Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Trojans & Adware
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 08-06-2007, 11:16 AM   #1 (permalink)
Registered User
 
Join Date: May 2007
Posts: 208
OS: XP


Trojans & Adware
Hi i noticed on my bit defender that i have some Trojans and some Adware infected files, it doesn't look that bad compared to what i have seen in the past heres my hijack this log, please help me thank you so much



Logfile of HijackThis v1.99.1
Scan saved at 1:15:34 PM, on 8/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\lxcecoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\{FC206696-0C80-1033-1108-051213050001}\Update.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3C206~1\Bar888.dll (file missing)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3C206~1\Bar888.dll (file missing)
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Administrator\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Administrator\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0002239 (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcecoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
zipzappy is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 08-06-2007, 10:03 PM   #2 (permalink)
Analyst, Security Team
 
forhockey's Avatar
 
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,931
OS: Windows 7 Ultimate


Re: Trojans & Adware
Hi zipzappy,

You may wish to Subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription.

--------------------------------------------------------------

Do you happen to have the log, which states exactly where and what virus' we are dealing with?

--------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3C206~1\Bar888.dll (file missing)
O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3C206~1\Bar888.dll (file missing)

Please remember to close all other windows, including browsers then click Fix checked.

--------------------------------------------------------------

Download combofix from here

**Save it directly to your desktop**

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

A log will be produced that will ultimately be named C:\ComboFix.txt I'll need that in your next reply, along with a fresh HijackThis Log.

--------------------------------------------------------------

Perform an online scan with Internet Explorer with Panda ActiveScan
  1. Click on located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *
Begin the scan by selecting
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on then click
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------

Please reply back with the following:

Log from your bitdefender (if possible)
C:\ComboFix.txt
Fresh HiJackThis Log
Panda Scan Results
__________________


Proud Member of ASAP
Proud Member of UNITE

Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support.

Donation link for Tech Support Forum
forhockey is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2007, 06:00 PM   #3 (permalink)
Registered User
 
Join Date: May 2007
Posts: 208
OS: XP


Re: Trojans & Adware
thank you so much for helping me heres what you asked for...



The Panda Scan Log




Incident Status Location

Adware:adware/commad Not disinfected c:\windows\system32\atmtd.dll
Adware:adware/savenow Not disinfected Windows Registry
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\ComboFix\nircmd.exe
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.atdmt.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.247realmedia.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[ad.yieldmanager.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[statse.webtrendslive.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.doubleclick.net/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.ads.pointroll.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.advertising.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.go.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.adtech.de/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.2o7.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.realmedia.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[ads.pointroll.com/PRServe/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.adrevolver.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.mediaplex.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.fastclick.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.atwola.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.adultfriendfinder.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.toplist.cz/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.phg.hitbox.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.target.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.overture.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.burstnet.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.bfast.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[www.burstbeacon.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.zedo.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.statcounter.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.com.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.xiti.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.yadro.ru/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.bluestreak.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.bs.serving-sys.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[server.iad.liveperson.net/hc/43770959]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.tradedoubler.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[statse.webtrendslive.com/S152628]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.as-eu.falkag.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.casalemedia.com/]
Spyware:Cookie/Versiontracker Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-2.txt[.versiontracker.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.atdmt.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.247realmedia.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[ad.yieldmanager.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[statse.webtrendslive.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.doubleclick.net/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.ads.pointroll.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.advertising.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.go.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.adtech.de/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.2o7.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.realmedia.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[ads.pointroll.com/PRServe/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.adrevolver.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.mediaplex.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.fastclick.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.atwola.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.adultfriendfinder.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.toplist.cz/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.phg.hitbox.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.target.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.overture.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.burstnet.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.bfast.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[www.burstbeacon.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.zedo.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.statcounter.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.com.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.xiti.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.yadro.ru/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.bluestreak.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.bs.serving-sys.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[server.iad.liveperson.net/hc/43770959]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.tradedoubler.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[statse.webtrendslive.com/S152628]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.as-eu.falkag.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.casalemedia.com/]
Spyware:Cookie/Versiontracker Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies-3.txt[.versiontracker.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.2o7.net/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.findwhat.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.overture.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.go.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.adtech.de/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[ads.pointroll.com/PRServe/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.atwola.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.phg.hitbox.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.target.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.bfast.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.com.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[server.iad.liveperson.net/hc/43770959]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[statse.webtrendslive.com/S152628]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Versiontracker Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cookies.txt[.versiontracker.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@adrevolver[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atwola[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@bs.serving-sys[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@ehg-dig.hitbox[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@go[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@media.adrevolver[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[2].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Administrator\Desktop\ComboFix.exe[nircmd.exe]
Virus:Generic Trojan Disinfected C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Games\_____100_\______20_plane.exe
Virus:Generic Malware Disinfected C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Style XP\Style.XP.v3.00.Keygen.zip[eclsxp30.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\Cache\7ED6F4AAd01[nircmd.exe]
Virus:Generic Trojan Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\b104.exe
Adware:Adware/Winpopup Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\b122.exe
Adware:Adware/Yazzle Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe
Adware:Adware/Winpopup Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\122[1].net
Adware:Adware/Yazzle Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net
Virus:Generic Trojan Disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MHJU1IUQ\104[1].net
Adware:Adware/PurityScan Not disinfected C:\Program Files\Common Files\s?mbols\spoolsv.exe
Adware:Adware/Yazzle Not disinfected C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
Virus:Trj/Downloader.MDW Disinfected C:\Program Files\WinPop\UnInstall.exe
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe
Adware:Adware/DollarRevenue Not disinfected C:\WINDOWS\system32\atmtd.dll._




