|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-17-2007, 05:01 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hey,
Recently my computer has become really slow and has been subject to loads and loads of pop ups. On start up i get the follwing message: 16 bit MS/DOS Subsystem C\Windows\System32\Scchk32.exe The NVTDM has encountered an illeagal instruction. CS:Of9c IP:010c OP:fe 7f 68 03 21 Choose 'close' to terminate the application. I have also noticed that files that should be hidden files such as thumbs.db and folders such as System Volume Information are all visable. Some of the trojans my scanner has picked up are: Trojan horse Generic5.KNI Trojan horse Collected.11.B Trojan horse SHeur.ZQ Trojan horse Downloader.Generic5.QB Trojan horse Downloader.Generic5.JDS Below are my logs, i hope someone can help. """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Panda Active Scan: Incident Status Location Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\tksxteyg.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\mllmj.dll Adware:adware/commad Not disinfected Windows Registry Adware:adware/powerscan Not disinfected Windows Registry Adware:adware/surfaccuracy Not disinfected Windows Registry Adware:adware/ist.istbar Not disinfected Windows Registry Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.tradedoubler.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.bravenet.com/] Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.adopt.hbmediapro.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.atwola.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.toplist.cz/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@2o7[2].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@888[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ad.yieldmanager[2].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adopt.hbmediapro[2].txt Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ads.addynamix[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ads.pointroll[2].txt Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adtech[2].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adultfriendfinder[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Willis\Cookies\willis@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atwola[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Willis\Cookies\willis@azjmp[2].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bluestreak[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bs.serving-sys[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bs.serving-sys[3].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Willis\Cookies\willis@doubleclick[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Willis\Cookies\willis@drivecleaner[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Willis\Cookies\willis@errorsafe[1].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@int.sitestat[1].txt Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Willis\Cookies\willis@int.sitestat[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Willis\Cookies\willis@mediaplex[2].txt Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Willis\Cookies\willis@overture[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Willis\Cookies\willis@questionmarket[2].txt Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Willis\Cookies\willis@searchportal.information[2].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Willis\Cookies\willis@server.iad.liveperson[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@serving-sys[2].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Willis\Cookies\willis@statcounter[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Willis\Cookies\willis@stats.drivecleaner[2].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Willis\Cookies\willis@stats1.reliablestats[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Willis\Cookies\willis@systemdoctor[1].txt Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tickle[1].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Willis\Cookies\willis@toplist[1].txt Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tradedoubler[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tribalfusion[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Willis\Cookies\willis@winantispyware[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Willis\Cookies\willis@winantivirus[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Willis\Cookies\willis@www6.addfreestats[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Willis\Cookies\willis@xiti[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Willis\Cookies\willis@zedo[2].txt Spyware:Spyware/Apropos Not disinfected C:\Documents and Settings\Willis\Desktop\aproposfix\backups\backups.zip[backups/ace.dll] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Willis\Desktop\Wil\l2mfix\Process.exe Virus:Trj/Downloader.OZB Disinfected C:\Documents and Settings\Willis\Local Settings\Temp\fclfdbdw.dll Virus:Trj/Downloader.PJT Disinfected C:\Documents and Settings\Willis\Local Settings\Temp\jvqqnpxk.exe Adware:Adware/WinAntivirus2006 Not disinfected C:\Documents and Settings\Willis\Local Settings\Temp\olrsmqly.dll Potentially unwanted tool:Application/SystemDoctor2006 Not disinfected C:\Documents and Settings\Willis\Local Settings\Temporary Internet Files\Content.IE5\8VZDFSTK\SystemDoctor2006FreeInstall[1].cab Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Willis\Local Settings\Temporary Internet Files\Content.IE5\G7TDCHE8\WinAntiVirusPro2006FreeInstall[1].exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\94blu.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\c2hBl0.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\jEKOhL.