|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-19-2007, 02:59 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: WinXP Professional
|
Another Outerinfo problem
Hi:
This is my very first post on any kind of message board. I've been reading about the outerinfo problems and I gather that each solution is unique. So I will tell you that my symptoms are the same as most. I started getting the pop ups after I loaded a new version of McAfee. I run Windows XP. I have downloaded Spybot and Ad-Aware and have operated them and needless to say the popups are still there. I have seen in other posts that you request downloads to the desktop of both Hijackthis and ComboFix which I did. So, prior to running them, I will await your instruction. Thanks so much. Boo |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-19-2007, 03:24 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Re: Another Outerinfo problem
Please follow MicroBell's 5 Step process - http://www.techsupportforum.com/secu...sting-log.html.
You shall have a proper set of logs for us after that
__________________
Question - what have you done for the community today? |
|
|
|
|
07-20-2007, 05:47 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: WinXP Professional
|
Re: Another Outerinfo problem
Hi:
Thanks for taking the time to help. I recently downloaded and installed McAfee virus scanner from their web site. After I used it the first time, I went on the internet and started getting the "advertisements by outerinfo" pop-ups. At that point I downloaded and ran Spybot and Ad-Aware and after running them I was still getting the outerinfo ads. I tried to uninstall outerinfo. I even went to their website and downloaded the uninstall program, ran it and still had the pop ups. This then brought me to your website seeking help with this situation. Boo Deckard's System Scanner v20070711.54 Run by computer user on 2007-07-20 at 19:24:06 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 6: 2007-07-20 23:24:20 UTC - RP1276 - Deckard's System Scanner Restore Point 5: 2007-07-19 02:48:37 UTC - RP1275 - System Checkpoint 4: 2007-07-18 01:35:51 UTC - RP1274 - Spybot-S&D Spyware removal 3: 2007-07-17 02:56:24 UTC - RP1273 - Spybot-S&D Spyware removal 2: 2007-07-17 00:01:20 UTC - RP1272 - Installed Ad-Aware 2007 -- First Restore Point -- 1: 2007-07-15 14:47:19 UTC - RP1271 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as computer user.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:27:46 PM, on 7/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\Program Files\Iomega\DriveIcons\ImgIcon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Sony Handheld\HOTSYNC.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe C:\WINDOWS\system32\cisvc.exe C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\Intuit\QB2007~1\QBDBMgr.exe c:\program files\mcafee\msc\mcuimgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\computer user\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\computer user.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Azlb] "C:\Program Files\Common Files\?icrosoft.NET\l?gonui.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/...6/mcinsctl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/...16/mcgdmgr.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe -- End of file - 9684 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 agp440 (Intel AGP Bus Filter) - c:\windows\\systemroot\system32\drivers\agp440.sys (file missing) R0 Gernuwa - c:\windows\system32\drivers\gernuwa.sys <Not Verified; Symantec Corporation; pcAnywhere> R0 iomdisk (Iomega Devices Disk Filter Services) - c:\windows\system32\drivers\iomdisk.sys <Not Verified; Iomega Corporation; Microsoft(R) Windows NT(R) Operating System> R1 AW_HOST - c:\windows\system32\drivers\aw_host5.sys <Not Verified; Symantec Corporation; pcAnywhere> R1 awlegacy - c:\windows\system32\drivers\awlegacy.sys <Not Verified; Symantec Corporation; pcAnywhere> R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> S3 bvrp_pci - c:\windows\system32\drivers\bvrp_pci.sys S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 _IOMEGA_ACTIVE_DISK_SERVICE_ (Iomega Active Disk) - "c:\program files\iomega\autodisk\adservice.exe" <Not Verified; Iomega Corporation; Iomega Active Disk> R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> R2 Iomega App Services - "c:\progra~1\iomega\system32\appservices.exe" <Not Verified; Iomega Corporation; Iomega App Services> S3 awhost32 (pcAnywhere Host Service) - c:\program files\symantec\pcanywhere\awhost32.exe <Not Verified; Symantec Corporation; pcAnywhere> S3 Intuit Fuse Service - "c:\program files\common files\intuit\fuse\service\intuit fuse service.exe" <Not Verified; Intuit; Intuit Fuse Service> S3 QBFCService (Intuit QuickBooks FCS) - "c:\program files\common files\intuit\quickbooks\fcs\intuit.quickbooks.fcs.exe" <Not Verified; Intuit Inc.; QuickBooks 2007> S4 Iomega Activity Disk2 - "" S4 QBCFMonitorService - "c:\program files\common files\intuit\quickbooks\qbcfmonitorservice.exe" <Not Verified; Intuit; QuickBooks for Windows> S4 QuickBooksDB - c:\progra~1\intuit\qb2006\qbdbmgrn.exe -hvquickbooksdb <Not Verified; Intuit, Inc.; QuickBooks Database Manager> -- Scheduled Tasks ------------------------------------------------------------- 2007-07-20 16:39:15 428 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job 2007-07-20 03:00:18 504 --a------ C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job 2007-07-15 17:00:11 452 --a------ C:\WINDOWS\Tasks\EasyShare Registration Task.job 2007-07-15 16:19:27 366 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2007-07-15 16:19:24 368 --a------ C:\WINDOWS\Tasks\McQcTask.job -- Files created between 2007-06-20 and 2007-07-20 ----------------------------- 2007-07-20 09:11:59 8576 --a------ C:\WINDOWS\system32\drivers\xhxocpnjpdfs.sys <Not Verified; Panda Software International; RKPavProc Driver> 2007-07-20 08:28:10 21312 --a------ C:\WINDOWS\choice.exe 2007-07-20 08:25:18 0 d-------- C:\ie-spyad 2007-07-20 08:15:25 0 d-------- C:\Program Files\SpywareBlaster 2007-07-19 21:49:55 8576 --a------ C:\WINDOWS\system32\drivers\vpivfmkgglxs.sys <Not Verified; Panda Software International; RKPavProc Driver> 2007-07-19 21:37:45 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-07-19 21:37:40 0 d-------- C:\WINDOWS\LastGood 2007-07-19 16:29:35 0 d-------- C:\Program Files\Trend Micro 2007-07-19 08:36:10 0 d-------- C:\Documents and Settings\computer user\Application Data\TrojanHunter 2007-07-18 21:17:48 0 d-------- C:\Program Files\TrojanHunter 4.7 2007-07-18 19:29:56 0 d-------- C:\Documents and Settings\computer user\Application Data\MalwareBot 2007-07-16 20:02:17 0 d-------- C:\Program Files\Lavasoft 2007-07-16 20:02:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-07-16 20:00:18 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-15 17:13:35 0 d-------- C:\Restored_spca_Files 2007-07-15 16:24:29 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-07-15 16:24:29 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-07-15 16:24:11 0 d-------- C:\Program Files\SiteAdvisor 2007-07-15 16:24:10 0 d-------- C:\Documents and Settings\computer user\Application Data\SiteAdvisor 2007-07-15 16:24:10 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-07-15 16:15:35 0 d-------- C:\Program Files\McAfee 2007-07-15 16:15:08 0 d-------- C:\Program Files\Common Files\McAfee 2007-07-15 16  41 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee2007-07-15 10:12:48 0 d-------- C:\Program Files\ISM 2007-07-05 16:58:35 0 d-------- C:\Program Files\Yahoo! Games 2007-07-01 18:22:35 23537 --a------ C:\logfile 2007-07-01 17:14:48 0 d-------- C:\Program Files\Bonjour 2007-07-01 17:11:46 0 d-------- C:\Program Files\QuickTime 2007-07-01 17:10:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-07-01 