My Combo Fix Log




ComboFix 07-08-07.6 - "Administrator" 2007-08-07 19:30:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.887 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ADMINI~1\MYDOCU~1.\ystem~1
C:\Program Files\Common Files\{3C206~1
C:\Program Files\Common Files\{FC206~1
C:\Program Files\Common Files\smbols~1
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\network monitor
C:\Program Files\outerinfo
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\winpop
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\wnsapiicomsv32.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CLIENT_IP-IPX
-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\Client IP-IPX
-------\cmdService
-------\Network Monitor


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-07 14:40 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-08-07 13:26 61,984 --a------ C:\WINDOWS\system32\drivers\xusb21.sys
2007-08-06 19:41 50,048 --a------ C:\WINDOWS\system32\drivers\xusb20.sys
2007-08-06 19:41 1,421,216 --a------ C:\WINDOWS\system32\WdfCoInstaller01001.dll
2007-08-06 19:41 <DIR> d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2007-08-06 19:37 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-08-06 14:10 <DIR> d--hs---- C:\WINDOWS\R2lvcmdpbw
2007-08-06 14:10 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-06 12:20 <DIR> d-------- C:\My Downloads
2007-08-04 21:43 <DIR> d-------- C:\Program Files\Maxis
2007-08-04 20:24 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-08-04 20:24 <DIR> d-------- C:\Program Files\DkZ Studio
2007-08-04 14:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-04 14:36 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-08-04 14:36 <DIR> d-------- C:\WINDOWS\nview
2007-08-04 14:35 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-08-03 23:18 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-08-03 23:15 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-08-03 23:15 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2007-08-03 23:14 9,715,200 --a------ C:\WINDOWS\RTLCPL.exe
2007-08-03 23:14 86,016 --a------ C:\WINDOWS\SoundMan.exe
2007-08-03 23:14 69,632 --a------ C:\WINDOWS\Alcmtr.exe
2007-08-03 23:14 520,192 --a------ C:\WINDOWS\RtlExUpd.dll
2007-08-03 23:14 4,432,384 --a------ C:\WINDOWS\system32\drivers\RtkHDAud.sys
2007-08-03 23:14 315,392 --a------ C:\WINDOWS\HideWin.exe
2007-08-03 23:14 2,808,832 --a------ C:\WINDOWS\alcwzrd.exe
2007-08-03 23:14 2,162,688 --a------ C:\WINDOWS\MicCal.exe
2007-08-03 23:14 16,377,344 --a------ C:\WINDOWS\RTHDCPL.exe
2007-08-03 23:14 1,826,816 --a------ C:\WINDOWS\SkyTel.exe
2007-08-03 23:14 1,191,936 --a------ C:\WINDOWS\RtlUpd.exe
2007-08-03 23:14 <DIR> d-------- C:\Program Files\Realtek
2007-08-03 22:03 <DIR> d-------- C:\Program Files\MagicISO
2007-08-02 23:15 12 --a------ C:\DOCUME~1\ADMINI~1\USERDATA.DAT
2007-08-02 23:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-07-31 13:35 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-07-29 22:51 <DIR> d-------- C:\Program Files\Native Instruments
2007-07-29 15:16 <DIR> d-------- C:\Program Files\Xilisoft
2007-07-27 14:05 <DIR> d-------- C:\Program Files\KONAMI
2007-07-27 01:56 <DIR> d-------- C:\Program Files\AIM6
2007-07-27 01:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-07-25 20:48 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-25 20:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-23 19:55 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-22 21:26 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\GetRightToGo
2007-07-22 21:17 <DIR> d-------- C:\Program Files\Mp3 Renamer
2007-07-22 20:38 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-07-22 20:33 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Bitdefender
2007-07-22 20:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-07-22 19:38 <DIR> d-------- C:\WINDOWS\system32\VIRepair
2007-07-22 19:34 8,636 --a------ C:\WINDOWS\system32\modifype.exe
2007-07-22 19:34 19,968 --a------ C:\WINDOWS\system32\reico.exe
2007-07-22 19:34 111,104 --a------ C:\WINDOWS\system32\Uharc.exe
2007-07-22 19:34 <DIR> d-------- C:\WINDOWS\system32\VITrans
2007-07-22 19:34 <DIR> d-------- C:\VTPFiles
2007-07-16 12:27 <DIR> d-------- C:\Program Files\CDCheck
2007-07-16 11:34 <DIR> d-------- C:\Program Files\GTA 3 San Andreas
2007-07-16 00:15 <DIR> d-------- C:\Program Files\One-click Tag Editor
2007-07-16 00:04 <DIR> d-------- C:\Program Files\TagRename
2007-07-15 01:23 <DIR> d-------- C:\Program Files\LucasArts
2007-07-12 12:27 <DIR> d-------- C:\Program Files\iTunes
2007-07-12 12:27 <DIR> d-------- C:\Program Files\iPod
2007-07-12 12:26 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-07-12 12:26 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-12 12:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-12 12:23 <DIR> d-------- C:\Program Files\QuickTime
2007-07-11 21:08 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Ahead