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\yDF.dat Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\fymtjpgb.dll Adware:Adware/CommAd Not disinfected C:\WINDOWS\V2lsbGlz\ktZAQN0okwQFDTO0Zc.vbs """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Deckard's System Scanner Deckard's System Scanner v20070711.54 Run by Willis on 2007-07-17 at 11:38:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 60: 2007-07-17 10:38:28 UTC - RP547 - Deckard's System Scanner Restore Point 59: 2007-07-17 03:36:02 UTC - RP546 - System Checkpoint 58: 2007-07-15 05:11:23 UTC - RP545 - System Checkpoint 57: 2007-07-14 02:29:26 UTC - RP544 - System Checkpoint 56: 2007-07-13 02:00:50 UTC - RP543 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2007-04-18 16:38:46 UTC - RP488 - Installed Microsoft Office Enterprise 2007 Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-07-17 11:41:02 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16473) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Grisoft\AVG Free\avgamsvr.exe C:\Program Files\Grisoft\AVG Free\avgupsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\explorer.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Grisoft\AVG Free\avgemc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Grisoft\AVG Free\avgcc.exe C:\Documents and Settings\Willis\Desktop\dss.exe C:\Program Files\Grisoft\AVG Free\avgvv.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\uskuyyep.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: (no name) - {7BD6CCF6-25D6-4D96-9612-50793CFBB262} - C:\WINDOWS\system32\mllmj.dll O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - C:\WINDOWS\system32\fcccaaa.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {CECEF132-253B-41F2-A476-57BFA981ADFf} - C:\WINDOWS\system32\tmluriea.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [vmfcbypo.exe] C:\Documents and Settings\All Users\Application Data\vmfcbypo.exe O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe" O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\fymtjpgb.dll",realset O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NETGEAR Smart Wizard.lnk = C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra 'Tools' menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: (no name) - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} () - http://www.miniclip.com/supergerball...GameLoader.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1127383312421 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: fcccaaa - C:\WINDOWS\system32\fcccaaa.dll (file missing) O20 - Winlogon Notify: mllmj - C:\WINDOWS\system32\mllmj.dll O20 - Winlogon Notify: winzbr32 - C:\WINDOWS\system32\winzbr32.dll (file missing) O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\system32\WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" O23 - Service: Autodesk Licensing Service - Autodesk - "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG Free\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG Free\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6291338.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ahvjcrtx.exe /service O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - "C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe" O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\tomcat\bin\tomcat5.exe //RS//Tomcat5 O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 ewido security suite driver - c:\program files\ewido\security suite\guard.sys R1 oreans32 - c:\windows\system32\drivers\oreans32.sys R2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys R2 BTSLBCSP (Bluetooth Port Client Driver) - c:\windows\system32\drivers\btslbcsp.sys <Not Verified; WIDCOMM, Inc.; Bluetooth Software 1.4.2 Build 10> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S3 SABProcEnum - c:\program files\superadblocker.com\super ad blocker\sabprocenum.sys (file missing) S3 USB100 (USB 10/100 Network Adapter) - c:\windows\system32\drivers\usb100.sys <Not Verified; USBs; USB 10/100 Ethernet Adapter> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Autodesk Licensing Service - "c:\program files\common files\autodesk shared\service\adskscsrv.exe" <Not Verified; Autodesk; Autodesk Licensing Service> R2 mi-raysat_3dsmax8 (RaySat_3dsmax8 Server) - "c:\program files\autodesk\3dsmax8\mentalray\satellite\raysat_3dsmax8server.exe" S2 DNSCacheReader (dns cache reader) - c:\windows\system32\j6291338.exe (file missing) S2 DomainService - c:\windows\system32\ahvjcrtx.exe /service (file missing) S2 ewido security suite guard - c:\program files\ewido\security suite\ewidoguard.exe <Not Verified; ewido networks; guard> S3 Tomcat5 (Apache Tomcat) - c:\tomcat\bin\tomcat5.exe //rs//tomcat5 <Not Verified; Apache Software Foundation; Service Runner> -- Files created between 2007-06-17 and 2007-07-17 ----------------------------- 2007-07-17 11:29:23 21312 --a------ C:\WINDOWS\choice.exe 2007-07-17 11:29:03 0 d-------- C:\ie-spyad 2007-07-17 11:28:46 0 d-------- C:\Program Files\SpywareBlaster 2007-07-17 03:54:41 278 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys 2007-07-17 03:54:41 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware> 2007-07-17 03:38:29 124436 --a------ C:\WINDOWS\system32\fymtjpgb.dll 2007-07-17 03:28:30 8576 --a------ C:\WINDOWS\system32\drivers\gjahawhqnhlk.sys <Not Verified; Panda Software International; RKPavProc Driver> 2007-07-17 02:43:56 8576 --a------ C:\WINDOWS\system32\drivers\agfqilincynu.sys <Not Verified; Panda Software International; RKPavProc Driver> 2007-07-17 02:35:30 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-07-17 02:35:28 0 d-------- C:\WINDOWS\LastGood 