|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-07-2007, 05:53 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Hi-Jack-This log
Hello I'm new to these forums and have a spy-ware problem. If you guys could help me out that would be much appreciated. Heres my Log.
*edit* I have CA anti-virus/avast/Ad-Aware/ Spy-bot Search and Destroy. I used em to clean as much as possible. Logfile of HijackThis v1.99.1 Scan saved at 5:52:32 PM, on 8/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\InetCntrl\InetCntrl.exe H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe D:\WINDOWS\svhost.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\MSN Messenger\msnmsgr.exe D:\Program Files\Xfire\Xfire.exe D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\system32\PnkBstrA.exe D:\WINDOWS\system32\UAService7.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\WINDOWS\System32\svchost.exe H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe D:\Program Files\Windows Media Player\wmplayer.exe D:\WINDOWS\System32\imapi.exe D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe H:\Program Files\CA\CA Internet Security Suite\casecuritycenter.exe H:\Program Files\Fire Fox\firefox.exe D:\Documents and Settings\Jacob K.JACOB\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O1 - Hosts: 70.87.69.74 63.216.32.69 O1 - Hosts: 24.23.38.160 61.152.116.62 O1 - Hosts: 70.87.69.66 nprotect.ryl.com.my O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [EPoXUSDM] "D:\Program Files\EPoX\USDM\USDM.EXE" "5000" O4 - HKLM\..\Run: [InetCntrl] D:\WINDOWS\system32\InetCntrl\InetCntrl.exe O4 - HKLM\..\Run: [cctray] "H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" O4 - HKLM\..\Run: [CAVRID] "H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" O4 - HKLM\..\Run: [poolsv] "D:\WINDOWS\poolsv.exe" O4 - HKLM\..\Run: [svhost] "D:\WINDOWS\svhost.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'inetcntrl0003.dll' missing O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113106995364 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E96A98A3-E927-4593-B9A7-58A0A4499731}: NameServer = 205.171.3.65,205.171.2.65 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: CaCCProvSP - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe O23 - Service: CAISafe - Computer Associates International, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - D:\WINDOWS\system32\UAService7.exe O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe Last edited by megahurts; 08-07-2007 at 05:59 PM. Reason: Forgot to add more information |
|
     |
| Sponsored Links |
|
08-07-2007, 08:37 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,246
OS: N/A
|
Re: Hi-Jack-This log
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
|
|
|
|
|
08-08-2007, 07:19 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Hi-Jack-This log
Thank you so much! Here is my log.