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 18:19 --------- d-------- C:\Program Files\Lexmark 4300 Series
2007-08-07 17:47 --------- d-------- C:\Program Files\FlashGet
2007-08-07 17:39 --------- d-------- C:\Program Files\AIM
2007-08-07 13:26 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2007-08-06 19:58 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2007-08-06 19:58 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb20_01001.Wdf
2007-08-03 23:14 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-02 19:50 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\LimeWire
2007-07-27 01:56 335 --a------ C:\WINDOWS\nsreg.dat
2007-07-26 21:58 --------- d-------- C:\Program Files\AMR
2007-07-22 23:35 913408 --a------ C:\WINDOWS\system32\xreglib.dll
2007-07-17 21:29 --------- d-------- C:\Program Files\Absolute Poker
2007-07-02 20:31 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-07-02 12:28 4 -r-hs---- C:\MSDOS.BIN
2007-07-01 11:59 --------- d-------- C:\Program Files\Sony
2007-06-29 00:43 8466432 --a------ C:\WINDOWS\system32\nvcpl.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvmctray.dll
2007-06-29 00:43 753664 --a------ C:\WINDOWS\system32\nvcplui.exe
2007-06-29 00:43 6807328 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-06-29 00:43 6807328 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-06-29 00:43 6729728 --a------ C:\WINDOWS\system32\nvoglnt.dll
2007-06-29 00:43 6234112 --a------ C:\WINDOWS\system32\nvdisps.dll
2007-06-29 00:43 5690624 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2007-06-29 00:43 5690624 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-06-29 00:43 5455872 --a------ C:\WINDOWS\system32\nvdispsr.dll
2007-06-29 00:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-06-29 00:43 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2007-06-29 00:43 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2007-06-29 00:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-06-29 00:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcodins.dll
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcod.dll
2007-06-29 00:43 360448 --a------ C:\WINDOWS\system32\nvapi.dll
2007-06-29 00:43 3600384 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2007-06-29 00:43 3518464 --a------ C:\WINDOWS\system32\nvvitvs.dll
2007-06-29 00:43 3321856 --a------ C:\WINDOWS\system32\nvgames.dll
2007-06-29 00:43 3072000 --a------ C:\WINDOWS\system32\nvgamesr.dll
2007-06-29 00:43 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll
2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-06-29 00:43 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2007-06-29 00:43 2416640 --a------ C:\WINDOWS\system32\nvwssr.dll
2007-06-29 00:43 2330624 --a------ C:\WINDOWS\system32\nvwss.dll
2007-06-29 00:43 229376 --a------ C:\WINDOWS\system32\nvmccs.dll
2007-06-29 00:43 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2007-06-29 00:43 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-06-29 00:43 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-06-29 00:43 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe
2007-06-29 00:43 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-06-29 00:43 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2007-06-29 00:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-06-29 00:43 1142784 --a------ C:\WINDOWS\system32\nvmobls.dll
2007-06-29 00:43 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll
2007-06-29 00:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Sony
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Publish Providers
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\NetMedia Providers
2007-06-27 22:58 --------- d-------- C:\Program Files\Vstplugins
2007-06-27 22:57 --------- d-------- C:\Program Files\Sony Setup
2007-06-27 22:19 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SopCast
2007-06-27 12:47 --------- d-------- C:\Program Files\Stardock
2007-06-17 17:49 --------- d-------- C:\Program Files\SopCast
2007-06-15 05:15 --------- d-------- C:\Program Files\VDJ5
2007-06-15 04:18 --------- d-------- C:\Program Files\TGTSoft
2007-06-14 23:58 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\vlc
2007-06-14 23:56 --------- d-------- C:\Program Files\VideoLAN
2007-06-14 23:27 --------- d-------- C:\Program Files\MediaMonkey
2007-06-14 19:35 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
2007-06-14 14:33 --------- d-------- C:\Program Files\Apple Software Update
2007-06-14 12:18 --------- d-------- C:\Program Files\Image-Line
2007-06-14 12:17 --------- d-------- C:\Program Files\Steinberg
2007-06-14 12:17 --------- d-------- C:\Program Files\ASIO4ALL v2
2007-06-14 06:19 --------- d-------- C:\Program Files\DivX
2007-06-14 06:12 --------- d-------- C:\Program Files\Winamp
2007-06-14 06:10 --------- d-------- C:\Program Files\Common Files\NSV
2007-06-14 01:32 --------- d-------- C:\Program Files\TagRunner
2007-06-11 02:25 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
2007-06-11 02:24 --------- d-------- C:\Program Files\Google
2007-06-11 02:17 19088 --a------ C:\DOCUME~1\ADMINI~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-06-11 01:10 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Steinberg
2007-06-11 01:03 --------- d-------- C:\Program Files\Syncrosoft
2007-06-10 20:02 --------- d-------- C:\Program Files\LimeWire
2007-06-10 19:51 --------- d-------- C:\Program Files\Audacity
2007-06-10 18:42 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-06-10 16:40 --------- d-------- C:\Program Files\Movie Maker
2007-06-10 16:40 --------- d-------- C:\Program Files\Messenger
2007-06-10 16:38 --------- d-------- C:\Program Files\Windows NT
2007-06-10 16:01 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\WinRAR
2007-06-10 15:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
2007-06-10 15:32 --------- d-------- C:\Program Files\Microsoft ActiveSync
2007-06-10 15:12 --------- d--h----- C:\Program Files\WindowsUpdate
2007-06-10 15:06 --------- d-------- C:\Program Files\Common Files\Ahead
2007-06-10 15:06 --------- d-------- C:\Program Files\Ahead
2007-06-10 14:34 --------- d-------- C:\Program Files\AOD
2007-06-10 14:34 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Aim
2007-06-10 13:22 --------- d-------- C:\Program Files\Creative
2007-06-10 12:58 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-10 12:28 --------- d-------- C:\Program Files\ORiNOCO
2007-06-10 12:15 0 -rahs---- C:\MSDOS.SYS


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4FDBDECA-350F-3AA0-7874-3DB60940FEC7}]
C:\WINDOWS\system32\gwvmwer.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 22:38 C:\WINDOWS\system32\P17.dll]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-07-22 23:34]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-07-22 23:34]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 14:49 C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINDOWS\Alcmtr.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-02-12 17:21]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 06:06]
"lxcemon.exe"="C:\Program Files\Lexmark 4300 Series\lxcemon.exe" [2005-08-02 20:45]
"EzPrint"="C:\Program Files\Lexmark 4300 Series\ezprint.exe" [2005-07-26 15:17]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 03:00]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 18:35]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 14:31]
"Oalt"="C:\PROGRA~1\COMMON~1\SMBOLS~1\spoolsv.exe" []
"Aokczev"="C:\Documents and Settings\Administrator\My Documents\?ystem\l?gonui.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-24 14:30:37]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 04:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2007-02-07 17:31 226992 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys
R3 P17;Creative SB Audigy LS;C:\WINDOWS\system32\drivers\P17.sys
R3 PRISM_USB;ORiNOCO 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\EXPSUSB.sys
R3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21;C:\WINDOWS\system32\DRIVERS\xusb21.sys
S3 AWINDIS5;AWINDIS5 Protocol Driver;\??\C:\WINDOWS\System32\AWINDIS5.SYS
S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\WINDOWS\system32\DRIVERS\xusb20.sys


