|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-07-2007, 11:58 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 10
OS: Win XP
|
HJT Help with everything from spyware to "antispyware"
Hi,
I have been having troubles as of late with hijacking and locking up. My computer will randomly direct me to "antivirus" sites. It's driving me nuts and beginning to cause lock ups with my PC  .I am running windows XP x32. After running HJT and creating the log it gave me: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:49:37 PM, on 8/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\WINDOWS\TEMP\win7527.tmp.exe C:\WINDOWS\mgrs.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\win7527.tmp.exe O4 - HKLM\..\Run: [smgr] mgrs.exe O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvbig.dll,startup O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 6767 bytes Any help on what to remove would be greatly welcome and appreciated. Thanks to all those better than I!! 
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-08-2007, 05:57 AM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,353
OS: N/A
|
Re: HJT Help with everything from spyware to "antispyware"
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
08-08-2007, 10:52 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 10
OS: Win XP
|
Re: HJT Help with everything from spyware to "antispyware"
Thankies sUBs!!
ComboFix: ComboFix 07-08-08 - "Administrator" 2007-08-08 9:33:24.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2497 [GMT -7:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\install.dat C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Find Spyware Remover.lnk C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Free Online Dating.lnk C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Go to Casino.lnk C:\Program Files\appatc~1 C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe C:\Program Files\ucleaner_setup.exe C:\Program Files\Ultimate Cleaner C:\WINDOWS\Casino.ico C:\WINDOWS\Free Online Dating.ico C:\WINDOWS\mgrs.exe C:\WINDOWS\Spyware Remover.ico C:\WINDOWS\system32\akbauedx.ini C:\WINDOWS\system32\asomjkuw.exe C:\WINDOWS\system32\atkeyqfe.exe C:\WINDOWS\system32\awtqo.dll C:\WINDOWS\system32\fkfqahfr.exe C:\WINDOWS\system32\gebbcyx.dll C:\WINDOWS\system32\gydutoul.exe C:\WINDOWS\system32\hlpsrv.exe C:\WINDOWS\system32\honmdutd.exe C:\WINDOWS\system32\icroso~1 C:\WINDOWS\system32\ifkqjqtu.exe C:\WINDOWS\system32\jjmmxulg.exe C:\WINDOWS\system32\juvdfisw.dll C:\WINDOWS\system32\kyaybqck.exe C:\WINDOWS\system32\lfcyheqq.exe C:\WINDOWS\system32\lxbktlnl.exe C:\WINDOWS\system32\mit.bat C:\WINDOWS\system32\mwtjbmhu.exe C:\WINDOWS\system32\ooqbcqov.exe C:\WINDOWS\system32\oqtwa.bak1 C:\WINDOWS\system32\oqtwa.bak2 C:\WINDOWS\system32\oqtwa.ini C:\WINDOWS\system32\primrpcf.exe C:\WINDOWS\system32\ptxhelpn.exe C:\WINDOWS\system32\qahjdwxg.exe C:\WINDOWS\system32\qnexnohc.exe C:\WINDOWS\system32\qqtgcwpb.exe C:\WINDOWS\system32\rcofcwmo.exe C:\WINDOWS\system32\tdfqolik.exe C:\WINDOWS\system32\urqpmjh.dll C:\WINDOWS\system32\winlgj32.dll C:\WINDOWS\system32\wiypieuw.exe C:\WINDOWS\system32\xdeuabka.dll C:\WINDOWS\system32\xnrufalq.exe C:\WINDOWS\system32\xxojhyvj.exe C:\WINDOWS\system32\yayyvvs.dll C:\WINDOWS\system32\yuqktrds.exe ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 ))))))))))))))))))))))))))))))) 2007-08-08 09:32 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-07 22:49 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-06 12:49 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Oxin's Style! 2007-08-06 12:48 <DIR> d-------- C:\Program Files\thriXXX 2007-08-06 10:51 <DIR> d-------- C:\Program Files\FlashFXP 2007-08-06 10:51 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\FlashFXP 2007-08-06 10:13 6,372 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg 2007-08-02 06:32 93,696 --a------ C:\WINDOWS\system32\drvbig.dll 2007-07-28 09:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy 2007-07-27 16:40 126,016 --a------ C:\WINDOWS\system32\esranlok.dll 2007-07-27 15:59 <DIR> d-------- C:\ProgramData 2007-07-27 15:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Google 2007-07-27 15:36 <DIR> d-------- C:\VundoFix Backups 2007-07-27 15:36 <DIR> d-------- C:\Program Files\Google 2007-07-27 09:24 <DIR> d-------- C:\Program Files\Windows Defender 2007-07-26 22:06 93,696 --a------ C:\WINDOWS\system32\drvsuw.dll 2007-07-26 18:13 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\Opera 2007-07-26 18:10 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\uTorrent 2007-07-26 17:50 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\vlc 