2007-07-16 22:14:28 0 d-------- C:\Documents and Settings\All Users\Application Data\Documents 2007-07-16 12:30:39 124436 -----n--- C:\WINDOWS\system32\tksxteyg.dll 2007-07-15 12:27:39 124436 --a------ C:\WINDOWS\system32\tmluriea.dll 2007-07-13 04:53:22 0 d-------- C:\Documents and Settings\Willis\Application Data\TrojanHunter 2007-07-13 04:37:31 1156 --a------ C:\WINDOWS\mozver.dat 2007-07-13 03:18:14 0 d-------- C:\Program Files\TrojanHunter 4.7 2007-07-11 20:16:19 1356016 ---hs---- C:\WINDOWS\system32\jmllm.ini2 2007-07-09 10:48:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy -- Find3M Report --------------------------------------------------------------- 2007-07-17 04:42:48 0 d-------- C:\Program Files\QuickTime 2007-07-17 04:40:12 0 d-------- C:\Program Files\MSN Messenger 2007-07-17 04:28:00 0 d-------- C:\Program Files\Kontiki 2007-07-17 04:24:42 0 d-------- C:\Program Files\iTunes 2007-07-17 04:23:55 0 d-------- C:\Program Files\Google 2007-07-17 03:32:39 1352047 ---hs---- C:\WINDOWS\system32\jmllm.bak2 2007-07-17 03:31:50 0 d-------- C:\Documents and Settings\Willis\Application Data\uTorrent 2007-07-17 03:28:05 0 d-------- C:\Program Files\Mpeg2Decoder 2007-07-16 12:22:52 1365169 ---hs---- C:\WINDOWS\system32\jmllm.bak1 2007-07-13 12:09:17 0 d-------- C:\Documents and Settings\Willis\Application Data\AVG7 2007-07-13 04:58:37 0 d-------- C:\Documents and Settings\Willis\Application Data\AdobeUM 2007-07-13 04:46:15 0 d-------- C:\Program Files\IrfanView 2007-07-02 22:19:58 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-07-01 13:51:35 0 d-------- C:\Program Files\Yahoo! 2007-06-16 13:22:07 662 --a------ C:\WINDOWS\system32\scchk32.exe 2007-06-10 14:57:15 263220 -----n--- C:\WINDOWS\system32\mllmj.dll -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} C:\WINDOWS\system32\uskuyyep.dll [x] {72853161-30C5-4D22-B7F9-0BBC1D38A37E} C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll {7BD6CCF6-25D6-4D96-9612-50793CFBB262} C:\WINDOWS\system32\mllmj.dll {8A61098D-612B-4EF2-943D-64E920684061} C:\WINDOWS\system32\fcccaaa.dll [x] {AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar4.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll {CECEF132-253B-41F2-A476-57BFA981ADFf} C:\WINDOWS\system32\tmluriea.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe" "ATIModeChange"="Ati2mdxx.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ "4oD"="\"C:\\Program Files\\Kontiki\\KHost.exe\" -all" "GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"" "vmfcbypo.exe"="C:\\Documents and Settings\\All Users\\Application Data\\vmfcbypo.exe" "SC2"="C:\\WINDOWS\\system32\\scchk32.exe" "THGuard"="\"C:\\Program Files\\TrojanHunter 4.7\\THGuard.exe\"" "GPLv3"="rundll32.exe \"C:\\WINDOWS\\system32\\fymtjpgb.dll\",realset" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe" "kdx"="C:\\Program Files\\Kontiki\\KHost.exe -all" "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook" "{8A61098D-612B-4EF2-943D-64E920684061}"="" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccaaa HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllmj HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzbr32 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 bthsvcs REG_MULTI_SZ BthServ\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AGFQILINCYNU *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_GJAHAWHQNHLK *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_RKPAVPROC *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SDTHOOK -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.igetnet.com 127.0.0.1 code.ignphrases.com 127.0.0.1 clear-search.com 127.0.0.1 r1.clrsch.com 127.0.0.1 sds.clrsch.com 127.0.0.1 status.clrsch.com 127.0.0.1 www.clrsch.com 127.0.0.1 clr-sch.com 127.0.0.1 sds-qckads.com 127.0.0.1 status.qckads.com 32 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-07-17 at 11:42:31 --------- """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" HiJackThis Log Logfile of HijackThis v1.99.1 Scan saved at 11:44:58, on 17/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Grisoft\AVG Free\avgcc.exe C:\Program Files\Grisoft\AVG Free\avgvv.exe C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\DOCUME~1\Willis\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [vmfcbypo.exe] C:\Documents and Settings\All Users\Application Data\vmfcbypo.exe O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe" O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\fymtjpgb.dll",realset O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NETGEAR Smart Wizard.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} - http://www.miniclip.com/supergerball...GameLoader.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1127383312421 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6291338.exe (file missing) O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ahvjcrtx.exe (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\tomcat\bin\tomcat5.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Thanks for any help you can give. Wil86 Last edited by wil86; 07-17-2007 at 05:08 AM. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-17-2007, 01:44 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hello and Welcome to TSF.
If you wish to receive immediate notification of the replies as soon as they are posted, please subscribe to this thread: click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ---------------------------------------------------------------------------------------------
Do not mouseclick combofix's window whilst it's running. That may cause it to stall --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it along with the Combofix log.