ComboFix 07-08-08 - "Jacob K" 2007-08-08 7:00:16.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.335 [GMT -7:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) D:\Program Files\poolsv D:\Program Files\poolsv\k11u72.exe D:\Program Files\poolsv\svhost.exe D:\Program Files\poolsv\YazzleBundle-1549.exe D:\Program Files\svhost D:\WINDOWS\poolsv.exe D:\WINDOWS\svhost.exe D:\WINDOWS\system32\f10WtR D:\WINDOWS\system32\f10WtR\f10WtR1099.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 ))))))))))))))))))))))))))))))) 2007-08-08 07:11 <DIR> d-------- D:\DOCUME~1\NETWOR~1.NTA\APPLIC~1\Xfire 2007-08-08 06:58 51,200 --a------ D:\WINDOWS\nircmd.exe 2007-08-07 16:10 95,608 --a------ D:\WINDOWS\system32\AvastSS.scr 2007-08-07 16:10 94,416 --a------ D:\WINDOWS\system32\drivers\aswmon2.sys 2007-08-07 16:10 92,848 --a------ D:\WINDOWS\system32\drivers\aswmon.sys 2007-08-07 16:10 783,224 --a------ D:\WINDOWS\system32\aswBoot.exe 2007-08-07 16:10 42,912 --a------ D:\WINDOWS\system32\drivers\aswTdi.sys 2007-08-07 16:10 26,624 --a------ D:\WINDOWS\system32\drivers\aavmker4.sys 2007-08-07 16:10 23,152 --a------ D:\WINDOWS\system32\drivers\aswRdr.sys 2007-08-07 16:10 <DIR> d-------- D:\Program Files\Alwil Software 2007-08-07 12:28 <DIR> d-------- D:\Program Files\Lavasoft 2007-08-07 12:28 <DIR> d-------- D:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft 2007-08-06 17:15 <DIR> d-------- D:\DOCUME~1\LOCALS~1.NTA\APPLIC~1\Xfire 2007-08-06 13:13 <DIR> d-------- D:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy 2007-07-27 16:57 22,328 --a------ D:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-27 16:57 103,736 --a------ D:\WINDOWS\system32\PnkBstrB.exe 2007-07-27 16:56 66,872 --a------ D:\WINDOWS\system32\PnkBstrA.exe 2007-07-23 17:12 <DIR> d-------- D:\Program Files\Microsoft ActiveSync 2007-07-23 17:11 <DIR> d-------- D:\WINDOWS\ShellNew 2007-07-23 17:11 <DIR> d-------- D:\Program Files\Common Files\L&H 2007-07-23 16:49 879,832 --a------ D:\WINDOWS\system32\drivers\vetefile.sys 2007-07-23 16:49 108,360 --a------ D:\WINDOWS\system32\drivers\veteboot.sys 2007-07-22 20:26 9,437,184 --a------ D:\DOCUME~1\JACOBK~1.JAC\ntuser.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-07 16:09 --------- d-------- D:\DOCUME~1\JACOBK~1.JAC\APPLIC~1\Xfire 2007-08-07 12:28 --------- d-------- D:\Program Files\Common Files\Wise Installation Wizard 2007-08-06 17:22 --------- d---s---- D:\Program Files\Xfire 2007-08-01 11:22 --------- d--h----- D:\Program Files\InstallShield Installation Information 2007-06-27 16:24 --------- d--h----- D:\DOCUME~1\JACOBK~1.JAC\APPLIC~1\ijjigame 2007-05-16 08:12 86528 -----c--- D:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 -----c--- D:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a------ D:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 683520 -----c--- D:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 510976 -----c--- D:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 -----c--- D:\WINDOWS\system32\dllcache\msoe.dll 2007-05-09 07:17 75280 --a------ D:\WINDOWS\system32\isafprod.dll 2007-05-08 02:24 3583488 --a--c--- D:\WINDOWS\system32\dllcache\mshtml.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22] "EPoXUSDM"="D:\Program Files\EPoX\USDM\USDM.exe" [2004-06-08 16:59] "InetCntrl"="D:\WINDOWS\system32\InetCntrl\InetCntrl.exe" [2006-09-14 11:25] "cctray"="H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-14 17:56] "CAVRID"="H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-09 07:17] "svhost"="D:\WINDOWS\svhost.exe" [] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-27 15:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] "msnmsgr"="D:\Program Files\MSN Messenger\msnmsgr.exe" [2006-01-24 11:37] D:\Documents and Settings\Jacob K.JACOB\Start Menu\Programs\Startup\ Xfire.lnk - D:\Program Files\Xfire\Xfire.exe [2007-08-02 15:44:38] D:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray] D:\Program Files\AGEIA Technologies\bin\TrayIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray] "D:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray] "D:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] "H:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "6to4"=2 (0x2) "WZCSVC"=2 (0x2) "WmdmPmSN"=3 (0x3) "UPS"=3 (0x3) "TlntSvr"=3 (0x3) "TermService"=3 (0x3) "TapiSrv"=3 (0x3) "RemoteRegistry"=2 (0x2) "RDSessMgr"=3 (0x3) "RasMan"=3 (0x3) "RasAuto"=3 (0x3) "MSSQLServerADHelper"=3 (0x3) "MSSQL$SOSHOME22"=2 (0x2) "lanmanserver"=2 (0x2) "Groove Games Licensing Service"=3 (0x3) "FastUserSwitchingCompatibility"=3 (0x3) R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);D:\WINDOWS\system32\drivers\sfvfs02.sys R0 SI3114r;SiI-3114 SATARaid Controller;D:\WINDOWS\system32\DRIVERS\SI3114R.sys R0 SiFilter;SATALink driver accelerator;D:\WINDOWS\system32\DRIVERS\SiWinAcc.sys R0 VClone;VClone;D:\WINDOWS\system32\DRIVERS\VClone.sys R1 Amfilter;Compatible Mouse Filter Driver;D:\WINDOWS\system32\DRIVERS\Amfilter.sys R1 bsofrwl;bsofrwl;D:\WINDOWS\system32\drivers\bsofrwl.sys R1 NPPTNT2;NPPTNT2;\??\D:\WINDOWS\system32\npptNT2.sys R1 Tcpip6;Microsoft IPv6 Protocol Driver;D:\WINDOWS\system32\DRIVERS\tcpip6.sys R2 atksgt;atksgt;D:\WINDOWS\system32\DRIVERS\atksgt.sys R2 EPoXUSDM;EPoXUSDM;D:\WINDOWS\system32\drivers\EPoXUSDM.sys R2 lirsgt;lirsgt;D:\WINDOWS\system32\DRIVERS\lirsgt.sys R3 ALCXSENS;Service for WDM 3D Audio Driver;D:\WINDOWS\system32\drivers\ALCXSENS.SYS R3 ElbyDelay;ElbyDelay;D:\WINDOWS\system32\Drivers\ElbyDelay.sys R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;D:\WINDOWS\system32\drivers\msmpu401.sys R3 msgame;Sidewinder HID to Joystick Port Enabler;D:\WINDOWS\system32\DRIVERS\msgame.sys R3 tunmp;Microsoft Tun Miniport Adapter Driver;D:\WINDOWS\system32\DRIVERS\tunmp.sys S3 Amusbprt;Compatible HID-compliant Mouse Driver;D:\WINDOWS\system32\DRIVERS\Amusbprt.sys S3 sony_ssm.sys;sony_ssm.sys;\??\D:\DOCUME~1\JACOBK~1.JAC\LOCALS~1\Temp\sony_ssm.sys S3 SQLAgent$SOSHOME22;SQLAgent$SOSHOME22;D:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME22\Binn\sqlagent.EXE -i SOSHOME22 S3 STEAMDVR;STEAMDVR;\??\H:\Program Files\Valve\Steam\bin\x86\SteamDvr.sys S4 6to4;IPv6 Helper Service;D:\WINDOWS\system32\svchost.exe -k netsvcs S4 Groove Games Licensing Service;Groove Games Licensing Service;"D:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe" S4 MSSQL$SOSHOME22;MSSQL$SOSHOME22;D:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME22\Binn\sqlservr.exe -sSOSHOME22 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{470bf0be-6629-11db-8bea-000461687fac}] AutoRun\command- K:\LaunchU3.exe -a Contents of the 'Scheduled Tasks' folder 2007-08-08 08:39:01 D:\WINDOWS\Tasks\MP Scheduled Scan.job - D:\Program Files\Windows Defender\MpCmdRun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-08 07:10:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-08 7:12:39 - machine was rebooted D:\ComboFix-quarantined-files.txt ... 2007-08-08 07:12 --- E O F --- |
|
|
|
|
08-08-2007, 07:13 PM
|
#5 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Hi-Jack-This log
Thank you so much I believe that program fixed everything. I don't have any more pop-ups.