2007-07-26 16:32 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-07-26 16:31 1,572,864 --ah----- C:\DOCUME~1\Blackie\NTUSER.DAT 2007-07-26 16:30 <DIR> dr------- C:\Program Files\Aston 2007-07-26 08:55 1,933,312 --a------ C:\WINDOWS\system32\cdintf250.dll 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Quicken 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Palo Alto Software 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Intuit 2007-07-26 08:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Intuit 2007-07-26 08:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Intuit 2007-07-23 06:25 <DIR> d-------- C:\Program Files\Last.fm 2007-07-22 13:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\dvdcss 2007-07-21 22:34 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-07-21 22:34 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-07-21 22:34 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-07-21 22:34 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-07-21 15:08 <DIR> d-------- C:\Program Files\iTunes 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Apple Software Update 2007-07-21 15:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple 2007-07-17 19:13 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-07-17 19:10 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-07-17 19:10 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-17 19:10 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-07-17 19:10 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-07-17 19:10 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-17 19:10 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-07-17 19:10 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-17 19:10 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-07-17 19:10 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-16 19:20 2,192,640 --a------ C:\WINDOWS\system32\kernel1.exe 2007-07-16 19:06 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-07-16 14:55 24,192 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermptxp.sys 2007-07-16 14:55 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys 2007-07-16 14:55 22,768 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermpt.sys 2007-07-13 11:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Help 2007-07-10 16:51 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-08 04:16 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\uTorrent 2007-08-06 10:13 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-30 18:46 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-07-27 15:32 --------- d-------- C:\Program Files\Microsoft IntelliType Pro 2007-07-27 09:29 --------- d-------- C:\Program Files\Opera 2007-07-26 18:25 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-07-26 18:25 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-26 16:07 --------- d-------- C:\Program Files\The All-Seeing Eye 2007-07-24 21:58 --------- d-------- C:\Program Files\uTorrent 2007-07-21 15:34 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Apple Computer 2007-07-21 15:08 --------- d-------- C:\Program Files\iPod 2007-07-21 15:07 --------- d-------- C:\Program Files\QuickTime 2007-07-21 14:11 --------- d-------- C:\Program Files\Winamp 2007-07-20 08:40 1809 --a------ C:\WINDOWS\mozver.dat 2007-07-16 14:56 --------- d-------- C:\Program Files\Motorola Phone Tools 2007-07-16 14:56 --------- d-------- C:\Program Files\Avanquest update 2007-07-06 22:14 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-05 22:10 --------- d-------- C:\Program Files\BitLord2 2007-07-05 15:26 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\InstallShield 2007-07-01 08:36 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SlySoft 2007-06-30 23:17 --------- d-------- C:\Program Files\CloneDVD 2007-06-30 23:16 14 --a------ C:\WINDOWS\system32\systeminfo3.dll 2007-06-30 23:15 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Vso 2007-06-30 23:14 81920 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ezpinst.exe 2007-06-30 23:14 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-06-30 23:14 47360 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\pcouffin.sys 2007-06-30 23:09 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys 2007-06-30 23:09 34308 --a------ C:\WINDOWS\system32\Chip.dll 2007-06-30 21:56 --------- d-------- C:\Program Files\Common Files\AOL 2007-06-30 21:56 --------- d-------- C:\Program Files\AIM6 2007-06-28 19:58 --------- d-------- C:\Program Files\HP 2007-06-27 03:00 --------- d-------- C:\Program Files\MSXML 4.0 2007-06-27 03:00 --------- d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-06-26 16:01 --------- d-------- C:\Program Files\Hewlett-Packard 2007-06-26 00:08 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Opera 2007-06-25 23:23 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-06-25 22:05 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SecondLife 2007-06-25 21:16 --------- d-------- C:\Program Files\SecondLife 2007-06-25 21:04 499712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-06-22 06:54 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys.bak 2007-06-20 14:08 93128 --a------ C:\WINDOWS\system32\ElbyCDIO.dll 2007-06-12 12:24 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Viewpoint 2007-06-11 10:16 5028 --a------ C:\dnsbak.reg 2007-06-11 09:38 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Aston 2007-06-10 22:09 --------- d-------- C:\Program Files\Windows Live 2007-06-03 08:17 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-06-01 08:20 51568 --a------ C:\WINDOWS\system32\sirenacm.dll 2007-05-20 18:11 291 --a------ C:\WINDOWS\PowerReg.dat 2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2001-01-11 16:02 794624 --a------ C:\WINDOWS\inf\OTHER\audio3d.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6}] C:\WINDOWS\system32\geedc.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92E68C11-E017-43CD-82C0-48131B6FCA41}] C:\WINDOWS\system32\awvts.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26] "nwiz"="nwiz.exe" [] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 07:57] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-05-20 03:13] "C-Media Mixer"="Mixer.exe" [2001-10-22 18:24 C:\WINDOWS\mixer.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 07:46] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] "itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-06-01 08:21] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 11:31] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-23 06:25:21] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedc] C:\WINDOWS\system32\geedc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrsst] ssqrsst.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp] C:\WINDOWS\TEMP\win511E.tmp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] rundll32.exe C:\WINDOWS\system32\drvsuw.dll,startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magicantispy] C:\Program Files\Magicantispy\Magicantispy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr] mgrs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ixqfpdmc.dll",forkonce [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader] C:\Windows\xpupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "odserv"=3 (0x3) "NBService"=3 (0x3) "Microsoft Office Groove Audit Service"=3 (0x3) "iPod Service"=3 (0x3) R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\system32\drivers\cmaudio.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys S3 PnkBstrK;PnkBstrK;\??\C:\WINDOWS\system32\drivers\PnkBstrK.sys S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys S3 usbsermpt;Motorola USB Modem Driver for MPT;C:\WINDOWS\system32\DRIVERS\usbsermpt.sys S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" S4 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" Contents of the 'Scheduled Tasks' folder 2007-08-03 15:58:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-07-27 22:58:21 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job - C:\Program Files\Microsoft IntelliType Pro\itype.exe 2007-08-08 11:21:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-08 09:42:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... ************************************************************************** Completion time: 2007-08-08 9:45:26 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-08 09:44 --- E O F --- HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:51:46 AM, on 8/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6} - C:\WINDOWS\system32\geedc.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {92E68C11-E017-43CD-82C0-48131B6FCA41} - C:\WINDOWS\system32\awvts.dll (file missing) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: geedc - C:\WINDOWS\system32\geedc.dll (file missing) O20 - Winlogon Notify: ssqrsst - ssqrsst.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 7568 bytes Again thank you very much. |
|
|
|
|
08-08-2007, 01:34 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,353
OS: N/A
|
Re: HJT Help with everything from spyware to "antispyware"
I have scheduled thriXXX for removal. Is it a program you voluntarily install? If so, you can remove it from my instructs below.