__________________
My services are free. However, you can donate to TSF to help keep it running.   Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
07-17-2007, 02:10 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Combofix Log:
"Willis" - 2007-07-17 20:46:54 - ComboFix 07-07-17.8 - Service Pack 2 NTFS (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\fymtjpgb.dll C:\WINDOWS\system32\tksxteyg.dll C:\WINDOWS\system32\tmluriea.dll C:\WINDOWS\system32\bgpjtmyf.ini C:\WINDOWS\system32\jmllm.bak1 C:\WINDOWS\system32\jmllm.bak2 C:\WINDOWS\system32\jmllm.ini C:\WINDOWS\system32\jmllm.ini2 C:\WINDOWS\system32\jmllm.tmp C:\WINDOWS\system32\gyetxskt.ini C:\WINDOWS\system32\jmllm.bak1 C:\WINDOWS\system32\jmllm.bak2 C:\WINDOWS\system32\jmllm.ini C:\WINDOWS\system32\jmllm.ini2 C:\WINDOWS\system32\jmllm.tmp C:\WINDOWS\system32\jmllm.bak1 C:\WINDOWS\system32\jmllm.bak2 C:\WINDOWS\system32\jmllm.ini C:\WINDOWS\system32\jmllm.ini2 C:\WINDOWS\system32\jmllm.tmp C:\WINDOWS\system32\mllmj.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\#SharedObjects\AB62TT69\iforex.com C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\#SharedObjects\AB62TT69\iforex.com\Emerp\Events\flash_object.swf\user_data.sol C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\#SharedObjects\AB62TT69\www.broadcaster.com C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\DOCUME~1\Willis\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\DOCUME~1\Willis\Desktop.\internet explorer.lnk C:\WINDOWS\system32\scchk32.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CMDSERVICE -------\LEGACY_DNSCACHEREADER -------\LEGACY_DOMAINSERVICE -------\DNSCacheReader -------\DomainService ((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 ))))))))))))))))))))))))))))))) 2007-07-17 20:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 11:38 <DIR> d-------- C:\Deckard 2007-07-17 11:29 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-17 11:29 <DIR> d-------- C:\ie-spyad 2007-07-17 11:28 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-17 02:43 8,576 --a------ C:\WINDOWS\system32\drivers\agfqilincynu.sys 2007-07-17 02:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-07-16 22:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Documents 2007-07-13 04:53 <DIR> d-------- C:\DOCUME~1\Willis\APPLIC~1\TrojanHunter 2007-07-13 04:37 1,156 --a------ C:\WINDOWS\mozver.dat 2007-07-13 03:18 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-07-09 10:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-17 19:55:03 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\uTorrent 2007-07-17 03:42:48 -------- d-----w C:\Program Files\QuickTime 2007-07-17 03:40:12 -------- d-----w C:\Program Files\MSN Messenger 2007-07-17 03:28:00 -------- d-----w C:\Program Files\Kontiki 2007-07-17 03:24:42 -------- d-----w C:\Program Files\iTunes 2007-07-17 03:23:55 -------- d-----w C:\Program Files\Google 2007-07-17 02:28:05 -------- d-----w C:\Program Files\Mpeg2Decoder 2007-07-13 03:58:37 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\AdobeUM 2007-07-13 03:46:15 -------- d-----w C:\Program Files\IrfanView 2007-07-02 21:19:58 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 12:51:35 -------- d-----w C:\Program Files\Yahoo! 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2007-06-18 15:57 1098840 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] 2006-10-27 00:48 2210608 --a------ C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2006-05-03 04:14 434279 --a------ C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2007-01-20 00:55 2403392 -ra------ c:\program files\google\googletoolbar4.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] 2007-06-29 21:51 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 03:56] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 21:00] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-05-10 12:02] "AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-06-26 08:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 12:58] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-07 13:53] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 13:00 C:\WINDOWS\system32\bthprops.cpl] "4oD"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "vmfcbypo.exe"="C:\Documents and Settings\All Users\Application Data\vmfcbypo.exe" [] "THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-10-13 01:13] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 21:51] "kdx"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-06-18 15:58] C:\DOCUME~1\Willis\STARTM~1\Programs\Startup Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26] BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-08-04 17:02:30] InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-06-17 15:55:23] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56] NETGEAR Smart Wizard.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe [2006-09-10 18:34:06] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Program Files\ewido\security suite\shellhook.dll" [2004-09-30 13:21] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccaaa] fcccaaa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzbr32] winzbr32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ ************************************************************************** catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-17 20:57:58 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-17 21:00:26 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-17 20:59 --- E O F --- |
|
|
|
|
07-18-2007, 03:26 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hi,
The log is looking good. There is a little more work to do. I would first like to warn you about P2P file sharing apps like uTorrent and Kontiki which are installed on your machine. While it is not my place to tell you what to do, P2p apps like thoses are the largest source of malware we see. You'll be doing yourself a favor by removing them. References for the risk of these programs are here, here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. ==============================================
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall. ================================= Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
================================== Perform an online scan using Internet Explorer with Panda ActiveScan
================================= Restart your computer. ================================= Scan with HijackThis and save the log. ================================= Post back the latest Combofix log, the fresh HijackThis log, and the Panda online scan results. Also, please let me know how the computer is running now.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
