|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-09-2007, 09:38 AM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file included
I'm not exactly sure how I knew I was infected. I believe it started yesterday with a popup from WinAntiSpyware2006. See, I had become complacent. I hadn't run Ad-aware nor spybot in months, because I had spywareblaster installed and felt I was a safe internet user. However, I have let others use my computer recently. Needless to say, my carelessness got me infected. Right away when I saw there was an issue, I ran spybot, which removed a number of things (webbuyingassistant, virtumonde, etc). However, it couldn't remove everything, not even after start up. I also ran ad-aware which removed some more stuff. But I am still having popup issues. This morning when I ran spybot, it couldn't remove drivecleaner2006. And now I am getting popups for some BlackSingles dating site and errorsafe.com. I tried to run the panda online scan, but the scanner crashed right at the very end (or rather the whole system froze up due to internet explorer popups that I had to force quit). Anyway, on to the log:
Deckard's System Scanner v20070807.62 Run by Andrew on 2007-08-09 at 12:15:10 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 18: 2007-08-09 16:15:13 UTC - RP793 - Deckard's System Scanner Restore Point 17: 2007-08-09 15:03:32 UTC - RP792 - Removed WexTech AnswerWorks 16: 2007-08-09 14:53:57 UTC - RP791 - Spybot-S&D Spyware removal 15: 2007-08-08 18:19:51 UTC - RP790 - Spybot-S&D Spyware removal 14: 2007-08-08 17:43:22 UTC - RP789 - Spybot-S&D Spyware removal -- First Restore Point -- 1: 2007-07-17 17:16:05 UTC - RP776 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive C: has 1.23 GiB (less than 15%) free. -- HijackThis (run as Andrew.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:07:12 AM, on 8/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\WINDOWS\system32\RevoTask.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Windows NT\hotyge22011.exe C:\WINDOWS\afbtsukA.exe C:\PROGRA~1\COMMON~1\PPATCH~1\mshta.exe C:\WINDOWS\?dobe\l?***.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe C:\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R3 - Default URLSearchHook is missing O1 - Hosts: 62.75.224.159 www.bns1.net O1 - Hosts: 62.75.224.159 www.bns2.net O1 - Hosts: 62.75.224.159 www.bns3.net O1 - Hosts: 62.75.224.159 www.bns4.net O1 - Hosts: 62.75.224.159 www.bns5.net O1 - Hosts: 62.75.224.159 www.bns6.net O1 - Hosts: 62.75.224.159 www.bns7.net O1 - Hosts: 62.75.224.159 www.bns8.net O1 - Hosts: 62.75.224.159 www.cms1.net O1 - Hosts: 62.75.224.159 www.cms2.net O1 - Hosts: 62.75.224.159 www.cms3.net O1 - Hosts: 62.75.224.159 www.cms4.net O1 - Hosts: 62.75.224.159 www.cms5.net O1 - Hosts: 62.75.224.159 www.cms6.net O1 - Hosts: 62.75.224.159 www.cms7.net O1 - Hosts: 62.75.224.159 www.cms8.net O1 - Hosts: 62.75.224.159 www.rg1.com O1 - Hosts: 62.75.224.159 www.rg2.com O1 - Hosts: 62.75.224.159 www.rg3.com O1 - Hosts: 62.75.224.159 www.rg4.com O1 - Hosts: 62.75.224.159 www.rg5.com O1 - Hosts: 62.75.224.159 www.rg6.com O1 - Hosts: 62.75.224.159 www.rg7.com O1 - Hosts: 62.75.224.159 www.rg8.com O1 - Hosts: 62.75.224.159 jcms.cydoor.com O1 - Hosts: 62.75.224.159 cydoor.com O1 - Hosts: 62.75.224.159 jnova.cjt1.net O1 - Hosts: 62.75.224.159 jcontent.bns1.m7z.net O1 - Hosts: 62.75.224.159 j.2004CMS.com O1 - Hosts: 62.75.224.159 2004CMS.com O1 - Hosts: 62.75.224.159 bns1.m7z.net O1 - Hosts: 62.75.224.159 m7z.net O1 - Hosts: 62.75.224.159 jcontent.bns1.net O1 - Hosts: 62.75.224.159 jbns2.cydoor.com O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\system32\RevoTask.exe O4 - HKLM\..