-------------- Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6} - C:\WINDOWS\system32\geedc.dll (file missing) O2 - BHO: (no name) - {92E68C11-E017-43CD-82C0-48131B6FCA41} - C:\WINDOWS\system32\awvts.dll (file missing) O20 - Winlogon Notify: geedc - C:\WINDOWS\system32\geedc.dll (file missing) O20 - Winlogon Notify: ssqrsst - ssqrsst.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/172842-hjt-help-everything-spyware-antispyware.html
Suspect::
C:\WINDOWS\system32\Chip.dll
DirLook::
C:\ProgramData
File::
C:\dnsbak.reg
C:\WINDOWS\system32\drvsuw.dll
C:\WINDOWS\system32\drvbig.dll
C:\WINDOWS\system32\esranlok.dll
Folder::
C:\VundoFix Backups
C:\Program Files\thriXXX
C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92E68C11-E017-43CD-82C0-48131B6FCA41}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedc]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrsst]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip Please submit this file to: http://www.bleepingcomputer.com/subm....php?channel=4 The file must be uploaded before proceeding to the next step. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
08-08-2007, 02:56 PM
|
#5 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 10
OS: Win XP
|
Re: HJT Help with everything from spyware to "antispyware"
Viewpoint was not in my add\delete as i know that program as an annoying wants to be updated program. I generally uninstall it as i see it. I dont recall installing anything by ThriXXX and certainly think it needs to be removed as well.
I have completed those options thus far Hijack this gave me the log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:15:02 PM, on 8/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Opera\Opera.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 7279 bytes Online scan gave me: Scan Statistics Total number of scanned objects 14613 Number of viruses found 0 Number of infected objects 0 Number of suspicious objects 0 Duration of the scan process 00:10:40 Infected Object Name Virus Name Last Action C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd9613.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\temp\TMP0000003C154F596ADFEE1352 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\DOCUME~1\ADMINI~1.JOS\LOCALS~1\Temp\~DFDF29.tmp Object is locked skipped C:\DOCUME~1\ADMINI~1.JOS\LOCALS~1\Temp\~DFDF51.tmp Object is locked skipped C:\DOCUME~1\ADMINI~1.JOS\LOCALS~1\Temp\~DFE8C7.tmp Object is locked skipped C:\DOCUME~1\ADMINI~1.JOS\LOCALS~1\Temp\~DFE912.tmp Object is locked skipped Scan process completed. And Combofix was: ComboFix 07-08-08 - "Administrator" 2007-08-08 13:00:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2561 [GMT -7:00] Command switches used :: C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Desktop\CFScript.txt * Created a new restore point FILE:: C:\dnsbak.reg C:\WINDOWS\system32\drvsuw.dll C:\WINDOWS\system32\drvbig.dll C:\WINDOWS\system32\esranlok.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\dnsbak.reg C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1226413427.mtj&p2=1&p3=16706501115576471129431327264977&p4=50463258 C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1241215004.mtx C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-663147969.mtj&p2=1&p3=16706501115576471129431327264977&p4=0 C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1233786184.mtx C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1355542221.mts C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\2096374885.mtj&p2=1&p3=16706501115576471129431327264977&p4=50463258 C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1929299903.mtj&p2=1&p3=16706501115576471129431327264977&p4=50463258 C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ViewPoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx C:\Program Files\thriXXX C:\Program Files\thriXXX\3D SexVilla\Binaries\JasPer License.txt C:\Program Files\thriXXX\3D SexVilla\Binaries\LibPNG License.txt C:\Program Files\thriXXX\3D SexVilla\Binaries\msvcp71.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\msvcr71.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\ogg.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\OggVorbis Copying.txt C:\Program Files\thriXXX\3D SexVilla\Binaries\OpenAL32.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\OpenSSL License.txt C:\Program Files\thriXXX\3D SexVilla\Binaries\thriXXX.ico C:\Program Files\thriXXX\3D SexVilla\Binaries\vorbis.