17:09:37 0 d-------- C:\WINDOWS\system32\BWKDLogs -- Find3M Report --------------------------------------------------------------- 2007-07-20 11:16:27 0 d-------- C:\Program Files\Sony Handheld 2007-07-20 10:27:09 0 d-------- C:\Program Files\Google 2007-07-19 21:28:29 0 d-------- C:\Program Files\Viewpoint 2007-07-16 20:02:10 0 d-------- C:\Documents and Settings\computer user\Application Data\Lavasoft 2007-07-15 16:52:26 0 d-------- C:\Program Files\QUICKENW 2007-07-15 16:29:06 0 d-------- C:\Program Files\McAfee.com 2007-07-01 17:15:09 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-07-01 17:09:30 0 d-------- C:\Program Files\Kodak 2007-07-01 17:07:48 0 d-------- C:\Program Files\Common Files\KODAK 2007-05-25 22:02:35 0 d-------- C:\Program Files\fxsgts -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {089FD14D-132B-48FC-8861-0048AE113215} C:\Program Files\SiteAdvisor\6066\SiteAdv.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {7DB2D5A0-7241-4E79-B68D-6309F01C5231} c:\program files\mcafee\virusscan\scriptcl.dll {9815DA81-2E0C-478c-90E4-06E474E704D0} C:\Program Files\ISM\BndDrive.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "ADUserMon"="C:\\Program Files\\Iomega\\AutoDisk\\ADUserMon.exe" "Iomega Drive Icons"="C:\\Program Files\\Iomega\\DriveIcons\\ImgIcon.exe" "Deskup"="C:\\Program Files\\Iomega\\DriveIcons\\deskup.exe /IMGSTART" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "SiteAdvisor"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe" "MalwareBot"="C:\\Program Files\\MalwareBot\\MalwareBot.exe -boot" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Azlb"="\"C:\\Program Files\\Common Files\\?icrosoft.NET\\l?gonui.exe\"" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\QuickBooks 2002 Delivery Agent.lnk" "backup"="C:\\WINDOWS\\pss\\QuickBooks 2002 Delivery Agent.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Intuit\\QB2002\\COMPON~1\\QBAgent\\QBDAGE~1.EXE " "item"="QuickBooks 2002 Delivery Agent" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^computer user^Start Menu^Programs^Startup^DING!.lnk] "path"="C:\\Documents and Settings\\computer user\\Start Menu\\Programs\\Startup\\DING!.lnk" "backup"="C:\\WINDOWS\\pss\\DING!.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\SOUTHW~1\\Ding\\Ding.exe " "item"="DING!" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_CATCHME *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_RKPAVPROC *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_SDTHOOK *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_VPIVFMKGGLXS *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_XHXOCPNJPDFS -- End of Deckard's System Scanner: finished at 2007-07-20 at 19:29:01 --------- |
|
|
|
|
07-20-2007, 06:02 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Re: Another Outerinfo problem
Do a HijackThis scan & place a check next to these items and select "Fix checked":
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O4 - HKLM\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot O4 - HKCU\..\Run: [Azlb] "C:\Program Files\Common Files\?icrosoft.NET\l?gonui.exe" O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) --------------- Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe Open notepad and copy/paste the text in the quotebox below into it: Code:
Folder:: C:\Program Files\MalwareBot C:\Program Files\AWS C:\Documents and Settings\computer user\Application Data\MalwareBot C:\Documents and Settings\LocalService\Desktop C:\Program Files\Viewpoint  Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.
__________________
Question - what have you done for the community today? |
|
|
|
|
07-20-2007, 08:25 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: WinXP Professional
|
Re: Another Outerinfo problem
Here is the ComboFix.txt file. BTW ViewPoint, WeatherBug and MalwareBot were not in the Add/Remove Program listing.