Contents of the 'Scheduled Tasks' folder
2007-07-26 15:33:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 19:38:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd4w\2]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\Software\Adobe\FeatureSubscriptions\DVAAdobeDocMeta\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\Registered"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\27:\xf5wjY\1]
"DisplayName"="\x3da2\x7667\x480\27\x1340\21\t"
"DeviceDesc"="\x3da2\x7667\x480\27\x1340\21\t"
"ProviderName"="\xad8\x388\x24dc\21\x69e0\27\x2808\21\x9005\x77f7"
"MFG"="\xffff\xffff\x3dbf\x7667\x654f\x7667\x112c"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=str(7):"c:\intel desktop board\smbus\smbusati.inf"

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 19:41:41 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-07 19:41

--- E O F ---





My Updated Hijackthis Log




Logfile of HijackThis v1.99.1
Scan saved at 7:54:35 PM, on 8/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program Files\Lexmark 4300 Series\ezprint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\lxcecoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {4FDBDECA-350F-3AA0-7874-3DB60940FEC7} - C:\WINDOWS\system32\gwvmwer.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 4300 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Oalt] "C:\PROGRA~1\COMMON~1\SMBOLS~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [Aokczev] "C:\Documents and Settings\Administrator\My Documents\?ystem\l?gonui.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Administrator\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Administrator\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcecoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
zipzappy is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2007, 06:03 PM   #4 (permalink)
Registered User
 
Join Date: May 2007
Posts: 208
OS: XP


Re: Trojans & Adware
There was to much text to put all 4 logs in one post lol, so heres the
BitDefender Log that you asked for as well, i ran a Deep System Scan.





//-----------------------------------------------------------------
//
// ProductBitDefender Antivirus Plus v10
// Product10.2
//
// Created on: 07/08/2007 14:51:10
//
//-----------------------------------------------------------------


Virus Statistics

Scan path : C:\
Folders : 11910
Files : 615887
Memory processes scanned : 41
Archives : 7033
Runtime packers : 33491
Identified viruses : 19
Infected files : 29
Memory processes infected : 2
Suspect files : 0
Warnings : 0
Disinfected files : 0
Deleted files : 0
Moved files : 16
I/O errors : 31
Scan time : 04:31:51
Scan speed (files/sec) : 37

Spyware Statistics

Registry keys scanned : 1633
Registry keys infected : 6
Cookies scanned : 93
Cookies infected : 0
Spyware files infected : 0
Spyware threats detected : 1


Virus definitions : 753972
Scan plugins : 16
Archive plugins : 41
Unpack plugins : 6
Mail plugins : 6
System plugins : 5

Virus scan options

Detection
[X] Scan boot sectors
[X] Memory Processes
[X] Scan archives
[X] Scan runtime packers
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Move to quarantine
[ ] Prompt user

Second action
[ ] Ignore
[ ] Delete
[X] Move to quarantine
[ ] Prompt user

Virus scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1186512670.log

Spyware scan options

[X] Scan for riskware
[ ] Skip dial and applications from scan
[X] Registry keys
[X] Cookies


Summary:

