program Files\ScreenPrint32 v3 2007-07-01 22:00:22 -------- d-----w C:\Program Files\AdsGone 2007-06-28 04:05:32 -------- d-----w C:\Program Files\GIANT Company Software 2007-06-26 15:10:45 352,137 ----a-w C:\swlist.reg 2007-06-25 17:57:32 -------- d-----w C:\Program Files\Morpheus 2007-06-19 07:02:46 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-06-13 16:59:50 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM 2007-06-11 14:33:10 -------- d-----w C:\Program Files\Yahoo! 2007-06-11 14:32:44 -------- d--h--r C:\DOCUME~1\Owner\APPLIC~1\yahoo! 2007-06-11 14:29:29 -------- d-----w C:\Program Files\Windows Live Toolbar 2007-06-11 14:27:44 -------- d-----w C:\Program Files\Soulseek 2007-06-11 14:25:09 -------- d-----w C:\Program Files\NASA 2007-06-11 14:23:21 -------- d-----w C:\Program Files\mIRC 2007-06-11 14:17:13 -------- d-----w C:\Program Files\KaZaA Lite 2007-06-11 14:16:27 -------- d-----w C:\Program Files\Easy DVD Creator 2007-06-11 14:15:42 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-11 14:14:48 -------- d-----w C:\Program Files\Common Files\AOL 2007-06-06 04:40:09 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\HP 2007-05-31 15:41:44 -------- d-----w C:\Program Files\Western Digital Technologies 2007-05-31 04:59:35 -------- d-----w C:\Program Files\CCleaner 2007-05-31 04:44:39 -------- d-----w C:\Program Files\MSXML 4.0 2007-05-31 04:31:35 -------- d-----w C:\Program Files\Messenger 2007-05-31 03:50:08 -------- d-----w C:\Program Files\Astonsoft 2007-05-31 03:50:08 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\DeepBurner Pro 2007-05-31 03:50:07 -------- d-----w C:\Program Files\MediaMonkey 2007-05-31 03:50:07 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Walgreens 2007-05-31 03:50:07 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Ashampoo 2007-05-31 03:50:03 -------- d-----w C:\Program Files\Media Player Classic 2007-05-31 03:48:30 -------- d-----w C:\Program Files\QuickTime Alternative 2007-05-31 03:48:09 -------- d-----w C:\Program Files\Common Files\Ahead 2007-05-31 03:48:09 -------- d-----w C:\Program Files\Ahead2 2007-05-22 14:26:11 -------- d-----w C:\Program Files\OpenOffice.org1.1.2 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-05-08 19:43:47 5 ----a-w C:\WINDOWS\system32\SySVid.dat 2007-05-08 19:36:54 -------- d-----w C:\Program Files\SuperAudiotool 2007-05-08 19:36:39 3,082 ----a-w C:\WINDOWS\system32\affv11300p4now.sys 2007-05-06 17:40:54 -------- d-----w C:\Program Files\Xilisoft 2007-05-06 08 23 -------- d-----w C:\Program Files\ImTOO2007-05-06 07:43:24 -------- d-----w C:\Program Files\Ashampoo 2007-05-04 07:09:45 -------- d-----w C:\Program Files\ATP 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2004-02-26 06:18:26 2 --shatr C:\WINDOWS\winstart.bat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2003-05-15 10:47 50376 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}] 2004-02-24 14:57 784384 --a------ C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F02EE046-5EDB-0C2F-D592-7AA2D8F23A95}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoTKit"="C:\hp\bin\AUTOTKIT.EXE" [2003-06-18 22:19] "LTMSG"="LTMSG.exe" [2003-07-14 20:52 C:\WINDOWS\ltmsg.exe] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25] "ScreenPrint32"="C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe" [2003-05-15 21:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TClockEx"="C:\Program Files\tclockex\TCLOCKEX.EXE" [2000-03-09 02:15] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2004-10-25 15:36] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoClose"=0 (0x0) "StartMenuLogOff"=0 (0x0) "NoLogOff"=0 (0x0) "NoChangeStartMenu"=0 (0x0) "NoSetFolders"=0 (0x0) "NoNetSetup"=0 (0x0) "NoPrinters"=0 (0x0) "NoViewOnDrive"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 08:29] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk] backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Organize.lnk] backup=C:\WINDOWS\pss\Organize.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^spamsubtract.lnk] backup=C:\WINDOWS\pss\spamsubtract.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SLock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] AutoRun\command- K:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3a9f5a4-12bb-11dc-b482-00038a000015}] AutoRun\command- K:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb4dcb1c-1065-11dc-b47e-00038a000015}] AutoRun\command- K:\LaunchU3.exe -a Contents of the 'Scheduled Tasks' folder 2007-06-25 11:48:00 C:\WINDOWS\tasks\Ad-aware 6.job 2007-07-02 01:12:00 C:\WINDOWS\tasks\Symantec NetDetect.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-01 21:10:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-01 21:17:16 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-01 21:13 --- E O F --- Fresh HIJACKTHIS Log: Logfile of HijackThis v1.99.1 Scan saved at 9:19:18 PM, on 7/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\LTMSG.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AdsGone\adsgone.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll O2 - BHO: (no name) - {F02EE046-5EDB-0C2F-D592-7AA2D8F23A95} - (no file) O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup O4 - HKCU\..\Run: [TClockEx] C:\Program Files\tclockex\TCLOCKEX.EXE O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: AdsGone 2004.lnk = ? O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_2us.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe |
|
|
|
|
07-01-2007, 06:33 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Need to get rid of Errorsafe (and other bad stuff)
Before fixing anything, open notepad and Copy/Paste the text in the box below into it:
Code:
@echo off rem For %%g in ( C:\DOCUME~1\Ashley\ps.exe C:\DOCUME~1\Ashley\x.exe C:\DOCUME~1\Ashley\rm.exe ) do ( catchme -l nul -k %%g del /a/f %%g )>nul 2>&1 rd /s/q C:\Qoobox >nul 2>&1 catchme -l nul -k "%0" >nul nircmd execmd move /y "~$folder.desktop$\catchme.zip" "Submit [%date:/=-% %time::=.%].zip" echo.Please submit the file - Submit [%date:/=-% %time::=.%].zip nircmd wait 7000 del "%0"  Double click on Submit.cmd & allow it to generate a zipped file called Submit [Date Time].zip Please submit this file to → http://www.bleepingcomputer.com/subm....php?channel=4 The file must be uploaded before proceeding to the next step. --------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {F02EE046-5EDB-0C2F-D592-7AA2D8F23A95} - (no file) O20 - AppInit_DLLs: --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from:
__________________
|
|
|
|
|
07-01-2007, 06:35 PM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Need to get rid of Errorsafe (and other bad stuff)
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
|
|
|
|
|