Logfile of HijackThis v1.99.1 Scan saved at 7:10:16 PM, on 8/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\EPoX\USDM\USDM.EXE D:\WINDOWS\system32\InetCntrl\InetCntrl.exe H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe D:\Program Files\MSN Messenger\msnmsgr.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe D:\Program Files\Xfire\Xfire.exe D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\PnkBstrA.exe D:\WINDOWS\system32\UAService7.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\WINDOWS\System32\svchost.exe H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe H:\Program Files\Fire Fox\firefox.exe D:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Program Files\Windows Media Player\wmplayer.exe H:\Program Files\Teamspeak2_RC2\TeamSpeak.exe D:\Documents and Settings\Jacob K.JACOB\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [EPoXUSDM] "D:\Program Files\EPoX\USDM\USDM.EXE" "5000" O4 - HKLM\..\Run: [InetCntrl] D:\WINDOWS\system32\InetCntrl\InetCntrl.exe O4 - HKLM\..\Run: [cctray] "H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" O4 - HKLM\..\Run: [CAVRID] "H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" O4 - HKLM\..\Run: [svhost] "D:\WINDOWS\svhost.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'inetcntrl0003.dll' missing O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113106995364 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E96A98A3-E927-4593-B9A7-58A0A4499731}: NameServer = 205.171.3.65,205.171.2.65 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: CaCCProvSP - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe O23 - Service: CAISafe - Computer Associates International, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - D:\WINDOWS\system32\UAService7.exe O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe |
|
|
|
|
08-08-2007, 07:24 PM
|
#6 (permalink) | ||
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,246
OS: N/A
|
Re: Hi-Jack-This log
Quote:
----------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O4 - HKLM\..\Run: [svhost] "D:\WINDOWS\svhost.exe" O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll --------------- Open NOTEPAD.exe and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Quote:
It should look like this:  Double click on fix.reg & allow it to merge into the registry --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
|
||
|
|
|
|
08-08-2007, 07:24 PM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,246
OS: N/A
|
Re: Hi-Jack-This log
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
|
|
|
|
|
08-09-2007, 06:56 AM
|
#8 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Hi-Jack-This log
Yikes theres more to this then I thought
 .Hi-Jack-This log Logfile of HijackThis v1.99.1 Scan saved at 6:49:16 AM, on 8/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\EPoX\USDM\USDM.EXE D:\WINDOWS\system32\InetCntrl\InetCntrl.exe H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe D:\Program Files\MSN Messenger\msnmsgr.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe D:\Program Files\Xfire\Xfire.exe D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\PnkBstrA.exe D:\WINDOWS\system32\UAService7.exe H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\WINDOWS\System32\svchost.exe H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe D:\Documents and Settings\Jacob K.JACOB\Desktop\Q3E.exe D:\Program Files\Windows Media Player\wmplayer.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe D:\Program Files\Internet Explorer\IEXPLORE.EXE H:\PROGRA~1\FIREFO~1\FIREFOX.EXE D:\Documents and Settings\Jacob K.JACOB\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - D:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [EPoXUSDM] "D:\Program Files\EPoX\USDM\USDM.EXE" "5000" O4 - HKLM\..\Run: [InetCntrl] D:\WINDOWS\system32\InetCntrl\InetCntrl.exe O4 - HKLM\..\Run: [cctray] "H:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" O4 - HKLM\..\Run: [CAVRID] "H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'inetcntrl0003.dll' missing O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113106995364 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E96A98A3-E927-4593-B9A7-58A0A4499731}: NameServer = 205.171.3.65,205.171.2.65 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: CaCCProvSP - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe O23 - Service: CAISafe - Computer Associates International, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - D:\WINDOWS\system32\UAService7.exe O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - H:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe Kaspersky log KASPERSKY ONLINE SCANNER REPORT Thursday, August 09, 2007 6:44:29 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 9/08/2007 Kaspersky Anti-Virus database records: 377347 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target Folders D:\ Scan Statistics Total number of scanned objects 53926 Number of viruses found 5 Number of infected objects 16 Number of suspicious objects 2 Duration of the scan process 01:30:44 Infected Object Name Virus Name Last Action D:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip/Yazzle1549OinUninstaller.exe Suspicious: Password-protected-EXE skipped D:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip ZIP: suspicious - 1 skipped D:\Documents and Settings\Jacob k\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-593ebb39-2fb6d1a8.class Infected: Trojan-Downloader.Java.OpenStream.y skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\cert8.db Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\formhistory.