<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (disk) Detected: Adware.CommAd.A
<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (disk) Disinfection failed
<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (disk) Move failed
<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (full dump) Detected: Adware.CommAd.A
<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (full dump) Disinfection failed
<System>=>C:\WINDOWS\R2lvcmdpbw\command.exe (full dump) Move failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (memory dump) Detected: Adware.CommAd.A
<System>=>C:\Program Files\Network Monitor\netmon.exe (memory dump) Disinfection failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (memory dump) Move failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (disk) Detected: Adware.CommAd.A
<System>=>C:\Program Files\Network Monitor\netmon.exe (disk) Disinfection failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (disk) Move failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (full dump) Detected: Adware.CommAd.A
<System>=>C:\Program Files\Network Monitor\netmon.exe (full dump) Disinfection failed
<System>=>C:\Program Files\Network Monitor\netmon.exe (full dump) Move failed
<System>=>C:\Program Files\WinPop\winpop.exe (memory dump) Infected: Trojan.Popwin.DE
<System>=>C:\Program Files\WinPop\winpop.exe (memory dump) Disinfection failed
<System>=>C:\Program Files\WinPop\winpop.exe (memory dump) Move failed
<System>=>C:\Program Files\WinPop\winpop.exe (disk) Infected: Trojan.Popwin.DE
<System>=>C:\Program Files\WinPop\winpop.exe (disk) Disinfection failed
<System>=>C:\Program Files\WinPop\winpop.exe (disk) Move failed
<System>=>C:\Program Files\WinPop\winpop.exe (full dump) Infected: Trojan.Popwin.DE
<System>=>C:\Program Files\WinPop\winpop.exe (full dump) Disinfection failed
<System>=>C:\Program Files\WinPop\winpop.exe (full dump) Move failed
<System>=>C:\PROGRA~1\COMMON~1\SMBOLS~1\spoolsv.exe (disk) Detected: Adware.Clickspring.Purityscan.O
<System>=>C:\PROGRA~1\COMMON~1\SMBOLS~1\spoolsv.exe (disk) Disinfection failed
<System>=>C:\PROGRA~1\COMMON~1\SMBOLS~1\spoolsv.exe (disk) Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\CMDSERVICE\ImagePath=>C:\WINDOWS\R2LVCMDPBW\COMMAND.EXE Move failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Detected: Adware.CommAd.A
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Disinfection failed
<System>=>HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\SERVICES\NETWORK MONITOR\ImagePath=>C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE Move failed
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0002 Infected: Trojan.Downloader.Purityscan.EH
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0002 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0002 Move failed
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0004 Detected: Adware.Softomate.BG
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0004 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temp\b128.exe=>(NSIS o)=>lzma_solid_nsis0004 Move failed
C:\Documents and Settings\Administrator\Local Settings\Temp\cmdinst.exe Infected: Trojan.Proxy.493
C:\Documents and Settings\Administrator\Local Settings\Temp\cmdinst.exe Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temp\cmdinst.exe Moved
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1YNM6DXP\installer[1].exe Infected: Trojan.Proxy.493
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1YNM6DXP\installer[1].exe Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1YNM6DXP\installer[1].exe Moved
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0002 Infected: Trojan.Downloader.Purityscan.EH
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0002 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0002 Move failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0004 Detected: Adware.Softomate.BG
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0004 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4T67KLAB\128[1].net=>(NSIS o)=>lzma_solid_nsis0004 Move failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1E3456J\ctxad-556[1].0006 Infected: Trojan.Dropper.PurityScan.AJ
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1E3456J\ctxad-556[1].0006 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1E3456J\ctxad-556[1].0006 Moved
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CY3F2AXO\dohinst-103[1].0000 Infected: MemScan:Adware.Mediatickets.C
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CY3F2AXO\dohinst-103[1].0000 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CY3F2AXO\dohinst-103[1].0000 Moved
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\N1WG7D1Q\setar-101[1].0000 Detected: Adware.Yazzle.A
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\N1WG7D1Q\setar-101[1].0000 Disinfection failed
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\N1WG7D1Q\setar-101[1].0000 Moved
C:\Documents and Settings\Administrator\My Documents\ѕystem\lοgonui.exe Detected: Adware.ClickSpring.CB
C:\Documents and Settings\Administrator\My Documents\ѕystem\lοgonui.exe Disinfection failed
C:\Documents and Settings\Administrator\My Documents\ѕystem\lοgonui.exe Moved
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\system.dll Infected: Trojan.Downloader.Agent.BAL
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\system.dll Disinfection failed
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\system.dll Move failed
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\Update.exe Infected: Trojan.Downloader.Small.AFW
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\Update.exe Disinfection failed
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\Update.exe Move failed
C:\Program Files\Common Files\sуmbols\spoolsv.exe Detected: Adware.Clickspring.Purityscan.O
C:\Program Files\Common Files\sуmbols\spoolsv.exe Disinfection failed
C:\Program Files\Common Files\sуmbols\spoolsv.exe Moved
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe Infected: Trojan.Downloader.PurityScan.CR
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe Disinfection failed
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe Moved
C:\Program Files\Network Monitor\netmon.exe Detected: Adware.CommAd.A
C:\Program Files\Network Monitor\netmon.exe Disinfection failed
C:\Program Files\Network Monitor\netmon.exe Moved
C:\Program Files\Outerinfo\OiUninstaller.exe Infected: Trojan.Dropper.PurityScan.AK
C:\Program Files\Outerinfo\OiUninstaller.exe Disinfection failed
C:\Program Files\Outerinfo\OiUninstaller.exe Moved
C:\Program Files\WinPop\winpop.exe Infected: Trojan.Popwin.DE
C:\Program Files\WinPop\winpop.exe Disinfection failed
C:\Program Files\WinPop\winpop.exe Moved
C:\WINDOWS\R2lvcmdpbw\asappsrv.dll Detected: Adware.CommAd.A
C:\WINDOWS\R2lvcmdpbw\asappsrv.dll Disinfection failed
C:\WINDOWS\R2lvcmdpbw\asappsrv.dll Moved
C:\WINDOWS\R2lvcmdpbw\command.exe Detected: Adware.CommAd.A
C:\WINDOWS\R2lvcmdpbw\command.exe Disinfection failed
C:\WINDOWS\R2lvcmdpbw\command.exe Moved
C:\WINDOWS\R2lvcmdpbw\lZ5SwAxDvT.vbs Detected: Adware.Isearch.D
C:\WINDOWS\R2lvcmdpbw\lZ5SwAxDvT.vbs Disinfection failed
C:\WINDOWS\R2lvcmdpbw\lZ5SwAxDvT.vbs Moved
C:\WINDOWS\system32\gwvmwer.dll Detected: Adware.ClickSpring.CB
C:\WINDOWS\system32\gwvmwer.dll Disinfection failed
C:\WINDOWS\system32\gwvmwer.dll Moved
C:\WINDOWS\uninstall_nmon.vbs Infected: Trojan.Small.WY
C:\WINDOWS\uninstall_nmon.vbs Disinfection failed
C:\WINDOWS\uninstall_nmon.vbs Moved






Thats everything, i really appreciate you helping me
zipzappy is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2007, 10:09 PM   #5 (permalink)
Analyst, Security Team
 
forhockey's Avatar
 
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,931
OS: Windows 7 Ultimate


Re: Trojans & Adware
Hi zipzappy,

Most of the malware was taken out in all those logs you've replied back with :) Time to do some cleanup.

--------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
File::
C:\WINDOWS\system32\gwvmwer.dll
C:\WINDOWS\uninstall_nmon.vbs

Folder::
C:\WINDOWS\R2lvcmdpbw
C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
C:\Documents and Settings\Administrator\My Documents\ѕystem
C:\Program Files\Common Files\sуmbols

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4FDBDECA-350F-3AA0-7874-3DB60940FEC7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Oalt"=-
"Aokczev"=-
Save this as CFScript




Refering to the picture above, drag CFScript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

--------------------------------------------------------------

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------

Please reply back with the following:

C:\ComboFix.txt
Kaspersky Scan Results
__________________


Proud Member of ASAP
Proud Member of UNITE

Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support.