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\vorbisfile.dll C:\Program Files\thriXXX\3D SexVilla\Binaries\zlib License.txt C:\Program Files\thriXXX\3D SexVilla\Logs\3DSexVilla.log C:\Program Files\thriXXX\3D SexVilla\Save\Config.cc C:\Program Files\thriXXX\3D SexVilla\Save\Person09Brain1.ai C:\Program Files\thriXXX\3D SexVilla\Save\Person09Customize1.cc C:\Program Files\thriXXX\3D SexVilla\Save\Person09Customize1.cf C:\Program Files\thriXXX\3D SexVilla\Save\Person10Customize1.cc C:\Program Files\thriXXX\3D SexVilla\Save\Person10Customize1.cf C:\VundoFix Backups C:\VundoFix Backups\awvts.dll.bad C:\VundoFix Backups\cdeeg.bak1.bad C:\VundoFix Backups\cdeeg.ini.bad C:\VundoFix Backups\mhnqulit.exe.bad C:\VundoFix Backups\stvwa.bak1.bad C:\VundoFix Backups\stvwa.bak2.bad C:\VundoFix Backups\stvwa.ini.bad C:\WINDOWS\system32\drvbig.dll C:\WINDOWS\system32\drvsuw.dll C:\WINDOWS\system32\esranlok.dll ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 ))))))))))))))))))))))))))))))) 2007-08-08 09:32 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-07 22:49 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-06 12:49 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Oxin's Style! 2007-08-06 10:51 <DIR> d-------- C:\Program Files\FlashFXP 2007-08-06 10:51 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\FlashFXP 2007-08-06 10:13 6,372 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg 2007-07-28 09:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy 2007-07-27 15:59 <DIR> d-------- C:\ProgramData 2007-07-27 15:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Google 2007-07-27 15:36 <DIR> d-------- C:\Program Files\Google 2007-07-27 09:24 <DIR> d-------- C:\Program Files\Windows Defender 2007-07-26 18:13 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\Opera 2007-07-26 18:10 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\uTorrent 2007-07-26 17:50 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\vlc 2007-07-26 16:32 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-07-26 16:31 1,572,864 --ah----- C:\DOCUME~1\Blackie\NTUSER.DAT 2007-07-26 16:30 <DIR> dr------- C:\Program Files\Aston 2007-07-26 08:55 1,933,312 --a------ C:\WINDOWS\system32\cdintf250.dll 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Quicken 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Palo Alto Software 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Intuit 2007-07-26 08:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Intuit 2007-07-26 08:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Intuit 2007-07-23 06:25 <DIR> d-------- C:\Program Files\Last.fm 2007-07-22 13:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\dvdcss 2007-07-21 22:34 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-07-21 22:34 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-07-21 22:34 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-07-21 22:34 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-07-21 15:08 <DIR> d-------- C:\Program Files\iTunes 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Apple Software Update 2007-07-21 15:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple 2007-07-17 19:13 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-07-17 19:10 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-07-17 19:10 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-17 19:10 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-07-17 19:10 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-07-17 19:10 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-17 19:10 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-07-17 19:10 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-17 19:10 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-07-17 19:10 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-16 19:20 2,192,640 --a------ C:\WINDOWS\system32\kernel1.exe 2007-07-16 19:06 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-07-16 14:55 24,192 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermptxp.sys 2007-07-16 14:55 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys 2007-07-16 14:55 22,768 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermpt.sys 2007-07-13 11:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Help 2007-07-10 16:51 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-08 04:16 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\uTorrent 2007-08-06 10:13 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-30 18:46 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-07-27 15:32 --------- d-------- C:\Program Files\Microsoft IntelliType Pro 2007-07-27 09:29 --------- d-------- C:\Program Files\Opera 2007-07-26 18:25 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-07-26 18:25 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-26 16:07 --------- d-------- C:\Program Files\The All-Seeing Eye 2007-07-24 21:58 --------- d-------- C:\Program Files\uTorrent 2007-07-21 15:34 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Apple Computer 2007-07-21 15:08 --------- d-------- C:\Program Files\iPod 2007-07-21 15:07 --------- d-------- C:\Program Files\QuickTime 2007-07-21 14:11 --------- d-------- C:\Program Files\Winamp 2007-07-20 08:40 1809 --a------ C:\WINDOWS\mozver.dat 2007-07-16 14:56 --------- d-------- C:\Program Files\Motorola Phone Tools 2007-07-16 14:56 --------- d-------- C:\Program Files\Avanquest update 2007-07-06 22:14 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-05 22:10 --------- d-------- C:\Program Files\BitLord2 