\Run: [mp3infp] "C:\Program Files\mp3infp\mp3infp_regist.exe" O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [hotyge] C:\Program Files\Windows NT\hotyge22011.exe O4 - HKLM\..\Run: [{E1-18-8E-E2-ZN}] C:\DOCUME~1\Andrew\LOCALS~1\Temp\thinksnet.exe CHD003 O4 - HKLM\..\Run: [afbtsukA] C:\WINDOWS\afbtsukA.exe O4 - HKLM\..\Run: [{ZN}] C:\WINDOWS\TISKY009.exe SKY009 O4 - HKLM\..\RunOnce: [SpybotDeletingA6798] command /c del "C:\WINDOWS\system32\ldcore.dll_tobedeleted_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC2021] cmd /c del "C:\WINDOWS\system32\ldcore.dll_tobedeleted_old" O4 - HKLM\..\RunOnce: [SpybotDeletingA8675] command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun6.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC5120] cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun6.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingA1625] command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun5.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC6883] cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun5.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingA7497] command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun4.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC241] cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun4.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingA126] command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun3.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC3392] cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun3.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingA2974] command /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun3.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC2734] cmd /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun3.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingA550] command /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun2.exe_tobedeleted" O4 - HKLM\..\RunOnce: [SpybotDeletingC5028] cmd /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun2.exe_tobedeleted" O4 - HKCU\..\Run: [Eomu] "C:\PROGRA~1\COMMON~1\PPATCH~1\mshta.exe" -vt yazb O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.1\webbuying.exe O4 - HKCU\..\Run: [Vcle] C:\WINDOWS\?dobe\l?***.exe O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe O4 - Startup: TA_Start.lnk = C:\WINDOWS\TISKY009.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\prohdy.html -- End of file - 9604 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 IFPUSB (iriver Internet Audio Player IFP-100) - c:\windows\system32\drivers\ifpusb.sys <Not Verified; iRiver, Inc.; IFP-100> R0 Vax347b - c:\windows\system32\drivers\vax347b.sys R0 Vax347s - c:\windows\system32\drivers\vax347s.sys R1 mbmiodrvr - c:\windows\system32\mbmiodrvr.sys <Not Verified; cansoft@livewiredev.com; Windows (R) 2000 DDK driver> R3 REVO (Service for Revo Driver (WDM)) - c:\windows\system32\drivers\revo.sys <Not Verified; Midiman/M-Audio; M-Audio Revo WDM Driver> R3 REVOSENS - c:\windows\system32\drivers\revosens.sys <Not Verified; Sensaura Ltd; > S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Diskeeper - "c:\program files\executive software\diskeeper\dkservice.exe" <Not Verified; Executive Software International, Inc.; Diskeeper (TM) Disk Defragmenter> R2 DomainService - c:\windows\system32\apuuhtya.exe /service <Not