Donation link for Tech Support Forum
forhockey is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-08-2007, 12:06 PM   #6 (permalink)
Registered User
 
Join Date: May 2007
Posts: 208
OS: XP


Re: Trojans & Adware
k thanks again heres the combo fix and kasper sky log




ComboFix 07-08-07.6 - "Administrator" 2007-08-08 7:23:57.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.974 [GMT -4:00]
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\gwvmwer.dll
C:\WINDOWS\uninstall_nmon.vbs


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon\domains.txt
C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon\log.txt
C:\WINDOWS\R2lvcmdpbw


((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))


2007-08-07 14:40 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-08-07 13:26 61,984 --a------ C:\WINDOWS\system32\drivers\xusb21.sys
2007-08-06 19:41 50,048 --a------ C:\WINDOWS\system32\drivers\xusb20.sys
2007-08-06 19:41 1,421,216 --a------ C:\WINDOWS\system32\WdfCoInstaller01001.dll
2007-08-06 19:41 <DIR> d-------- C:\Program Files\Microsoft Xbox 360 Accessories
2007-08-06 19:37 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-08-06 12:20 <DIR> d-------- C:\My Downloads
2007-08-04 21:43 <DIR> d-------- C:\Program Files\Maxis
2007-08-04 20:24 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-08-04 20:24 <DIR> d-------- C:\Program Files\DkZ Studio
2007-08-04 14:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-08-04 14:36 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-08-04 14:36 <DIR> d-------- C:\WINDOWS\nview
2007-08-04 14:35 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-08-03 23:18 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-08-03 23:15 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-08-03 23:15 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2007-08-03 23:14 9,715,200 --a------ C:\WINDOWS\RTLCPL.exe
2007-08-03 23:14 86,016 --a------ C:\WINDOWS\SoundMan.exe
2007-08-03 23:14 69,632 --a------ C:\WINDOWS\Alcmtr.exe
2007-08-03 23:14 520,192 --a------ C:\WINDOWS\RtlExUpd.dll
2007-08-03 23:14 4,432,384 --a------ C:\WINDOWS\system32\drivers\RtkHDAud.sys
2007-08-03 23:14 315,392 --a------ C:\WINDOWS\HideWin.exe
2007-08-03 23:14 2,808,832 --a------ C:\WINDOWS\alcwzrd.exe
2007-08-03 23:14 2,162,688 --a------ C:\WINDOWS\MicCal.exe
2007-08-03 23:14 16,377,344 --a------ C:\WINDOWS\RTHDCPL.exe
2007-08-03 23:14 1,826,816 --a------ C:\WINDOWS\SkyTel.exe
2007-08-03 23:14 1,191,936 --a------ C:\WINDOWS\RtlUpd.exe
2007-08-03 23:14 <DIR> d-------- C:\Program Files\Realtek
2007-08-03 22:03 <DIR> d-------- C:\Program Files\MagicISO
2007-08-02 23:15 12 --a------ C:\DOCUME~1\ADMINI~1\USERDATA.DAT
2007-08-02 23:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-07-31 13:35 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-07-29 22:51 <DIR> d-------- C:\Program Files\Native Instruments
2007-07-29 15:16 <DIR> d-------- C:\Program Files\Xilisoft
2007-07-27 14:05 <DIR> d-------- C:\Program Files\KONAMI
2007-07-27 01:56 <DIR> d-------- C:\Program Files\AIM6
2007-07-27 01:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-07-25 20:48 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-25 20:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-23 19:55 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-22 21:26 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\GetRightToGo
2007-07-22 21:17 <DIR> d-------- C:\Program Files\Mp3 Renamer
2007-07-22 20:38 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-07-22 20:33 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Bitdefender
2007-07-22 20:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-07-22 19:38 <DIR> d-------- C:\WINDOWS\system32\VIRepair
2007-07-22 19:34 8,636 --a------ C:\WINDOWS\system32\modifype.exe
2007-07-22 19:34 19,968 --a------ C:\WINDOWS\system32\reico.exe
2007-07-22 19:34 111,104 --a------ C:\WINDOWS\system32\Uharc.exe
2007-07-22 19:34 <DIR> d-------- C:\WINDOWS\system32\VITrans
2007-07-22 19:34 <DIR> d-------- C:\VTPFiles
2007-07-16 12:27 <DIR> d-------- C:\Program Files\CDCheck
2007-07-16 11:34 <DIR> d-------- C:\Program Files\GTA 3 San Andreas
2007-07-16 00:15 <DIR> d-------- C:\Program Files\One-click Tag Editor
2007-07-16 00:04 <DIR> d-------- C:\Program Files\TagRename
2007-07-15 01:23 <DIR> d-------- C:\Program Files\LucasArts
2007-07-12 12:27 <DIR> d-------- C:\Program Files\iTunes
2007-07-12 12:27 <DIR> d-------- C:\Program Files\iPod
2007-07-12 12:26 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-07-12 12:26 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-12 12:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-12 12:23 <DIR> d-------- C:\Program Files\QuickTime
2007-07-11 21:08 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Ahead


