|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-19-2007, 03:02 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 7
OS: XP
|
reassurance!
Earlier today i was having trouble with "System and Controllers app", which kept encountering errors and shutting down my pc. I've performed a system restore and it seems to have worked. *Touch wood*. I'd just like some reassurance as to wether it's still lurking or wether it's gone.
Thanks :) Deckard's System Scanner v20070711.54 Run by Administrator on 2007-07-19 at 21:59:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 6: 2007-07-19 20:58:19 UTC - RP353 - Software Distribution Service 3.0 5: 2007-07-19 20:44:55 UTC - RP352 - Restore Operation 4: 2007-07-19 20:31:57 UTC - RP351 - Deckard's System Scanner Restore Point 3: 2007-07-18 02:01:30 UTC - RP350 - Software Distribution Service 3.0 2: 2007-07-04 17:43:45 UTC - RP349 - Removed Call of Duty(R) 2 -- First Restore Point -- 1: 2007-06-27 20:08:22 UTC - RP348 - Removed 4oD. Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:41:44, on 19/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ULI5289\ALi5289.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\nfomon\nfomon.exe C:\WINDOWS\system32\vidmon\vidmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Xfire\Xfire.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Administrator\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\ADMINI~1.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing) O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Tools\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe O4 - HKLM\..\Run: [SvcManager] lsass7.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Nfo] C:\WINDOWS\system32\nfomon\nfomon.exe O4 - HKLM\..\Run: [vidmon] C:\WINDOWS\system32\vidmon\vidmon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Policies\Explorer\Run: [{18E50F56-07D4-1033-0627-05072605002c}] "C:\Program Files\Common Files\{18E50F56-07D4-1033-0627-05072605002c}\Update.exe" mc-110-12-0000904 O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/activ...33352D2D2D.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1171929856093 O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O18 - Protocol: bw+0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw+0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw-0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw-0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw00 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw00s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw10 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw10s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw20 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw20s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw30 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw30s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw40 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw40s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw50 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw50s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw60 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw60s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw70 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw70s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw80 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw80s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw90 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw90s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwa0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwa0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwb0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwb0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwc0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwc0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwd0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwd0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwe0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwe0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwf0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwf0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwg0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwh0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwh0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwi0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwi0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwj0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwj0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwk0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwk0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwl0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwl0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwm0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwm0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwn0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwn0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwo0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwo0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwp0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwp0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwq0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwq0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwr0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwr0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bws0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bws0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwt0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwt0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwu0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwu0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwv0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwv0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bww0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bww0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwx0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwx0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwy0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwy0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwz0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwz0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: offline-8876480 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll (file missing) O20 - Winlogon Notify: Run - C:\WINDOWS\system32\ir6ml5j11.dll (file missing) O21 - SSODL: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe (file missing) -- End of file - 22023 bytes -- File Associations ----------------------------------------------------------- .js - JSFile - DefaultIcon - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe",2 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 ABIT-IO - c:\windows\system32\drivers\abit-io.sys <Not Verified; ABIT Computer Corporation; ABIT I/O prot driver> R0 giveio - c:\windows\system32\giveio.sys R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S0 BootScreen - c:\windows\\systemroot\system32\drivers\vidstub.sys (file missing) S3 ENTECH - c:\windows\system32\drivers\entech.sys (file missing) S3 LHidUsbK (Logitech SetPoint USB Receiver device driver) - c:\windows\system32\drivers\lhidusbk.sys (file missing) S3 LMouKE (Logitech SetPoint Mouse Filter Driver) - c:\windows\system32\drivers\lmouke.sys (file missing) S3 ovt519 (D-Link VGA Webcam) - c:\windows\system32\drivers\ov519vid.sys <Not Verified; OmniVision Technologies, Inc.; Dual Mode USB Camera 519> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 WinVNC4 (VNC Server Version 4) - "c:\program files\realvnc\vnc4\winvnc4.exe" -service (file missing) -- Scheduled Tasks ------------------------------------------------------------- 2007-07-18 22:42:08 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-06-19 and 2007-07-19 ----------------------------- 2007-07-19 21:51:19 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2007-07-19 21:33:16 0 d-------- C:\Program Files\Trend Micro 2007-07-04 18:43:29 6905856 --a------ C:\Documents and Settings\Administrator\ntuser.dat 2007-07-03 18:58:11 0 d-------- C:\Program Files\Dave 2007-06-27 21:21:21 0 d-------- C:\Program Files\Common Files\Skype 2007-06-27 21:09:50 0 d-------- C:\WINDOWS\LastGood -- Find3M Report --------------------------------------------------------------- 2007-07-19 21:57:40 0 d-------- C:\Documents and Settings\Administrator\Application Data\Xfire 2007-07-19 21:57:24 0 d-------- C:\Documents and Settings\Administrator\Application Data\Skype 2007-07-19 21:57:13 0 d---s---- C:\Program Files\Xfire 2007-07-19 21:54:52 0 d-------- C:\Program Files\Steam 2007-07-19 21:52:04 0 d-------- C:\Program Files\Ubisoft 2007-07-19 21:52:00 0 d-------- C:\Program Files\Hitman Pro 2007-07-19 21:50:43 0 d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent 2007-07-19 21:50:39 0 d-------- C:\Program Files\World of Warcraft 2007-07-19 21  24 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG72007-07-19 17:42:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\teamspeak2 2007-07-04 20:17:05 0 d-------- C:\Program Files\Common Files\Macromedia 2007-07-04 20:17:00 0 d-------- C:\Program Files\Macromedia 2007-07-04 18:44:06 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-07-03 18:57:09 0 d-------- C:\Program Files\Teamspeak2_RC2 2007-07-03 15:40:53 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2007-06-27 21:21:26 0 d-------- C:\Program Files\Skype 2007-06-12 01:33:45 0 d-------- C:\Program Files\HLSW 2007-06-10 13:10:50 0 d-------- C:\Program Files\Logitech 2007-06-08 22:29:39 0 d-------- C:\Program Files\Common Files\Logitech 2007-05-30 16:09:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\dvdcss 2007-05-29 11:42:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Screaming Bee 2007-05-27 17:13:02 0 d-------- C:\Program Files\Common Files\Screaming Bee 2007-05-24 21:07:19 0 d-------- C:\Program Files\SGL Anti-Cheat 2007-05-23 15:09:12 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "BootSkin Startup Jobs"="\"C:\\Program Files\\Tools\\BootSkin\\BootSkin.exe\" /StartupJobs" "ALi5289"="C:\\Program Files\\ULI5289\\ALi5289.exe" "SoundMan"="SOUNDMAN.EXE" "SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" "PC Alarm Clock"="" "Microsoft Windows Logon Process"="C:\\WINDOWS\\winlogon.exe" "SvcManager"="lsass7.exe" "QuickTime Task"="\"C:\\Program Files\\K-Lite Codec Pack\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" "Nfo"="C:\\WINDOWS\\system32\\nfomon\\nfomon.exe" "vidmon"="C:\\WINDOWS\\system32\\vidmon\\vidmon.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart" "Rainlendar2"="C:\\Program Files\\Rainlendar2\\Rainlendar2.exe" "Steam"="\"C:\\Program Files\\Steam\\Steam.exe\" -silent" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" "Spyware Doctor"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 "NoRecentDocsMenu"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] "{18E50F56-07D4-1033-0627-05072605002c}"="\"C:\\Program Files\\Common Files\\{18E50F56-07D4-1033-0627-05072605002c}\\Update.exe\" mc-110-12-0000904" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 "NoRecentDocsMenu"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"="hirtellous" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "hirtellous"="{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mszsrn32 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Run HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Stardock ObjectDock.lnk] "path"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\Stardock ObjectDock.lnk" "backup"="C:\\WINDOWS\\pss\\Stardock ObjectDock.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\Stardock\\OBJECT~1\\OBJECT~1.EXE " "item"="Stardock ObjectDock" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Gamma Loader.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE " "item"="Adobe Gamma Loader" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\defender] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dfndrff_e20" "hkey"="HKLM" "command"="C:\\\\dfndrff_e20.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IE Redir] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ieredir" "hkey"="HKLM" "command"="C:\\WINDOWS\\ieredir.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="KHALMNPR" "hkey"="HKLM" "command"="KHALMNPR.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP3 Alarm Clock] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mp3alarmclock" "hkey"="HKLM" "command"="C:\\Program Files\\MP3 Alarm Clock\\mp3alarmclock.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nwnmff_e20" "hkey"="HKLM" "command"="C:\\\\nwnmff_e20.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-07-19 at 22:02:04 --------- |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-19-2007, 03:25 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Re: reassurance!