Verified; ; DDC> S2 Net Agent - c:\windows\dls0523pmw.exe S3 Adobe Version Cue CS2 - "c:\program files\adobe\adobe version cue cs2\bin\versioncuecs2.exe" -win32service <Not Verified; Adobe Systems Incorporated; Adobe Version Cue CS2> S4 ATMsrvc (ATM Service) - c:\windows\system32\atmsrvc.exe <Not Verified; Adobe Systems Incorporated; Adobe Type Manager> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} Description: VIA OHCI Compliant IEEE 1394 Host Controller Device ID: PCI\VEN_1106&DEV_3044&SUBSYS_808A1043&REV_80\3&267A616A&0&38 Manufacturer: VIA Name: VIA OHCI Compliant IEEE 1394 Host Controller PNP Device ID: PCI\VEN_1106&DEV_3044&SUBSYS_808A1043&REV_80\3&267A616A&0&38 Service: ohci1394 Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: RAID Controller Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78 Manufacturer: Name: RAID Controller PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78 Service: Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318} Description: Printer Port Device ID: ACPI\PNP0400\1 Manufacturer: (Standard port types) Name: Printer Port (LPT1) PNP Device ID: ACPI\PNP0400\1 Service: Parport Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318} Description: Communications Port Device ID: ACPI\PNP0501\2 Manufacturer: (Standard port types) Name: Communications Port (COM2) PNP Device ID: ACPI\PNP0501\2 Service: Serial Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318} Description: Communications Port Device ID: ACPI\PNP0501\1 Manufacturer: (Standard port types) Name: Communications Port (COM1) PNP Device ID: ACPI\PNP0501\1 Service: Serial -- Files created between 2007-07-09 and 2007-08-09 ----------------------------- 2007-08-09 12:11:31 21312 --a------ C:\WINDOWS\choice.exe 2007-08-09 12:10:14 0 d-------- C:\ie-spyad 2007-08-09 12:04:51 125504 --a------ C:\WINDOWS\system32\vxmfbmgw.dll 2007-08-09 11:43:34 69184 --a------ C:\WINDOWS\system32\jpsohovp.dll 2007-08-09 11:40:20 4672 --a------ C:\WINDOWS\system32\fiouqsdq.exe 2007-08-09 11:40:16 75328 --a------ C:\WINDOWS\system32\apuuhtya.exe <Not Verified; ; DDC> 2007-08-09 11:40:13 4672 --a------ C:\WINDOWS\system32\mxcruehm.exe 2007-08-09 11:38:09 1757076 ---hs---- C:\WINDOWS\system32\mlkkj.bak2 2007-08-09 11:17:39 0 d-------- C:\WINDOWS\LastGood 2007-08-09 11:06:25 0 d-------- C:\hijackthis 2007-08-09 10:36:47 34816 --a------ C:\WINDOWS\rau001978.exe 2007-08-08 14:23:02 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-08-08 14:23:01 0 d-------- C:\Documents and Settings\NetworkService\Desktop 2007-08-08 14:22:58 6689 --a------ C:\WINDOWS\system32\ldcore.dll 2007-08-08 14:22:58 9769 --a------ C:\WINDOWS\hrgvx0578.exe 2007-08-08 13:08:43 0 d-------- C:\Documents and Settings\Andrew\Application Data\WinAntiSpyware 2007 2007-08-08 13:07:08 0 dr------- C:\Documents and Settings\All Users\Application Data\SalesMonitor 2007-08-08 13:07:06 79872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys <Not Verified; Windows (R) Codename Longhorn DDK provider; Windows (R) Codename Longhorn DDK driver> 2007-08-08 13:06:52 0 d-------- C:\Program Files\Common Files\WinAntiSpyware 2007 2007-08-08 13:06:49 0 d-------- C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007 2007-08-08 13:05:43 6421 ---hs---- C:\WINDOWS\system32\mlkkj.bak1 2007-08-08 13:05:30 31254 --a------ C:\WINDOWS\system32\ddcyvtu.dll 2007-08-08 13:05:19 231520 --a------ C:\WINDOWS\system32\jkklm.dll 2007-08-08 13:00:26 135168 --a------ C:\WINDOWS\tk58.exe 2007-08-08 13:00:25 2 --a------ C:\WINDOWS\system32\wnstsisv.exe 