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\history.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\key3.db Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\parent.lock Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\search.sqlite Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\urlclassifier2.sqlite Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Cookies\index.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\Cache\_CACHE_001_ Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\Cache\_CACHE_002_ Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\Cache\_CACHE_003_ Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Application Data\Mozilla\Firefox\Profiles\yeieovwj.default\Cache\_CACHE_MAP_ Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\History\History.IE5\index.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temp\~DF78F7.tmp Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temp\~DFB00F.tmp Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temp\~DFD808.tmp Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temp\~DFD918.tmp Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temp\~DFDC5F.tmp Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\ntuser.dat Object is locked skipped D:\Documents and Settings\Jacob K.JACOB\ntuser.dat.LOG Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\Cookies\index.dat Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped D:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\Cookies\index.dat Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped D:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped D:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped D:\QooBox\Quarantine\D\Program Files\poolsv\k11u72.exe.vir/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped D:\QooBox\Quarantine\D\Program Files\poolsv\k11u72.exe.vir NSIS: infected - 1 skipped D:\QooBox\Quarantine\D\Program Files\poolsv\svhost.exe.vir Infected: Trojan-Proxy.Win32.VB.x skipped D:\QooBox\Quarantine\D\Program Files\poolsv\YazzleBundle-1549.exe.vir/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped D:\QooBox\Quarantine\D\Program Files\poolsv\YazzleBundle-1549.exe.vir NSIS: infected - 1 skipped D:\QooBox\Quarantine\D\WINDOWS\svhost.exe.vir Infected: Trojan-Proxy.Win32.VB.x skipped D:\QooBox\Quarantine\D\WINDOWS\system32\f10WtR\f10WtR1099.exe.vir Infected: Trojan-Downloader.Win32.VB.awj skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1172\A0345293.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347072.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347072.exe NSIS: infected - 1 skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347073.exe Infected: Trojan-Proxy.Win32.VB.x skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347074.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347074.exe NSIS: infected - 1 skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347075.exe Infected: Trojan-Downloader.Win32.VB.awj skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1174\A0347076.exe Infected: Trojan-Proxy.Win32.VB.x skipped D:\System Volume Information\_restore{DEF33B93-66C0-48C0-B191-AD49AEBB83DF}\RP1175\change.log Object is locked skipped D:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped D:\WINDOWS\SchedLgU.Txt Object is locked skipped D:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped D:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped D:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped D:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped D:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped D:\WINDOWS\system32\config\default Object is locked skipped D:\WINDOWS\system32\config\default.LOG Object is locked skipped D:\WINDOWS\system32\config\Internet.evt Object is locked skipped D:\WINDOWS\system32\config\SAM Object is locked skipped D:\WINDOWS\system32\config\SAM.LOG Object is locked skipped D:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped D:\WINDOWS\system32\config\SECURITY Object is locked skipped D:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped D:\WINDOWS\system32\config\software Object is locked skipped D:\WINDOWS\system32\config\software.LOG Object is locked skipped D:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped D:\WINDOWS\system32\config\system Object is locked skipped D:\WINDOWS\system32\config\system.LOG Object is locked skipped D:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped D:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped D:\WINDOWS\system32\drivers\sptd3597.sys Object is locked skipped D:\WINDOWS\system32\InetCntrl\applog.txt Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped D:\WINDOWS\Temp\Perflib_Perfdata_2a0.dat Object is locked skipped D:\WINDOWS\Temp\Perflib_Perfdata_6f4.dat Object is locked skipped D:\WINDOWS\Temp\Perflib_Perfdata_d0.dat Object is locked skipped D:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Thank you again for all your efforts. |
|
|
|
|
08-09-2007, 07:54 AM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,246
OS: N/A
|
Re: Hi-Jack-This log
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"D:\Documents and Settings\Jacob k\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-593ebb39-2fb6d1a8.class"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"D:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Recovery"
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
|
|
|
|
|
08-09-2007, 02:57 PM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,246
OS: N/A
|
Re: Hi-Jack-This log
Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
|
|
|
|
| Thread Tools | |
|
|