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
07-19-2007, 04:42 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 7
OS: XP
|
Re: reassurance!
Ok theres the ComboFix.
"Administrator" - 2007-07-19 23:29:53 - ComboFix 07-07-20.5 - Service Pack 2 NTFS Rootkit driver pe386 is present. ... attempting disinfection pe386 ...... driver unloaded successfully. ADS removed - system32: deleted 54654 bytes in 1 streams. (((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\clsid\{475A4F1C-2014-453A-8A10-0D4D7B6202B1}] @="" [HKEY_CLASSES_ROOT\clsid\{475A4F1C-2014-453A-8A10-0D4D7B6202B1}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{475A4F1C-2014-453A-8A10-0D4D7B6202B1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{475A4F1C-2014-453A-8A10-0D4D7B6202B1}\InprocServer32] @="C:\\WINDOWS\\system32\\psrpnsp.dll" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Granting SeDebugPrivilege to Administrators ... successful ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\arch\1001.dfn C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\keys.dat C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0104.dbd C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0106.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0204.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0315.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0412.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0504.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon0904.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon1125.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon1204.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon1215.dbd C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon1909.ddx C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon1920.dbd C:\DOCUME~1\ALLUSE~1\APPLIC~1.\nfo\mon2007.dbd C:\DOCUME~1\ALLUSE~1\APPLIC~1.\vidmon C:\DOCUME~1\ALLUSE~1\APPLIC~1.\vidmon\vidmon.inf C:\lswmv.ini C:\Program Files\Common Files\{18E50~1 C:\Program Files\Common Files\uninstall information C:\Program Files\Common Files\uninstall information\RemoveWebDP.exe C:\Program Files\inetget2 C:\Program Files\pedevice C:\Program Files\pedevice\communication.xml C:\Program Files\pedevice\Domain.Watchlist.txt C:\Program Files\pedevice\pae-options.xml C:\Program Files\pedevice\pae_url.xml C:\Program Files\pedevice\PeDev.dll C:\Program Files\pedevice\PeDev.exe C:\Program Files\pedevice\pedevPS.dll C:\Program Files\pedevice\search.watchlist.txt C:\Program Files\pedevice\watchlist.xml C:\Program Files\seekmo C:\Program Files\seekmo\seekmo.exe C:\Program Files\seekmo\seekmo_gdf.dat C:\Program Files\seekmo\seekmo_kyf.dat C:\Program Files\seekmo\seekmoau.dat C:\Program Files\seekmo\seekmohook.dll C:\Program Files\yazzle sudoku C:\WINDOWS\newname.dat C:\WINDOWS\system32\drv32dta C:\WINDOWS\system32\drv32dta\keylog_061003_231305.txt C:\WINDOWS\system32\nfomon C:\WINDOWS\system32\nfomon\License.txt C:\WINDOWS\system32\nfomon\nfo.ocx C:\WINDOWS\system32\nfomon\nfom.dll C:\WINDOWS\system32\nfomon\nfomon.exe C:\WINDOWS\system32\unsvchosts.lzma C:\WINDOWS\system32\vidmon C:\WINDOWS\system32\vidmon\vidmon.exe ((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19 ))))))))))))))))))))))))))))))) 2007-07-19 23:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-19 21:33 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-19 21:31 <DIR> d-------- C:\Deckard 2007-07-04 18:43 6,905,856 --a------ C:\DOCUME~1\ADMINI~1\ntuser.dat 2007-07-03 18:58 <DIR> d-------- C:\Program Files\Dave 2007-06-27 21:21 <DIR> d-------- C:\Program Files\Common Files\Skype (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-19 22:37:36 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Xfire 2007-07-19 22:36:59 -------- d-----w C:\Program Files\Steam 2007-07-19 22:35:27 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype 2007-07-19 22:26:52 -------- d-s---w C:\Program Files\Xfire 2007-07-19 20:52:04 -------- d-----w C:\Program Files\Ubisoft 2007-07-19 20:52:00 -------- d-----w C:\Program Files\Hitman Pro 2007-07-19 20:50:43 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\uTorrent 2007-07-19 20:50:39 -------- d-----w C:\Program Files\World of Warcraft 2007-07-19 16:42:50 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\teamspeak2 2007-07-04 17:44:06 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-03 17:57:09 -------- d-----w C:\Program Files\Teamspeak2_RC2 2007-06-27 20:21:26 -------- d-----w C:\Program Files\Skype 2007-06-12 00:33:45 -------- d-----w C:\Program Files\HLSW 2007-06-10 12:10:50 -------- d-----w C:\Program Files\Logitech 2007-06-08 21:29:39 -------- d-----w C:\Program Files\Common Files\Logitech 2007-05-30 15:09:34 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\dvdcss 2007-05-29 10:42:46 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Screaming Bee 2007-05-27 16:13:02 -------- d-----w C:\Program Files\Common Files\Screaming Bee 2007-05-24 20:07:19 -------- d-----w C:\Program Files\SGL Anti-Cheat 2007-05-23 14:09:12 -------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-19 16:59:49 1,040,384 ----a-w C:\WINDOWS\system32\libeay32.dll 2007-04-19 16:59:30 196,608 ----a-w C:\WINDOWS\system32\ssleay32.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{5345A7A9-805A-4923-B505-86B2FEBA3FE0}"= C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL [ ] [HKEY_CLASSES_ROOT\CLSID\{5345A7A9-805A-4923-B505-86B2FEBA3FE0}] [HKEY_CLASSES_ROOT\TypeLib\{5345A7A0-805A-4923-B505-86B2FEBA3FE0}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{5345A7A9-805A-4923-B505-86B2FEBA3FE0}"= C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL [ ] [-HKEY_CLASSES_ROOT\CLSID\{5345A7A9-805A-4923-B505-86B2FEBA3FE0}] [HKEY_CLASSES_ROOT\TypeLib\{5345A7A0-805A-4923-B505-86B2FEBA3FE0}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "BootSkin Startup Jobs"="C:\Program Files\Tools\BootSkin\BootSkin.exe" [2004-04-26 16:21] "ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2005-03-10 14:56] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 03:01 C:\WINDOWS\SOUNDMAN.EXE] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59] "nwiz"="nwiz.exe" [2005-12-10 03:06 C:\WINDOWS\system32\nwiz.exe] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-05-22 19:02] "PC Alarm Clock"="" [] "SvcManager"="lsass7.exe" [] "QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-25 02:03] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-05-22 19:02] "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [] "Steam"="C:\Program Files\Steam\Steam.exe" [2007-06-28 14:28] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-06-08 15:18] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"= C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ Xfire.lnk - C:\Program Files\Xfire\Xfire.exe [2007-07-11 02:07:46] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-25 02:03:35] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mszsrn32] C:\WINDOWS\system32\mszsrn32.