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 18:19 --------- d-------- C:\Program Files\Lexmark 4300 Series
2007-08-07 17:47 --------- d-------- C:\Program Files\FlashGet
2007-08-07 17:39 --------- d-------- C:\Program Files\AIM
2007-08-07 13:26 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2007-08-06 19:58 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2007-08-06 19:58 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_xusb20_01001.Wdf
2007-08-03 23:14 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-02 19:50 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\LimeWire
2007-07-27 01:56 335 --a------ C:\WINDOWS\nsreg.dat
2007-07-26 21:58 --------- d-------- C:\Program Files\AMR
2007-07-22 23:35 913408 --a------ C:\WINDOWS\system32\xreglib.dll
2007-07-17 21:29 --------- d-------- C:\Program Files\Absolute Poker
2007-07-02 20:31 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-07-02 12:28 4 -r-hs---- C:\MSDOS.BIN
2007-07-01 11:59 --------- d-------- C:\Program Files\Sony
2007-06-29 00:43 8466432 --a------ C:\WINDOWS\system32\nvcpl.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvmctray.dll
2007-06-29 00:43 753664 --a------ C:\WINDOWS\system32\nvcplui.exe
2007-06-29 00:43 6807328 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-06-29 00:43 6807328 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-06-29 00:43 6729728 --a------ C:\WINDOWS\system32\nvoglnt.dll
2007-06-29 00:43 6234112 --a------ C:\WINDOWS\system32\nvdisps.dll
2007-06-29 00:43 5690624 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2007-06-29 00:43 5690624 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-06-29 00:43 5455872 --a------ C:\WINDOWS\system32\nvdispsr.dll
2007-06-29 00:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-06-29 00:43 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2007-06-29 00:43 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2007-06-29 00:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-06-29 00:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcodins.dll
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcod.dll
2007-06-29 00:43 360448 --a------ C:\WINDOWS\system32\nvapi.dll
2007-06-29 00:43 3600384 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2007-06-29 00:43 3518464 --a------ C:\WINDOWS\system32\nvvitvs.dll
2007-06-29 00:43 3321856 --a------ C:\WINDOWS\system32\nvgames.dll
2007-06-29 00:43 3072000 --a------ C:\WINDOWS\system32\nvgamesr.dll
2007-06-29 00:43 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll
2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-06-29 00:43 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2007-06-29 00:43 2416640 --a------ C:\WINDOWS\system32\nvwssr.dll
2007-06-29 00:43 2330624 --a------ C:\WINDOWS\system32\nvwss.dll
2007-06-29 00:43 229376 --a------ C:\WINDOWS\system32\nvmccs.dll
2007-06-29 00:43 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2007-06-29 00:43 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-06-29 00:43 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-06-29 00:43 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe
2007-06-29 00:43 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-06-29 00:43 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2007-06-29 00:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-06-29 00:43 1142784 --a------ C:\WINDOWS\system32\nvmobls.dll
2007-06-29 00:43 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll
2007-06-29 00:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Sony
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Publish Providers
2007-06-28 13:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\NetMedia Providers
2007-06-27 22:58 --------- d-------- C:\Program Files\Vstplugins
2007-06-27 22:57 --------- d-------- C:\Program Files\Sony Setup
2007-06-27 22:19 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SopCast
2007-06-27 12:47 --------- d-------- C:\Program Files\Stardock
2007-06-17 17:49 --------- d-------- C:\Program Files\SopCast
2007-06-15 05:15 --------- d-------- C:\Program Files\VDJ5
2007-06-15 04:18 --------- d-------- C:\Program Files\TGTSoft
2007-06-14 23:58 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\vlc
2007-06-14 23:56 --------- d-------- C:\Program Files\VideoLAN
2007-06-14 23:27 --------- d-------- C:\Program Files\MediaMonkey
2007-06-14 19:35 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
2007-06-14 14:33 --------- d-------- C:\Program Files\Apple Software Update
2007-06-14 12:18 --------- d-------- C:\Program Files\Image-Line
2007-06-14 12:17 --------- d-------- C:\Program Files\Steinberg
2007-06-14 12:17 --------- d-------- C:\Program Files\ASIO4ALL v2
2007-06-14 06:19 --------- d-------- C:\Program Files\DivX
2007-06-14 06:12 --------- d-------- C:\Program Files\Winamp
2007-06-14 06:10 --------- d-------- C:\Program Files\Common Files\NSV
2007-06-14 01:32 --------- d-------- C:\Program Files\TagRunner
2007-06-11 02:25 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
2007-06-11 02:24 --------- d-------- C:\Program Files\Google
2007-06-11 02:17 19088 --a------ C:\DOCUME~1\ADMINI~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-06-11 01:10 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Steinberg
2007-06-11 01:03 --------- d-------- C:\Program Files\Syncrosoft
2007-06-10 20:02 --------- d-------- C:\Program Files\LimeWire
2007-06-10 19:51 --------- d-------- C:\Program Files\Audacity
2007-06-10 18:42 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-06-10 16:40 --------- d-------- C:\Program Files\Movie Maker
2007-06-10 16:40 --------- d-------- C:\Program Files\Messenger
2007-06-10 16:38 --------- d-------- C:\Program Files\Windows NT
2007-06-10 16:01 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\WinRAR
2007-06-10 15:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
2007-06-10 15:32 --------- d-------- C:\Program Files\Microsoft ActiveSync
2007-06-10 15:12 --------- d--h----- C:\Program Files\WindowsUpdate
2007-06-10 15:06 --------- d-------- C:\Program Files\Common Files\Ahead
2007-06-10 15:06 --------- d-------- C:\Program Files\Ahead
2007-06-10 14:34 --------- d-------- C:\Program Files\AOD
2007-06-10 14:34 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Aim
2007-06-10 13:22 --------- d-------- C:\Program Files\Creative
2007-06-10 12:58 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-10 12:28 --------- d-------- C:\Program Files\ORiNOCO
2007-06-10 12:15 0 -rahs---- C:\MSDOS.SYS


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 22:38 C:\WINDOWS\system32\P17.dll]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-07-22 23:34]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-07-22 23:34]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 14:49 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"XboxStat"="c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-02-12 17:21]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 06:06]
"lxcemon.exe"="C:\Program Files\Lexmark 4300 Series\lxcemon.exe" [2005-08-02 20:45]
"EzPrint"="C:\Program Files\Lexmark 4300 Series\ezprint.exe" [2005-07-26 15:17]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 03:00]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 18:35]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 14:31]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-24 14:30:37]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 04:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2007-02-07 17:31 226992 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys
R3 P17;Creative SB Audigy LS;C:\WINDOWS\system32\drivers\P17.sys
R3 PRISM_USB;ORiNOCO 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\EXPSUSB.sys
R3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21;C:\WINDOWS\system32\DRIVERS\xusb21.sys
S3 AWINDIS5;AWINDIS5 Protocol Driver;\??\C:\WINDOWS\System32\AWINDIS5.SYS
S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\WINDOWS\system32\DRIVERS\xusb20.sys