2007-07-05 15:26 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\InstallShield 2007-07-01 08:36 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SlySoft 2007-06-30 23:17 --------- d-------- C:\Program Files\CloneDVD 2007-06-30 23:16 14 --a------ C:\WINDOWS\system32\systeminfo3.dll 2007-06-30 23:15 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Vso 2007-06-30 23:14 81920 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ezpinst.exe 2007-06-30 23:14 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-06-30 23:14 47360 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\pcouffin.sys 2007-06-30 23:09 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys 2007-06-30 23:09 34308 --a------ C:\WINDOWS\system32\Chip.dll 2007-06-30 21:56 --------- d-------- C:\Program Files\Common Files\AOL 2007-06-30 21:56 --------- d-------- C:\Program Files\AIM6 2007-06-28 19:58 --------- d-------- C:\Program Files\HP 2007-06-27 03:00 --------- d-------- C:\Program Files\MSXML 4.0 2007-06-27 03:00 --------- d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-06-26 16:01 --------- d-------- C:\Program Files\Hewlett-Packard 2007-06-26 00:08 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Opera 2007-06-25 23:23 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-06-25 22:05 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SecondLife 2007-06-25 21:16 --------- d-------- C:\Program Files\SecondLife 2007-06-25 21:04 499712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-06-22 06:54 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys.bak 2007-06-20 14:08 93128 --a------ C:\WINDOWS\system32\ElbyCDIO.dll 2007-06-11 09:38 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Aston 2007-06-10 22:09 --------- d-------- C:\Program Files\Windows Live 2007-06-03 08:17 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-06-01 08:20 51568 --a------ C:\WINDOWS\system32\sirenacm.dll 2007-05-20 18:11 291 --a------ C:\WINDOWS\PowerReg.dat 2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2001-01-11 16:02 794624 --a------ C:\WINDOWS\inf\OTHER\audio3d.dll (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ---- Directory of C:\ProgramData ---- 2007-07-27 16:00 37224 --a------ C:\ProgramData\Electronic Arts\EA Link\cache\logs\Core.html ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26] "nwiz"="nwiz.exe" [] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 07:57] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-05-20 03:13] "C-Media Mixer"="Mixer.exe" [2001-10-22 18:24 C:\WINDOWS\mixer.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 07:46] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] "itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-06-01 08:21] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 11:31] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-23 06:25:21] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magicantispy] C:\Program Files\Magicantispy\Magicantispy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "odserv"=3 (0x3) "NBService"=3 (0x3) "Microsoft Office Groove Audit Service"=3 (0x3) "iPod Service"=3 (0x3) R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\system32\drivers\cmaudio.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys S3 PnkBstrK;PnkBstrK;\??\C:\WINDOWS\system32\drivers\PnkBstrK.sys S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys S3 usbsermpt;Motorola USB Modem Driver for MPT;C:\WINDOWS\system32\DRIVERS\usbsermpt.sys S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" S4 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" Contents of the 'Scheduled Tasks' folder 2007-08-03 15:58:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-07-27 22:58:21 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job - C:\Program Files\Microsoft IntelliType Pro\itype.exe 2007-08-08 17:46:03 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-08 13  32Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... C:\WINDOWS\QTFont.for C:\WINDOWS\QTFont.qfn scan completed successfully hidden files: 2 ************************************************************************** Completion time: 2007-08-08 13:08:54 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-08 13:08 C:\ComboFix2.txt ... 2007-08-08 09:45 --- E O F --- |
|
|
|
|
08-08-2007, 03:06 PM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,353
OS: N/A
|
Re: HJT Help with everything from spyware to "antispyware"
 Your Kaspersky results conflicts with my expectations. Did you do a standard scan as opposed to an extended scan? I expected it to at least have found some stuff
__________________
Question - what have you done for the community today? |
|
|
|
|
08-08-2007, 03:22 PM
|
#9 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 10
OS: Win XP
|
Re: HJT Help with everything from spyware to "antispyware"
Oh sorry i'm retarded. I only scanned "critical areas" not "my computer". It's scanning my computer right now again though. Thanks alot for all your help!