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Stardock ObjectDock.lnk] path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Stardock ObjectDock.lnk backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\defender] C:\\dfndrff_e20.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IE Redir] C:\WINDOWS\ieredir.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] KHALMNPR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP3 Alarm Clock] C:\Program Files\MP3 Alarm Clock\mp3alarmclock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname] C:\\nwnmff_e20.exe Contents of the 'Scheduled Tasks' folder 2007-07-18 21:42:08 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-19 23:36:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000001b2 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-19 23:41:51 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-19 23:41 --- E O F --- And here's the HJTL. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:45:11, on 19/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\ULI5289\ALi5289.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Xfire\Xfire.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing) O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Tools\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [SvcManager] lsass7.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1171929856093 O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O18 - Protocol: bw+0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw+0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw-0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw-0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw00 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw00s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw10 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw10s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw20 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw20s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw30 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw30s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw40 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw40s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw50 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw50s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw60 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw60s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw70 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw70s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw80 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw80s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw90 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bw90s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwa0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwa0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwb0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwb0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwc0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwc0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwd0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwd0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwe0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwe0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwf0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwf0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwg0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwh0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwh0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwi0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwi0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwj0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwj0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwk0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwk0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwl0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwl0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwm0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwm0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwn0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwn0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwo0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwo0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwp0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwp0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwq0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwq0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwr0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwr0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bws0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bws0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwt0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwt0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwu0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwu0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwv0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwv0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bww0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bww0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwx0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwx0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwy0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwy0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwz0 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: bwz0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: offline-8876480 - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll (file missing) O21 - SSODL: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe (file missing) -- End of file - 21458 bytes Thanks |
|
|
|
|
07-19-2007, 11:36 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Re: reassurance!