07-18-2007, 11:37 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
New ComboFix Log
"Willis" - 2007-08-03 18:25:28 - ComboFix 07-07-17.8 - Service Pack 2 NTFS Command switches used :: C:\Documents and Settings\Willis\Desktop\CFScript.txt ((((((((((((((((((((((((( Files Created from 2007-07-03 to 2007-08-03 ))))))))))))))))))))))))))))))) 2007-07-17 20:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 11:38 <DIR> d-------- C:\Deckard 2007-07-17 11:29 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-17 11:29 <DIR> d-------- C:\ie-spyad 2007-07-17 11:28 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-17 02:43 8,576 --a------ C:\WINDOWS\system32\drivers\agfqilincynu.sys 2007-07-17 02:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-07-16 22:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Documents 2007-07-13 04:53 <DIR> d-------- C:\DOCUME~1\Willis\APPLIC~1\TrojanHunter 2007-07-13 04:37 1,156 --a------ C:\WINDOWS\mozver.dat 2007-07-13 03:18 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-07-09 10:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-03 15:53:54 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\uTorrent 2007-07-17 03:42:48 -------- d-----w C:\Program Files\QuickTime 2007-07-17 03:40:12 -------- d-----w C:\Program Files\MSN Messenger 2007-07-17 03:28:00 -------- d-----w C:\Program Files\Kontiki 2007-07-17 03:24:42 -------- d-----w C:\Program Files\iTunes 2007-07-17 03:23:55 -------- d-----w C:\Program Files\Google 2007-07-17 02:28:05 -------- d-----w C:\Program Files\Mpeg2Decoder 2007-07-13 03:58:37 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\AdobeUM 2007-07-13 03:46:15 -------- d-----w C:\Program Files\IrfanView 2007-07-02 21:19:58 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 12:51:35 -------- d-----w C:\Program Files\Yahoo! 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2007-06-18 15:57 1098840 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] 2006-10-27 00:48 2210608 --a------ C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2006-05-03 04:14 434279 --a------ C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2007-01-20 00:55 2403392 -ra------ c:\program files\google\googletoolbar4.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] 2007-06-29 21:51 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 03:56] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 21:00] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-05-10 12:02] "AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-06-26 08:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 12:58] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-07 13:53] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 13:00 C:\WINDOWS\system32\bthprops.cpl] "4oD"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-10-13 01:13] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 21:51] "kdx"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-06-18 15:58] C:\DOCUME~1\Willis\STARTM~1\Programs\Startup Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26] BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-08-04 17:02:30] InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-06-17 15:55:23] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56] NETGEAR Smart Wizard.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe [2006-09-10 18:34:06] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Program Files\ewido\security suite\shellhook.dll" [2004-09-30 13:21] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzbr32] winzbr32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e853d97c-23dc-11da-9824-806d6172696f}] AutoRun\command- E:\BS4Launcher.exe *Newly Created Service* - CATCHME ************************************************************************** catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-03 18:31:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-03 18:35:11 C:\ComboFix-quarantined-files.txt ... 2007-08-03 18:33 C:\ComboFix2.txt ... 2007-08-03 14:29 C:\ComboFix3.txt ... 2007-07-17 21:00 --- E O F --- |
|
|
|
|
07-18-2007, 02:55 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Quote:
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
|
07-19-2007, 01:54 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Panda Scan
Incident Status Location Adware:adware/powerscan Not disinfected Windows Registry Adware:adware/surfaccuracy Not disinfected Windows Registry Adware:adware/ist.istbar Not disinfected Windows Registry Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.statcounter.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[statse.webtrendslive.com/] Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.ads.addynamix.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.zedo.com/] Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.888.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.2o7.net/] Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.bluestreak.com/] Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.yadro.ru/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.com.com/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.burstnet.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.paycounter.com/] Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.systemdoctor.com/] Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[stats1.reliablestats.com/] Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.bravenet.com/] Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.adopt.hbmediapro.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.atwola.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.toplist.cz/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.advertising.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.overture.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.adtech.de/] Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.tradedoubler.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@2o7[2].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@888[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ad.yieldmanager[1].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adopt.hbmediapro[2].txt Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ads.addynamix[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Willis\Cookies\willis@ads.pointroll[2].txt Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adtech[2].