Thanks, Boo "computer user" - 2007-07-20 22:01:22 - ComboFix 07-07-20.3 - Service Pack 2 NTFS Command switches used :: C:\Documents and Settings\computer user\Desktop\CFScript.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\LocalService\Desktop C:\Program Files\AWS C:\Program Files\AWS\WeatherBug\REMOVE.EXE C:\Program Files\Viewpoint C:\Program Files\Viewpoint\Common\ViewpointService.exe ((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 ))))))))))))))))))))))))))))))) 2007-07-20 19:23 <DIR> d-------- C:\Deckard 2007-07-20 09:11 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\xhxocpnjpdfs.sys 2007-07-20 08:28 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-20 08:25 <DIR> d-------- C:\ie-spyad 2007-07-20 08:15 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-19 21:49 8,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\vpivfmkgglxs.sys 2007-07-19 21:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2007-07-19 21:37 <DIR> d-------- C:\WINDOWS\LastGood 2007-07-19 16:31 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-19 16:29 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-19 12:30 109,920 --a------ C:\OiUninstaller.exe 2007-07-19 08:36 <DIR> d-------- C:\DOCUME~1\MARCRO~1\APPLIC~1\TrojanHunter 2007-07-18 21:17 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-07-18 19:29 <DIR> d-------- C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot 2007-07-16 20:02 <DIR> d-------- C:\Program Files\Lavasoft 2007-07-16 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-07-16 20:00 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-15 17:13 <DIR> d-------- C:\Restored_spca_Files 2007-07-15 16:24 <DIR> d-------- C:\Program Files\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\MARCRO~1\APPLIC~1\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor 2007-07-15 16:21 71,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys 2007-07-15 16:21 37,480 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys 2007-07-15 16:21 34,184 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys 2007-07-15 16:21 32,008 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys 2007-07-15 16:21 170,408 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys 2007-07-15 16:20 109,608 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys 2007-07-15 16:15 <DIR> d-------- C:\Program Files\McAfee 2007-07-15 16:15 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-07-15 16:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee 2007-07-15 10:12 <DIR> d-------- C:\Program Files\ISM 2007-07-05 16:58 <DIR> d-------- C:\Program Files\Yahoo! Games 2007-07-01 17:14 <DIR> d-------- C:\Program Files\Bonjour 2007-07-01 17:11 <DIR> d-------- C:\Program Files\QuickTime 2007-07-01 17:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-07-01 17:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\BWKDLogs 2007-07-01 17:08 5,632 --a------ C:\WINDOWS\SYSTEM32\ptpusb.dll 2007-07-01 17:08 159,232 --a------ C:\WINDOWS\SYSTEM32\ptpusd.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-20 15:16:27 -------- d-----w C:\Program Files\Sony Handheld 2007-07-20 14:27:09 -------- d-----w C:\Program Files\Google 2007-07-17 00:02:10 -------- d-----w C:\DOCUME~1\MARCRO~1\APPLIC~1\Lavasoft 2007-07-15 20:52:26 -------- d-----w C:\Program Files\QUICKENW 2007-07-15 20:29:06 -------- d-----w C:\Program Files\McAfee.com 2007-07-01 21:15:09 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 21:09:30 -------- d-----w C:\Program Files\Kodak 2007-07-01 21:07:48 -------- d-----w C:\Program Files\Common Files\KODAK 2007-06-04 19:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 19:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 19:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-05-26 02:02:35 -------- d-----w C:\Program Files\fxsgts 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2004-08-08 20:34:25 100,640 ----a-w C:\DOCUME~1\MARCRO~1\APPLIC~1\GDIPFONTCACHEV1.DAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}] 2007-07-11 16:02 192512 --a------ C:\Program Files\ISM\BndDrive.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 13:28] "ADUserMon"="C:\Program Files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 16:39] "Iomega Drive Icons"="C:\Program Files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 14:30] "Deskup"="C:\Program Files\Iomega\DriveIcons\deskup.exe" [2002-07-16 10:55] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-07-01 17:13] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-03-30 11:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24] C:\Documents and Settings\computer user\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 14:36:04] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] DESKTOP.INI [2002-09-03 14:36:04] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-08-29 08:34:39] HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2003-09-28 16:46:05] Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-02-20 05:10:26] KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-06-10 04:09:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] PCANotify.dll 2002-02-15 10:51 24638 C:\WINDOWS\SYSTEM32\PCANotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks 2002 Delivery Agent.lnk backup=C:\WINDOWS\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^computer user^Start Menu^Programs^Startup^DING!.lnk] path=C:\Documents and Settings\computer user\Start Menu\Programs\Startup\DING!.lnk backup=C:\WINDOWS\pss\DING!.