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL (file missing) O4 - HKLM\..\Run: [SvcManager] lsass7.exe O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll (file missing) O21 - SSODL: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) Select ALL O18 -Logitech entries O18 - Protocol: bwz0s - {81960738-1532-4451-BE3D-B03862307A9D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
Folder::
C:\Program Files\iMeshBar
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5345A7A9-805A-4923-B505-86B2FEBA3FE0}"=-
[-HKEY_CLASSES_ROOT\CLSID\{5345A7A9-805A-4923-B505-86B2FEBA3FE0}]
[-HKEY_CLASSES_ROOT\TypeLib\{5345A7A0-805A-4923-B505-86B2FEBA3FE0}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{5345A7A9-805A-4923-B505-86B2FEBA3FE0}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SvcManager"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mszsrn32]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\defender]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IE Redir]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
* If you're downloading torrents in the background, please disconnect all of them. Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
07-19-2007, 11:36 PM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Re: reassurance!
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
Question - what have you done for the community today? |
|
|
|
|
07-20-2007, 09:05 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 7
OS: XP
|
Re: reassurance!
Ok firstly, here's the combofix;
"Administrator" - 2007-07-20 13:30:14 - ComboFix 07-07-20.5 - Service Pack 2 NTFS Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt ((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20 ))))))))))))))))))))))))))))))) 2007-07-19 23:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-19 21:33 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-19 21:31 <DIR> d-------- C:\Deckard 2007-07-04 18:43 6,905,856 --a------ C:\DOCUME~1\ADMINI~1\ntuser.dat 2007-07-03 18:58 <DIR> d-------- C:\Program Files\Dave 2007-06-27 21:21 <DIR> d-------- C:\Program Files\Common Files\Skype (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-20 12:27:22 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype 2007-07-20 11:56:06 -------- d-----w C:\Program Files\World of Warcraft 2007-07-20 11:53:50 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Xfire 2007-07-20 11:53:23 -------- d-----w C:\Program Files\Steam 2007-07-20 01:42:37 -------- d-s---w C:\Program Files\Xfire 2007-07-19 20:52:04 -------- d-----w C:\Program Files\Ubisoft 2007-07-19 20:52:00 -------- d-----w C:\Program Files\Hitman Pro 2007-07-19 20:50:43 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\uTorrent 2007-07-19 16:42:50 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\teamspeak2 2007-07-04 17:44:06 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-03 17:57:09 -------- d-----w C:\Program Files\Teamspeak2_RC2 2007-06-27 20:21:26 -------- d-----w C:\Program Files\Skype 2007-06-12 00:33:45 -------- d-----w C:\Program Files\HLSW 2007-06-10 12:10:50 -------- d-----w C:\Program Files\Logitech 2007-06-08 21:29:39 -------- d-----w C:\Program Files\Common Files\Logitech 2007-05-30 15:09:34 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\dvdcss 2007-05-29 10:42:46 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Screaming Bee 2007-05-27 16:13:02 -------- d-----w C:\Program Files\Common Files\Screaming Bee 2007-05-24 20:07:19 -------- d-----w C:\Program Files\SGL Anti-Cheat 2007-05-23 14:09:12 -------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "BootSkin Startup Jobs"="C:\Program Files\Tools\BootSkin\BootSkin.exe" [2004-04-26 16:21] "ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2005-03-10 14:56] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 03:01 C:\WINDOWS\SOUNDMAN.EXE] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59] "nwiz"="nwiz.exe" [2005-12-10 03:06 C:\WINDOWS\system32\nwiz.exe] "PC Alarm Clock"="" [] "QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-25 02:03] "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [] "Steam"="C:\Program Files\Steam\Steam.exe" [2007-06-28 14:28] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-06-08 15:18] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "MessengerPlusUninstall"=C:\WINDOWS\system32\cmd.exe /C "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MsgPlusUninst.bat" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"= C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ Xfire.lnk - C:\Program Files\Xfire\Xfire.exe [2007-07-11 02:07:46] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-25 02:03:35] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Stardock ObjectDock.lnk] path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Stardock ObjectDock.lnk backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] KHALMNPR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP3 Alarm Clock] C:\Program Files\MP3 Alarm Clock\mp3alarmclock.exe Contents of the 'Scheduled Tasks' folder 2007-07-18 21:42:08 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-20 13:33:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000004ab "TracesSuccessful"=dword:00000023 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-20 13:35:08 C:\ComboFix-quarantined-files.txt ... 2007-07-20 13:34 C:\ComboFix2.txt ... 2007-07-19 23:41 --- E O F --- Here's the online scan; ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, July 20, 2007 4:05:48 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 20/07/2007 Kaspersky Anti-Virus database records: 365756 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 112485 Number of viruses found: 8 Number of infected objects: 17 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:51:16 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\cert8.