|
|
|
|
|
08-08-2007, 07:19 PM
|
#10 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 10
OS: Win XP
|
Re: HJT Help with everything from spyware to "antispyware"
Kaspersky:
KASPERSKY ONLINE SCANNER REPORT Wednesday, August 08, 2007 6:19:13 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 9/08/2007 Kaspersky Anti-Virus database records: 377274 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan Statistics Total number of scanned objects 246564 Number of viruses found 16 Number of infected objects 141 Number of suspicious objects 0 Duration of the scan process 03:54:49 Infected Object Name Virus Name Last Action C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\cert8.db Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\history.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\key3.db Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\parent.lock Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\search.sqlite Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Ahead\Nero Home\bl.db-journal Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Ahead\Nero Home\is2.db-journal Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Last.fm\Client\lastfmhelper.log Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{EE9B98F1-2467-4EFB-A4E4-138983A794D8} Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Windows Live Contacts\blackie987@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Microsoft\Windows Live Contacts\blackie987@hotmail.com\shadow\members.stg Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Application Data\Mozilla\Firefox\Profiles\sk2dz13b.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\History\History.IE5\MSHist012007080820070809\index.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temp\~DFDF29.tmp Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temp\~DFDF51.tmp Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temp\~DFE8C7.tmp Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temp\~DFE912.tmp Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\My Received Files\MsnMsgr.txt Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe WiseSFX: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe WiseSFX Dropper: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe WiseSFX: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe WiseSFX Dropper: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe WiseSFX: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe WiseSFX Dropper: infected - 3 skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Windows Defender\Support\MPLog-07272007-092455.log Object is locked skipped C:\Documents and Settings\Blackie\Local Settings\Temp\6432.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temp\hsperfdata_Blackie\3724 Object is locked skipped C:\Documents and Settings\Blackie\Local Settings\Temp\looksyn.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temp\server16.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temp\sv32.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temp\svlook.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\54OWUZBN\ucleaner_setup[1].exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\B3OCUEHM\hlpsrv[1].exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\TFDZ2HDA\adfcook[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe/WISE0019.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe WiseSFX: infected - 3 skipped C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe WiseSFX Dropper: infected - 3 skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\QooBox\Quarantine\C\VundoFix Backups\awvts.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.lc skipped C:\QooBox\Quarantine\C\VundoFix Backups\mhnqulit.exe.bad.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\mgrs.exe.vir Infected: Trojan-Downloader.Win32.Alphabet.p skipped C:\QooBox\Quarantine\C\WINDOWS\system32\asomjkuw.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\atkeyqfe.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\drvbig.dll.vir Infected: Trojan.Win32.Agent.qt skipped C:\QooBox\Quarantine\C\WINDOWS\system32\drvsuw.dll.vir Infected: Trojan.Win32.Agent.qt skipped C:\QooBox\Quarantine\C\WINDOWS\system32\esranlok.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\fkfqahfr.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gydutoul.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\hlpsrv.exe.vir Infected: Trojan-Clicker.Win32.Small.mv skipped C:\QooBox\Quarantine\C\WINDOWS\system32\honmdutd.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ifkqjqtu.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jjmmxulg.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\kyaybqck.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\lfcyheqq.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\lxbktlnl.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mwtjbmhu.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ooqbcqov.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\primrpcf.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ptxhelpn.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qahjdwxg.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qnexnohc.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qqtgcwpb.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\rcofcwmo.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\tdfqolik.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\urqpmjh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.io skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winlgj32.dll.vir Infected: Trojan.Win32.Dialer.qn skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wiypieuw.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\xnrufalq.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\xxojhyvj.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\yayyvvs.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\yuqktrds.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\QooBox\Quarantine\catchme2007-08-08_ 94221.62.zip/gebbcyx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\catchme2007-08-08_ 94221.62.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025594.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025594.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025594.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025594.exe WiseSFX: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025594.exe WiseSFX Dropper: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025595.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025595.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025595.