07-01-2007, 07:02 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: XP
|
Re: Need to get rid of Errorsafe (and other bad stuff)
While Im waiting for the scan to complete, heres an error I got when I tried to fix the items you told me to fix with HJT:
An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: ) Error #5 - Invalid procedure call or argument Please email me at merijn@spywareinfo.com, reporting the following: * What you were trying to fix when the error occurred, if applicable * How you can reproduce the error * A complete HijackThis scan log, if possible Windows version: Windows NT 5.01.2600 MSIE version: 7.0.5730.11 HijackThis version: 1.99.1 This message has been copied to your clipboard. Click OK to continue the rest of the scan. Last edited by steve33809; 07-01-2007 at 07:13 PM. |
|
|
|
|
07-01-2007, 09:08 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: XP
|
Re: Need to get rid of Errorsafe (and other bad stuff)
Heres the logs
Kaspersky: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, July 02, 2007 12:04:50 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 2/07/2007 Kaspersky Anti-Virus database records: 356320 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ G:\ H:\ I:\ J:\ L:\ Scan Statistics: Total number of scanned objects: 103474 Number of viruses found: 30 Number of infected objects: 130 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:53:06 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/1/EnigmaUpdater.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/2/esgi_md5h.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/7/SpyHunter.exe Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/17/Esgiutl1.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/18/SHSched.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe/PRE Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe Ghost Installer: infected - 6 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.703\spyhunterS.exe UPX: infected - 6 skipped C:\Documents and Settings\Ashley\Local Settings\Temp\wschtm35.dll Infected: not-virus:Hoax.Win32.Renos.di skipped C:\Documents and Settings\Ashley\My Documents\ladyoflight.exe/WISE0013.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Ashley\My Documents\ladyoflight.exe/WISE0014.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Documents and Settings\Ashley\My Documents\ladyoflight.exe WiseSFX: infected - 2 skipped C:\Documents and Settings\Ashley\My Documents\ladyoflight.exe WiseSFX Dropper: infected - 2 skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(10)\B85F34B3d01/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.Quick.a skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(10)\B85F34B3d01/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(10)\B85F34B3d01/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Gator.3103 skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(10)\B85F34B3d01 WiseSFX: infected - 3 skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\cert8.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\history.dat Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\key3.db Object is locked skipped C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\parent.lock Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DF74E8.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DFAC88.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\My Documents\aaa\111\7WHv3ccfng.rar/crack.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\Documents and Settings\Owner\My Documents\aaa\111\7WHv3ccfng.rar RAR: infected - 1 skipped C:\Documents and Settings\Owner\My Documents\Text Files\Submit [Sun 07-01-2007 21.38.06.81].zip/Documents Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped C:\Documents and Settings\Owner\My Documents\Text Files\Submit [Sun 07-01-2007 21.38.06.81].zip ZIP: infected - 1 skipped C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP644\A0130151.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP657\A0131176.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP658\A0131248.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP659\A0131284.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131368.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131413.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131414.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131417.exe Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131418.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131419.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP660\A0131457.dll Infected: not-a-virus:Monitor.Win32.SpyAgent.44103 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132579.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132580.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132581.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132582.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132583.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132584.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132585.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132586.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132587.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132588.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132589.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132590.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132591.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132592.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132593.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132594.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132595.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132596.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132597.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132598.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132599.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132600.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132601.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132602.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132603.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132604.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132605.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132606.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132607.exe Infected: Trojan.Win32.Agent.aoy skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132608.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132609.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132610.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132611.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132612.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132613.exe Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132614.