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\history.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\key3.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\parent.lock Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\search.sqlite Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\call256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\call512.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\callmember256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chat1024.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chat512.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmember256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmsg1024.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmsg16384.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmsg2048.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmsg256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatmsg512.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatsync\39\39bc47ce7545c5d1.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatsync\46\465182b0b31d5a3b.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatsync\66\66d346a97b4f9d18.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatsync\d5\d5668231e6157ec0.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\chatsync\f8\f8decb91b60c8da0.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\contactgroup256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\dyncontent\bundle.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\index2.dat Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\profile4096.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\transfer256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\transfer512.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\user1024.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\user16384.dbb Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Skype\brrrad\voicemail256.dbb Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\34gtazop.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\My Documents\New Folder\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.62 skipped C:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped C:\Program Files\Steam\Steam.log Object is locked skipped C:\Program Files\Steam\SteamApps\winui.gcf Object is locked skipped C:\Program Files\Steam\SteamLogs\SteamStats.log Object is locked skipped C:\Program Files\Teamspeak2_RC2\TSClient.log Object is locked skipped C:\QooBox\Quarantine\C\Program Files\Common Files\Uninstall Information\RemoveWebDP.exe.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\QooBox\Quarantine\C\Program Files\Seekmo\seekmo.exe.vir Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped C:\QooBox\Quarantine\C\WINDOWS\system32\nfomon\nfo.ocx.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.c skipped C:\QooBox\Quarantine\C\WINDOWS\system32\nfomon\nfom.dll.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\QooBox\Quarantine\C\WINDOWS\system32\nfomon\nfomon.exe.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vidmon\vidmon.exe.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.j skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP352\A0340312.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341413.exe Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341416.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341420.ocx Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.c skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341421.dll Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341422.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP353\A0341423.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.j skipped C:\System Volume Information\_restore{7D51E98C-CF96-4CE3-9E71-7A583665270F}\RP355\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{0644F4FE-A904-4D09-9C1A-B9348B0F4804}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. And here is the new HJT log; Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:07:55, on 20/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ULI5289\ALi5289.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Xfire\Xfire.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe c:\program files\steam\steamapps\braddas69\counter-strike source\hl2.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Tools\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WINDOWS\system32\cmd.exe /C "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MsgPlusUninst.bat" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1171929856093 O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O22 - SharedTaskScheduler: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - (no file) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe (file missing) -- End of file - 7711 bytes |
|
|
|
|
07-20-2007, 09:11 AM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Re: reassurance!
C:\Documents and Settings\Administrator\My Documents\New Folder\mirc.exe
C:\Program Files\mIRC\mirc.exe C:\WINDOWS\system32\cmdow.exe C:\WINDOWS\system32\pskill.exe Kaspersky found these but they aren't really that malicious. I'll leave the decision to you. C:\QooBox\ is ComboFix's quarantine folder. You can safely delete it C:\System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be reseting/clearing the cache in a little while ---------------------- Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
|
07-20-2007, 09:40 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2007
Posts: 7
OS: XP
|
Re: reassurance!
You are quite the legend!
Done and dusted! I've always used Firefox anyways so that's all good, and i've recently aquired BitDefender AV and Firewall so hopefully i'll be protected from now on. Thanks again! :D |
|
|
|
| Thread Tools | |
|
|