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Willis\Cookies\willis@adultfriendfinder[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Willis\Cookies\willis@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atwola[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Willis\Cookies\willis@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Willis\Cookies\willis@azjmp[2].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bluestreak[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bs.serving-sys[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@bs.serving-sys[3].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Willis\Cookies\willis@doubleclick[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Willis\Cookies\willis@drivecleaner[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Willis\Cookies\willis@errorsafe[1].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Willis\Cookies\willis@int.sitestat[1].txt Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Willis\Cookies\willis@int.sitestat[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Willis\Cookies\willis@mediaplex[2].txt Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Willis\Cookies\willis@overture[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Willis\Cookies\willis@questionmarket[2].txt Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Willis\Cookies\willis@searchportal.information[2].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Willis\Cookies\willis@server.iad.liveperson[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Willis\Cookies\willis@serving-sys[2].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Willis\Cookies\willis@statcounter[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Willis\Cookies\willis@stats.drivecleaner[2].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Willis\Cookies\willis@stats1.reliablestats[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Willis\Cookies\willis@systemdoctor[1].txt Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tickle[1].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Willis\Cookies\willis@toplist[1].txt Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tradedoubler[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Willis\Cookies\willis@tribalfusion[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Willis\Cookies\willis@winantispyware[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Willis\Cookies\willis@winantivirus[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Willis\Cookies\willis@www6.addfreestats[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Willis\Cookies\willis@xiti[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Willis\Cookies\willis@zedo[1].txt Spyware:Spyware/Apropos Not disinfected C:\Documents and Settings\Willis\Desktop\aproposfix\backups\backups.zip[backups/ace.dll] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Willis\Desktop\ComboFix.exe[nircmd.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Willis\Desktop\Wil\l2mfix\Process.exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\94blu.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\c2hBl0.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\jEKOhL.dat Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\yDF.dat Spyware:Spyware/Virtumonde Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\fymtjpgb.dll.vir Spyware:Spyware/Virtumonde Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\mllmj.dll.vir Spyware:Spyware/Virtumonde Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\tksxteyg.dll.vir Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe Adware:Adware/CommAd Not disinfected C:\WINDOWS\V2lsbGlz\ktZAQN0okwQFDTO0Zc.vbs """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Combo fix log "Willis" - 2007-08-03 18:25:28 - ComboFix 07-07-17.8 - Service Pack 2 NTFS Command switches used :: C:\Documents and Settings\Willis\Desktop\CFScript.txt ((((((((((((((((((((((((( Files Created from 2007-07-03 to 2007-08-03 ))))))))))))))))))))))))))))))) 2007-07-17 20:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 11:38 <DIR> d-------- C:\Deckard 2007-07-17 11:29 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-17 11:29 <DIR> d-------- C:\ie-spyad 2007-07-17 11:28 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-17 02:43 8,576 --a------ C:\WINDOWS\system32\drivers\agfqilincynu.sys 2007-07-17 02:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-07-16 22:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Documents 2007-07-13 04:53 <DIR> d-------- C:\DOCUME~1\Willis\APPLIC~1\TrojanHunter 2007-07-13 04:37 1,156 --a------ C:\WINDOWS\mozver.dat 2007-07-13 03:18 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-07-09 10:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-03 15:53:54 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\uTorrent 2007-07-17 03:42:48 -------- d-----w C:\Program Files\QuickTime 2007-07-17 03:40:12 -------- d-----w C:\Program Files\MSN Messenger 2007-07-17 03:28:00 -------- d-----w C:\Program Files\Kontiki 2007-07-17 03:24:42 -------- d-----w C:\Program Files\iTunes 2007-07-17 03:23:55 -------- d-----w C:\Program Files\Google 2007-07-17 02:28:05 -------- d-----w C:\Program Files\Mpeg2Decoder 2007-07-13 03:58:37 -------- d-----w C:\DOCUME~1\Willis\APPLIC~1\AdobeUM 2007-07-13 03:46:15 -------- d-----w C:\Program Files\IrfanView 2007-07-02 21:19:58 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 12:51:35 -------- d-----w C:\Program Files\Yahoo! 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2007-06-18 15:57 1098840 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] 2006-10-27 00:48 2210608 --a------ C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2006-05-03 04:14 434279 --a------ C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2007-01-20 00:55 2403392 -ra------ c:\program files\google\googletoolbar4.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] 2007-06-29 21:51 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 03:56] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 21:00] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-05-10 12:02] "AVG7_EMC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" [2007-06-26 08:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 12:58] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-07 13:53] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 13:00 C:\WINDOWS\system32\bthprops.cpl] "4oD"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-10-13 01:13] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 21:51] "kdx"="C:\Program Files\Kontiki\KHost.exe" [2006-11-08 17:32] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-06-18 15:58] C:\DOCUME~1\Willis\STARTM~1\Programs\Startup Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26] BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-08-04 17:02:30] InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-06-17 15:55:23] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56] NETGEAR Smart Wizard.