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime *Newly Created Service* - CATCHME *Newly Created Service* - RKPAVPROC *Newly Created Service* - SDTHOOK *Newly Created Service* - VPIVFMKGGLXS *Newly Created Service* - XHXOCPNJPDFS Contents of the 'Scheduled Tasks' folder 2007-07-15 21:00:11 C:\WINDOWS\tasks\EasyShare Registration Task.job 2007-07-20 07:00:18 C:\WINDOWS\tasks\MalwareBot Scheduled Scan.job 2007-07-15 20:19:27 C:\WINDOWS\tasks\McDefragTask.job 2007-07-15 20:19:24 C:\WINDOWS\tasks\McQcTask.job 2007-07-21 00:39:19 C:\WINDOWS\tasks\Symantec NetDetect.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-20 22:12:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000004d4 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-20 22:15:34 C:\ComboFix-quarantined-files.txt ... 2007-07-20 22:13 C:\ComboFix2.txt ... 2007-07-19 16:48 --- E O F --- |
|
|
|
|
07-21-2007, 03:48 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Re: Another Outerinfo problem
Open notepad and copy/paste the text in the quotebox below into it:
Code:
File::
C:\WINDOWS\SYSTEM32\DRIVERS\xhxocpnjpdfs.sys
C:\WINDOWS\SYSTEM32\DRIVERS\vpivfmkgglxs.sys
C:\OiUninstaller.exe
C:\Program Files\ISM\BndDrive.dll
Folder::
C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot
Driver::
VPIVFMKGGLXS
XHXOCPNJPDFS
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
* If you're downloading torrents in the background, please disconnect all of them. Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
07-21-2007, 05:48 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: WinXP Professional
|
Re: Another Outerinfo problem
Hi:
So far I have not been getting any pop ups. I had no problems with this latest set of instructions. Boo 1. Hijackthis log - Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:42:53 PM, on 7/21/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\Program Files\Iomega\DriveIcons\ImgIcon.exe C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\Program Files\Sony Handheld\HOTSYNC.EXE C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe c:\program files\mcafee\msc\mcuimgr.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/...6/mcinsctl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/...16/mcgdmgr.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe -- End of file - 9372 bytes 2. Online scan ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, July 21, 2007 5:58:12 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 21/07/2007 Kaspersky Anti-Virus database records: 366226 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 126168 Number of viruses found: 10 Number of infected objects: 30 Number of suspicious objects: 0 Duration of the scan process: 02:30:14 Infected Object Name / Virus Name / Last Action C:\21.tmp/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\21.tmp NSIS: infected - 1 skipped C:\22.tmp/stream/data0003 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped C:\22.tmp/stream Infected: not-a-virus:AdWare.Win32.Agent.ay skipped C:\22.tmp NSIS: infected - 2 skipped C:\722e7f0033db3fb59261f7\sp2\update\update.exe Object is locked skipped C:\Documents and Settings\All Users\Application Data\COMMON FILES\INTUIT\QUICKBOOKS\qbupdate\log\CHANNEL.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\computer user\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped C:\Documents and Settings\computer user\Application Data\Microsoft\Word\AutoRecovery save of Document1.asd Object is locked skipped C:\Documents and Settings\computer user\Application Data\SiteAdvisor\SiteAdv.csh Object is locked skipped C:\Documents and Settings\computer user\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Junk e-mail/18 Jan 2004 21:03 from U.S. Bank:Suspicious attachment detected:.eml/UNNAMED/html Infected: Trojan-Spy.HTML.UrlSpoof.b skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Junk e-mail/18 Jan 2004 21:03 from U.S. Bank:Suspicious attachment detected:.eml/UNNAMED Infected: Trojan-Spy.HTML.UrlSpoof.b skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Outlook\outlook.pst/Personal Folders/Junk e-mail/18 Jan 2004 21:03 from U.S. Bank:Suspicious attachment detected:.eml Infected: Trojan-Spy.HTML.UrlSpoof.b skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Mail MS Mail: infected - 3 skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\computer user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\computer user\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\computer user\Local Settings\Temp\~DF6311.tmp Object is locked skipped C:\Documents and Settings\computer user\Local Settings\Temp\~DFBF3C.tmp Object is locked skipped C:\Documents and Settings\computer user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\computer user\NTUSER.DAT Object is locked skipped C:\Documents and Settings\computer user\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\ff77539029e9c82418b5cd265546e69e\sp2\update\update.exe Object is locked skipped C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.me Object is locked skipped C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.mm Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000001.