Contents of the 'Scheduled Tasks' folder
2007-07-26 15:33:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-08 07:28:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd4w\2]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\Software\Adobe\FeatureSubscriptions\DVAAdobeDocMeta\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\Registered"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\27:\xf5wjY\1]
"DisplayName"="\x3da2\x7667\x480\27\x1340\21\t"
"DeviceDesc"="\x3da2\x7667\x480\27\x1340\21\t"
"ProviderName"="\xad8\x388\x24dc\21\x69e0\27\x2808\21\x9005\x77f7"
"MFG"="\xffff\xffff\x3dbf\x7667\x654f\x7667\x112c"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=str(7):"c:\intel desktop board\smbus\smbusati.inf"

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-08 7:29:21
C:\ComboFix-quarantined-files.txt ... 2007-08-08 07:28
C:\ComboFix2.txt ... 2007-08-07 19:41

--- E O F ---






and heres my kasper sky log...







Wednesday, August 08, 2007 10:40:11 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 8/08/2007
Kaspersky Anti-Virus database records: 377073
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 115298
Number of viruses found 16
Number of infected objects 24
Number of suspicious objects 0
Duration of the scan process 02:49:26

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Administrator\Application Data\Aim\mtbfdwzz\giorgi1011\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Aim\mtbfdwzz\giorgi1011\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Bitdefender\Desktop\Profiles\asdict.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Vista Transformation\Auto Vista Transformation\Vista Transformation Pack 7.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Vista Transformation\Auto Vista Transformation\Vista Transformation Pack 7.0.exe WiseSFX: infected - 1 skipped
C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Vista Transformation\Auto Vista Transformation\vtp7.zip/Vista Transformation Pack 7.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Vista Transformation\Auto Vista Transformation\vtp7.zip/Vista Transformation Pack 7.0.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Documents and Settings\Administrator\Desktop\Giorgio Media\Proggies and Stuff\Vista Transformation\Auto Vista Transformation\vtp7.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\mghtooke.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007080820070809\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\asappsrv.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\command.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\netmon.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\spoolsv.exe Infected: Trojan-Downloader.Win32.PurityScan.dx skipped
C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Quarantine\winpop.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Softwin\BitDefender10\aspdict.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011034.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011036.exe/file02 Infected: not-a-virus:AdWare.Win32.Lop.bo skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011036.exe/file13 Infected: Trojan.Win32.Obfuscated.en skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011036.exe Inno: infected - 2 skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011075.exe Infected: Trojan-Downloader.Win32.Agent.boa skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011076.exe Infected: not-a-virus:RiskTool.Win32.Starter.a skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP81\A0011077.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011188.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011189.exe Infected: not-a-virus:AdWare.Win32.Mostofate.al skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011190.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011191.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011191.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011191.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP86\A0011192.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{6EA55B3F-6C11-4EA1-8720-1F5883615C5D}\RP88\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\bdss.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\tmp00002993\tmp00000000 Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
zipzappy is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-08-2007, 10:30 PM   #7 (permalink)
Analyst, Security Team
 
forhockey's Avatar
 
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,931
OS: Windows 7 Ultimate


Re: Trojans & Adware
Hi zipzappy,

Please empty out your BitDefender quarantine folder.


Well done, your logs are clean! There are just a few more things I would like you to do.

Reset System Restore

To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.

Clear Firefox Cookies
  • Click Tools -> Options
  • Click Privacy Tab
  • Click the "Show Cookies" button
  • Click the "Remove All Cookies" button, which is at the bottom of the window.
  • Click Close

Clear IE7 cookies
  • On the Internet Explorer 6 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
  • Double-click Internet Options to open Internet Properties.
  • Click Delete Files button.
  • Click Delete button across from Temporary Internet Files.
  • Click Yes.
  • Click Close.
  • Click Ok.

Microsoft Updates

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Malware Prevention Tools

These programs configure your computer to prevent known malware-related changes. You can have more than one of these at a time and they take up minimal resources.
  • SpywareBlaster - Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Check regularly for updates.
  • IE-Spyad - Extract to your desktop and double-click install.bat. Install options #2 and #4. IE-Spyad places more than 4,000 dubious domains in the IE Restricted list, which impairs attempts to infect your system. It prevents any downloads from the sites although you will still be able to connect to them. You can read more about it on it's homepage.
  • MVPS Hosts File - extract and double-click the mvps.bat file. This will replace your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements, preventing your computer from connecting to those sites.
  • McAfee SiteAdvisor - helps to warn you before you interact with a dangerous Web site. Works with both IE and Firefox.
  • SpywareGuard - real-time protection that detects and blocks spyware before it can execute.

Alternative Web Browsers

Using an alternative browser can help prevent malware from being installed without your knowledge, but may not work on all websites.

Firewalls

If you do not have a firewall, here are a few free ones available for personal use:

Understanding and Using Firewalls


Informational Reading

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved.
__________________


Proud Member of ASAP
Proud Member of UNITE

Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support.

Donation link for Tech Support Forum
forhockey is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-08-2007, 11:25 PM   #8 (permalink)
Registered User
 
Join Date: May 2007
Posts: 208
OS: XP


Re: Trojans & Adware
Thank you so much!!!
zipzappy is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-08-2007, 11:28 PM   #9 (permalink)
Analyst, Security Team
 
forhockey's Avatar
 
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,931
OS: Windows 7 Ultimate


Re: Trojans & Adware
Was my pleasure. Safe surfin
__________________


Proud Member of ASAP
Proud Member of UNITE

Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support.

Donation link for Tech Support Forum
forhockey is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 09:10 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85