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe [2006-09-10 18:34:06] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Program Files\ewido\security suite\shellhook.dll" [2004-09-30 13:21] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzbr32] winzbr32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e853d97c-23dc-11da-9824-806d6172696f}] AutoRun\command- E:\BS4Launcher.exe *Newly Created Service* - CATCHME ************************************************************************** catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-03 18:31:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-03 18:35:11 C:\ComboFix-quarantined-files.txt ... 2007-08-03 18:33 C:\ComboFix2.txt ... 2007-08-03 14:29 C:\ComboFix3.txt ... 2007-07-17 21:00 --- E O F --- """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Hijack This log Logfile of HijackThis v1.99.1 Scan saved at 20:51, on 2007-07-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.5.0_07\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\uTorrent\uTorrent.exe C:\DOCUME~1\Willis\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NETGEAR Smart Wizard.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} - http://www.miniclip.com/supergerball...GameLoader.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1127383312421 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: winzbr32 - winzbr32.dll (file missing) O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\tomcat\bin\tomcat5.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Computer seems to be running faster than before, there are fewer pop ups. Panda scan showed 62 spyware and 3 hacking tools and rootkits. |
|
|
|
|
07-20-2007, 05:41 AM
|
#8 (permalink) | ||
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hi again,
You are running HijackThis from a temporary directory. It needs to run from a folder of its own in a permanent directory. Please move Hijackthis to it's own folder, It can be done by following this tutorial : ==================================== Quote:
==================================== Please disable teatimer: While both Tea timer and SpyBot are closed Download ResetTeaTimer.bat to your desktop from the following links: http://downloads.subratam.org/ResetTeaTimer.bat alternative link:http://www.bleepingcomputer.com/file...etTeaTimer.bat Run ResetTeaTimer.bat. Since it will not be needed again delete ResetTeaTimer.bat. You can turn Tea timer back on again via SpyBots tools resident page once we are done. ================================== Scan with HijackThis and put a checkmark against the following entries: O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} - http://www.miniclip.com/supergerball...GameLoader.dll O20 - Winlogon Notify: winzbr32 - winzbr32.dll (file missing) Close all browsers and windows except HijackThis and click on "fix checked". ================================= I see that you have Ewido installed. Ewido has been bought by AVG and it's called AVG Anti Spyware now. Please remove Ewido via Add/Remove Programs in Control Panel. ================================= Please download Ccleaner and save it to your desktop. Tutorial for CCleaner During the installation be sure to UN-check the box for "Ccleaner Yahoo Toolbar" unless you want it. Do not scan with it yet. ========================================
======================================= Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". (Note: When run in safe mode, sometimes the GUI is larger than the screen and the buttons at the bottom are partly or completely hidden, making them unaccessible for doing a scan. If this is the case, press the WINKEY + M key or Alt + Spacebar to "Minimize" the AVG display. Then right-click on AVG in the Task Bar and select "Maximize". If that does not help, then you may have to run your scan in normal mode and advise your helper afterwards.) ======================================= Using Windows Explorer (right click on Start, click on Explore), empty the contents of the following folder: Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\TrojanHunter 4.7\Quarantine\ ======================================= Using Windows Explorer (right click on Start, click on Explore), delete the following folders: C:\Documents and Settings\Willis\Desktop\aproposfix C:\Documents and Settings\Willis\Desktop\Wil\l2mfix C:\QooBox C:\Program Files\ewido ======================================= From Safe Mode run Ccleaner
If you have more than one users, run Ccleaner for every user ========================================
Note: Close all open windows, programs, and DO NOT USE the computer while AVG Anti-Spyware is scanning. Doing so can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection. AVG Anti-Spyware is free for 30 days and all the extensions of the full version will be activated. After the 30 day trial, active protection extensions will be deactivated and the program will turn into a feature-limited freeware version that you can continue to use as an on-demand scanner or you may purchase a license to use the full version. We are installing AVG AntiSpyware with its real-time protection disabled. Once your system is clean you may renable it so you can continue using this feature for the remainder of the trial period. ========================================= Reboot in Normal Mode. ========================================= You have not followed my instructions to update your Java. It's very important that you do that. Updating Java:
========================================= Perform an online scan using Internet Explorer with Kaspersky. Go to Start>Control Panel>Add/Remove Programs and remove if Kaspersky online scanner is present prior to downloading the most up-to-date one. Now run this online scan using Internet Explorer: Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner Next Click on Launch Kaspersky Online Scanner You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
============================================= Quote:
================================================ Please post back the results from AVG Anti-Spyware and Kaspersky online scans, and a fresh HijackThis log. P.S. Are you running Apache Tomcat?