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025595.exe WiseSFX: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025595.exe WiseSFX Dropper: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025596.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025596.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025596.exe/WISE0020.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025596.exe WiseSFX: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP131\A0025596.exe WiseSFX Dropper: infected - 3 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP139\A0025887.exe Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP140\A0025913.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lc skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP140\A0025914.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP140\A0025916.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP141\A0025939.exe Infected: Trojan-Downloader.Win32.Alphabet.h skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP145\A0026915.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP145\A0026916.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP145\A0026917.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0027059.exe Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0027916.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0027924.exe Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0027928.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0028915.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0028925.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP148\A0028932.exe Infected: Trojan-Downloader.Win32.Alphabet.p skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP151\A0029977.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP152\A0030933.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP152\A0030934.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP157\A0031126.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.bxy skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP157\A0031126.exe/stream Infected: Trojan-Downloader.Win32.Zlob.bxy skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP157\A0031126.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP157\A0031943.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP157\A0031947.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP158\A0031950.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP159\A0031981.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP159\A0031982.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP159\A0031986.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP159\A0033067.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP160\A0033963.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0033998.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0033999.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034000.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034001.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034002.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034003.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034004.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034005.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034006.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034007.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034008.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034009.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034010.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034011.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034013.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.io skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034015.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034016.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034017.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034018.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034019.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034020.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034021.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034022.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034023.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034024.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034025.dll Infected: Trojan.Win32.Dialer.qn skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034029.exe Infected: Trojan-Downloader.Win32.Alphabet.p skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034030.exe Infected: Trojan-Clicker.Win32.Small.mv skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034037.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP162\A0034047.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\A0035105.dll Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\A0035106.dll Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\A0035107.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped C:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd9613.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\temp\TMP0000003C154F596ADFEE1352 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\change.log Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\change.log Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\_restore{095311A3-F356-46E6-A46B-1B1D24A0D7B5}\RP163\change.log Object is locked skipped Scan process completed. |
|
|
|
|
08-08-2007, 07:29 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,353
OS: N/A
|
Re: HJT Help with everything from spyware to "antispyware"
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179873.exe"
"C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179894.exe"
"C:\Documents and Settings\Administrator.JOSHUA-DA02C4CB\My Documents\Webloads\179919.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temp\6432.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temp\looksyn.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temp\server16.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temp\sv32.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temp\svlook.exe"
"C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\54OWUZBN\ucleaner_setup[1].exe"
"C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\B3OCUEHM\hlpsrv[1].exe"
"C:\Documents and Settings\Blackie\Local Settings\Temporary Internet Files\Content.IE5\TFDZ2HDA\adfcook[1]"
"C:\Documents and Settings\Joshua\Local Settings\Temporary Internet Files\Content.IE5\DYBIIB48\14410[1].exe"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
08-08-2007, 10:03 PM
|
#14 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,353
OS: N/A
|
Re: HJT Help with everything from spyware to "antispyware"
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