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped C:\QooBox\Quarantine\C\OiUninstaller.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\QooBox\Quarantine\C\OiUninstaller.exe.vir/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\QooBox\Quarantine\C\OiUninstaller.exe.vir NSIS: infected - 2 skipped C:\QooBox\Quarantine\C\Program Files\Common Files\ICROSO~1.NET\lοgonui.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped C:\QooBox\Quarantine\C\Program Files\ISM\BndDrive.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ay skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.b skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir NSIS: infected - 3 skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tikyg.dll.vir Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1273\A0105870.exe Infected: Trojan.Win32.Small.oa skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0105999.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0106000.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0106003.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.b skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0106003.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0106003.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1275\A0106003.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1276\A0106128.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1276\A0106128.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1276\A0106128.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1276\A0106129.dll Infected: not-a-virus:AdWare.Win32.Agent.ay skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1276\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_iZbXedppuXHp5Sy Object is locked skipped C:\WINDOWS\Temp\mcmsc_3vqsbgbcCO5Ybab Object is locked skipped C:\WINDOWS\Temp\mcmsc_6YUGxDKKmFVPnnT Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_594.dat Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. 3. ComboFix log "computer user" - 2007-07-21 14:35:05 - ComboFix 07-07-20.3 - Service Pack 2 NTFS Command switches used :: C:\Documents and Settings\computer user\Desktop\CFScript.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Log\log_2007_07_20_03_00_06.log C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Log\log_2007_07_20_03_00_17.log C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\CustomScan.stg C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\IgnoreList.stg C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\ScanInfo.stg C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\ScanResults.stg C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\SelectedFolders.stg C:\DOCUME~1\MARCRO~1\APPLIC~1\MalwareBot\Settings\Settings.stg C:\OiUninstaller.exe C:\Program Files\ISM\BndDrive.dll C:\WINDOWS\SYSTEM32\DRIVERS\vpivfmkgglxs.sys C:\WINDOWS\SYSTEM32\DRIVERS\xhxocpnjpdfs.sys ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_VPIVFMKGGLXS -------\LEGACY_XHXOCPNJPDFS -------\vpivfmkgglxs -------\xhxocpnjpdfs ((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 ))))))))))))))))))))))))))))))) 2007-07-20 19:23 <DIR> d-------- C:\Deckard 2007-07-20 08:28 21,312 --a------ C:\WINDOWS\choice.exe 2007-07-20 08:25 <DIR> d-------- C:\ie-spyad 2007-07-20 08:15 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-07-19 21:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2007-07-19 16:31 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-19 16:29 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-19 08:36 <DIR> d-------- C:\DOCUME~1\MARCRO~1\APPLIC~1\TrojanHunter 2007-07-18 21:17 <DIR> d-------- C:\Program Files\TrojanHunter 4.7 2007-07-16 20:02 <DIR> d-------- C:\Program Files\Lavasoft 2007-07-16 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-07-16 20:00 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-15 17:13 <DIR> d-------- C:\Restored_spca_Files 2007-07-15 16:24 <DIR> d-------- C:\Program Files\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\MARCRO~1\APPLIC~1\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor 2007-07-15 16:24 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor 2007-07-15 16:21 71,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys 2007-07-15 16:21 37,480 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys 2007-07-15 16:21 34,184 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys 2007-07-15 16:21 32,008 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys 2007-07-15 16:21 170,408 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys 2007-07-15 16:20 109,608 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys 2007-07-15 16:15 <DIR> d-------- C:\Program Files\McAfee 2007-07-15 16:15 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-07-15 16:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee 2007-07-15 10:12 <DIR> d-------- C:\Program Files\ISM 2007-07-05 16:58 <DIR> d-------- C:\Program Files\Yahoo! Games 2007-07-01 17:14 <DIR> d-------- C:\Program Files\Bonjour 2007-07-01 17:11 <DIR> d-------- C:\Program Files\QuickTime 2007-07-01 17:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-07-01 17:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\BWKDLogs 2007-07-01 17:08 5,632 --a------ C:\WINDOWS\SYSTEM32\ptpusb.dll 2007-07-01 17:08 159,232 --a------ C:\WINDOWS\SYSTEM32\ptpusd.