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
||
|
|
|
|
07-20-2007, 10:59 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hacking tools and rootkits were displayed on panda scan box however if there are none displayed in the log then im sure its fine.
Im unsure how to disable the tea timer. Pop ups have now stopped. I am unable to run Kaspersky: After launching it and accepting the agreement i click on 'Install ActiveX Control' and i get sent to a Welcome to the Kaspersky Online Scanner screen where the only clickable links are 'Kaspersky File Scanner' and 'antivirus solution'. Yes am running Apache Tomcat, it was for an xml project at uni. ================================ AVG Antispyware scan --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 16:34 2007-07-20 + Scan result: C:\WINDOWS\V2lsbGlz\ktZAQN0okwQFDTO0Zc.vbs -> Trojan.Small : Cleaned with backup (quarantined). ::Report end ============================== New Hijack This Log Logfile of HijackThis v1.99.1 Scan saved at 17:55, on 2007-07-20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Willis\Desktop\Wil\Install and Setup Apps\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NETGEAR Smart Wizard.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1127383312421 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\tomcat\bin\tomcat5.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Last edited by wil86; 07-20-2007 at 11:01 AM. |
|
|
|
|
07-20-2007, 01:14 PM
|
#10 (permalink) | ||
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hi,
Quote:
Quote:
 About the Kaspersky scan, try the following instructions and see if it works now:
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
||
|
|
|
|
07-20-2007, 08:34 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 12
OS: XP
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Here is my kaspersky log
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, July 21, 2007 3:30:25 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 21/07/2007 Kaspersky Anti-Virus database records: 343325 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 86975 Number of viruses found: 1 Number of infected objects: 0 / 0 Number of suspicious objects: 2 Duration of the scan process: 02:15:21 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Kontiki\error.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\YazzleSudoku.zip/Yazzle1162OinUninstaller.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\YazzleSudoku.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Willis\Application Data\AVG7\Log\emc.log Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\cert8.db Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\history.dat Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\key3.db Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\parent.lock Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\search.sqlite Object is locked skipped C:\Documents and Settings\Willis\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Willis\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Application Data\Mozilla\Firefox\Profiles\b8hb30yf.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Willis\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Willis\Local Settings\History\History.IE5\MSHist012007072020070721\index.dat Object is locked skipped C:\Documents and Settings\Willis\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Willis\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Willis\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{9901B591-1E70-4C2C-AF0D-699299657A79}\RP557\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{75E23366-1ED3-49E7-B098-8AAE6408F03B}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_66c.dat Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
07-21-2007, 12:09 AM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
Hi,
The only reported item in the Kaspersky log is in the Recovery folder of Spybot Search and Destroy. Open Spybot S&D, click on "Recovery", put a chekmark against YazzleSudoku.zip and click on "Purge selected item". When you're done with this and the following last steps, you'll be good to go.  Please remove/delete all the tools I asked you to download, except AVG Anti Spyware and Ccleaner. Use Add/Remove Programs to remove if listed there otherwise just delete them. Those tools are constantly updated and there is no use of keeping older versions. Also delete the following folders: C:\Combofix and empty the recycle bin. Since AVG Anti Spyware is a trial version, the realtime guard and automatic update will stop functioning after the trial period. That is why we are not installing the guard so it will not interfere with the cleanup or the malware removal process. You can use AVG-AS as an on-demand scanner (recommended) but you will have to manually update the definition file each time you scan. Ccleaner is also a useful tool to keep for cleaning your cookies and temp files on a regular basis. Create a new System Restore point to prevent reinfection from old restore points. Go to Start>Run and type sysdm.cpl. Press Enter
Windows XP System Restore Guide ================================================== A colleague of ours has excellent information and tips on the prevention of malware here and more on improving speed/system performance after malware removal here . If you want to fight back the Malware Writers, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved. Happy Surfing!
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
07-22-2007, 04:39 AM
|
#14 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,479
OS: XP SP3
|
Re: Pop ups and slow computer - Trojan horse Kolweb.G etc.
You're welcome. Glad we could help. Stay safe!
 Since your problem appears to be resolved, this thread will now be closed. If you need it reopened, please pm a moderator to reopen it. Anyone else with similar issues, please start a thread of your own
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
| Thread Tools | |
|
|
located at the bottom of the page.
then click 
and post back the contents please.