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132615.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132616.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132617.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132618.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132619.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132620.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132621.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132622.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132623.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132624.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132625.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132626.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132627.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132628.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132629.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132630.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132631.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132632.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132633.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132634.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132635.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132636.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132637.dll Infected: Trojan-Downloader.Win32.Small.ddp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132638.exe Infected: Trojan.Win32.Agent.anr skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132639.exe Infected: Trojan.Win32.Agent.anr skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132640.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132641.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132645.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132646.exe Infected: Trojan-Downloader.Win32.PurityScan.be skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0132647.exe Infected: Backdoor.Win32.EggDrop.v skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP662\A0133666.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/1/EnigmaUpdater.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/2/esgi_md5h.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/7/SpyHunter.exe Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/17/Esgiutl1.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/18/SHSched.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe/PRE Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe Ghost Installer: infected - 6 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133685.exe UPX: infected - 6 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/1/EnigmaUpdater.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/2/esgi_md5h.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/7/SpyHunter.exe Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/17/Esgiutl1.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE/data/{65145FC9-DEA0-4738-A4FE-376C2BA51806}/18/SHSched.dll Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe/PRE Infected: not-a-virus:FraudTool.Win32.SpyHunter.b skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe Ghost Installer: infected - 6 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133686.exe UPX: infected - 6 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133720.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133722.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133722.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133722.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133725.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133726.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kj skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133736.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133746.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133747.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\A0133766.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\mtuninst.exe Infected: not-a-virus:AdWare.Win32.MediaTickets.u skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\HyperLinker.exe Infected: not-a-virus:AdWare.Win32.MDH.a skipped C:\WINDOWS\system32\PreUninstall.exe Infected: not-a-virus:AdWare.Win32.Suggestor.f skipped C:\WINDOWS\system32\unregister.exe Infected: not-a-virus:AdWare.Win32.VB.f skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP664\change.log Object is locked skipped Scan process completed. Fresh HJT log: Logfile of HijackThis v1.99.1 Scan saved at 12:05:50 AM, on 7/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\LTMSG.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup O4 - HKCU\..\Run: [TClockEx] C:\Program Files\tclockex\TCLOCKEX.EXE O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: AdsGone 2004.lnk = ? O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_2us.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe |
|
|
|
|
07-02-2007, 12:30 AM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Need to get rid of Errorsafe (and other bad stuff)
C:\Deckard
C:\Documents and Settings\Ashley\My Documents\ladyoflight.exe C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\Cache(10)\B85F34B3d01 C:\Documents and Settings\Owner\My Documents\aaa\111\7WHv3ccfng.rar C:\Documents and Settings\Owner\My Documents\Text Files\Submit [Sun 07-01-2007 21.38.06.81].zip C:\WINDOWS\mtuninst.exe C:\WINDOWS\system32\HyperLinker.exe C:\WINDOWS\system32\PreUninstall.exe C:\WINDOWS\system32\unregister.exe Delete the above files/folders. (let me know if you fail to find/delete any) Have you updated Java yet?
__________________
|
|
|
|
|
07-02-2007, 08:27 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: XP
|
Re: Need to get rid of Errorsafe (and other bad stuff)
Ok, all those files/folders deleted. I updated Java right after posting my last reply.
Not sure if you need it, but heres a fresh HJT log anyway: Logfile of HijackThis v1.99.1 Scan saved at 11:26:30 AM, on 7/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\LTMSG.exe C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AdsGone\adsgone.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\a4f1z77c.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [TClockEx] C:\Program Files\tclockex\TCLOCKEX.EXE O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: AdsGone 2004.lnk = ? O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_2us.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe |
|
|
|
|
07-02-2007, 08:55 AM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Need to get rid of Errorsafe (and other bad stuff)
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
|
|
|
|
| Thread Tools | |
|
|