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-20 15:16:27 -------- d-----w C:\Program Files\Sony Handheld 2007-07-20 14:27:09 -------- d-----w C:\Program Files\Google 2007-07-17 00:02:10 -------- d-----w C:\DOCUME~1\MARCRO~1\APPLIC~1\Lavasoft 2007-07-15 20:52:26 -------- d-----w C:\Program Files\QUICKENW 2007-07-15 20:29:06 -------- d-----w C:\Program Files\McAfee.com 2007-07-01 21:15:09 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-01 21:09:30 -------- d-----w C:\Program Files\Kodak 2007-07-01 21:07:48 -------- d-----w C:\Program Files\Common Files\KODAK 2007-06-04 19:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 19:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 19:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-05-26 02:02:35 -------- d-----w C:\Program Files\fxsgts 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2004-08-08 20:34:25 100,640 ----a-w C:\DOCUME~1\MARCRO~1\APPLIC~1\GDIPFONTCACHEV1.DAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}] C:\Program Files\ISM\BndDrive.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 13:28] "ADUserMon"="C:\Program Files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 16:39] "Iomega Drive Icons"="C:\Program Files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 14:30] "Deskup"="C:\Program Files\Iomega\DriveIcons\deskup.exe" [2002-07-16 10:55] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-07-01 17:13] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2007-03-30 11:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24] C:\Documents and Settings\computer user\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 14:36:04] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] DESKTOP.INI [2002-09-03 14:36:04] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-08-29 08:34:39] HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2003-09-28 16:46:05] Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-02-20 05:10:26] KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-06-10 04:09:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] PCANotify.dll 2002-02-15 10:51 24638 C:\WINDOWS\SYSTEM32\PCANotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks 2002 Delivery Agent.lnk backup=C:\WINDOWS\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^computer user^Start Menu^Programs^Startup^DING!.lnk] path=C:\Documents and Settings\computer user\Start Menu\Programs\Startup\DING!.lnk backup=C:\WINDOWS\pss\DING!.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime Contents of the 'Scheduled Tasks' folder 2007-07-15 21:00:11 C:\WINDOWS\tasks\EasyShare Registration Task.job 2007-07-20 07:00:18 C:\WINDOWS\tasks\MalwareBot Scheduled Scan.job 2007-07-15 20:19:27 C:\WINDOWS\tasks\McDefragTask.job 2007-07-15 20:19:24 C:\WINDOWS\tasks\McQcTask.job 2007-07-21 18:51:30 C:\WINDOWS\tasks\Symantec NetDetect.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-21 14:45:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\801AEE179C9018D4F82A4DC807862124\Usage] "QBCommon"=dword:36f5d05a scanning hidden files ... ************************************************************************** Completion time: 2007-07-21 14:55:24 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-21 14:52 C:\ComboFix2.txt ... 2007-07-20 22:22 C:\ComboFix3.txt ... 2007-07-19 16:48 --- E O F --- |
|
|
|
|
07-21-2007, 06:04 PM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Re: Another Outerinfo problem
Do a HijackThis scan & place a check next to these items and select "Fix checked":
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll (file missing) --------------- Then launch Microsoft Outlook & delete this email: Junk e-mail -- 18 Jan 2004 21:03 -- from U.S. Bank:Suspicious attachment detected:.eml --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( C:\21.tmp C:\22.tmp ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( %systemdrive%\Qoobox ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! nircmd wait 7000 del %0 It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
07-21-2007, 07:11 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 6
OS: WinXP Professional
|
Re: Another Outerinfo problem
Wow. That was quick. It opened up an old type DOS window with a black screen and white letters saying "Deleted Successfully !!" and then as quickly as it reported that, it was gone, along with the icon for this batch file on my desktop.
Boo |
|
|
|
|
07-21-2007, 07:21 PM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Re: Another Outerinfo problem
Of the stuff Kaspersky found, C:\System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be reseting/clearing the cache in a little while
---------------------- Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
,