2007-08-08 13:00:23 0 d-------- C:\WINDOWS\?dobe 2007-08-08 13:00:23 60928 --a------ C:\WINDOWS\system32\magoqwgv.dll 2007-08-08 13:00:23 0 d-------- C:\Program Files\Outerinfo 2007-08-08 13:00:21 65536 --a------ C:\WINDOWS\dls0523pmw.exe 2007-08-08 13:00:21 776352 -r-hs---- C:\WINDOWS\afbtsukA.exe <Not Verified; System Service; System Monitor Service> 2007-08-08 13:00:20 54784 --a------ C:\WINDOWS\afbtsuk.exe 2007-08-08 13:00:19 49152 --a------ C:\WINDOWS\TISKY009.exe 2007-08-08 13:00:18 31254 --a------ C:\WINDOWS\system32\vturpqp.dll 2007-08-08 13:00:18 171520 --a------ C:\WINDOWS\system32\ccaoasc.dll 2007-08-08 13:00:17 0 d-------- C:\WINDOWS\system32\Y2 2007-08-08 13:00:17 0 d-------- C:\WINDOWS\system32\Y1 2007-08-08 13:00:17 0 d-------- C:\WINDOWS\system32\win 2007-08-08 13:00:17 0 d-------- C:\WINDOWS\system32\driver 2007-08-08 13:00:17 0 d-------- C:\WINDOWS\system32\B1 2007-08-08 13:00:16 0 d-------- C:\Program Files\Common Files\??pPatch 2007-08-08 13:00:15 0 d-------- C:\WINDOWS\system32\f02WtR 2007-08-08 13:00:14 31254 --a------ C:\WINDOWS\system32\opnmjkj.dll 2007-08-03 12:57:00 0 d-------- C:\Program Files\CDCheck 2007-07-20 14:27:42 0 d-------- C:\Program Files\CKM 2007-07-17 11:27:12 56320 --a------ C:\WINDOWS\b122.exe -- Find3M Report --------------------------------------------------------------- 2007-08-09 12:08:19 0 d-------- C:\Program Files\SpywareBlaster 2007-08-09 12:03:02 0 d-------- C:\Program Files\xnews 2007-08-09 11:03:33 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-08-09 11:03:33 0 d-------- C:\Program Files\Common Files 2007-08-08 14:29:24 0 d-------- C:\Program Files\MSN Gaming Zone 2007-08-08 13:00:20 0 d-------- C:\Program Files\Windows NT 2007-08-08 13:00:16 0 d-------- C:\Program Files\Common Files\??pPatch 2007-08-08 12:18:01 0 d-------- C:\Documents and Settings\Andrew\Application Data\Adobe 2007-07-13 14:49:25 0 d-------- C:\Program Files\mIRC 2007-06-22 12:03:20 0 d-------- C:\Program Files\WhereIsMySpace 2007-05-28 11:17:32 4 --a------ C:\WINDOWS\uccspecb.sys 2007-05-28 11:17:28 5519 --a------ C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CAC8391-685C-4CFE-2D72-39B60338FFEA}] 08/01/2007 09:43 AM 60928 --a------ C:\WINDOWS\system32\magoqwgv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D7360D4-F326-4A27-A033-F8E7C0A516CE}] 08/08/2007 01:05 PM 231520 --a------ C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ee649e-d494-4668-9376-d0cf68d0de87}] 08/08/2007 01:00 PM 171520 --a------ C:\WINDOWS\system32\ccaoasc.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1}] 08/09/2007 11:43 AM 69184 --a------ C:\WINDOWS\system32\jpsohovp.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9BD0828-1FD9-410C-A50F-43EBE65D310F}] 08/08/2007 01:00 PM 31254 --a------ C:\WINDOWS\system32\opnmjkj.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PtiuPbmd"="ptipbm.dll" [01/15/2003 03:41 PM C:\WINDOWS\system32\ptipbm.dll] "EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [12/20/2001 09:42 AM] "RevoTaskbarApp"="C:\WINDOWS\system32\RevoTask.exe" [04/20/2005 02:44 PM] "mp3infp"="C:\Program Files\mp3infp\mp3infp_regist.exe" [04/25/2005 11:14 AM] "Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [04/04/2005 06:58 PM] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [01/12/2006 09:52 PM] "hotyge"="C:\Program Files\Windows NT\hotyge22011.exe" [08/07/2007 04:30 PM] "{E1-18-8E-E2-ZN}"="C:\DOCUME~1\Andrew\LOCALS~1\Temp\thinksnet.exe" [] "afbtsukA"="C:\WINDOWS\afbtsukA.exe" [12/12/1989 10:10 AM] "{ZN}"="C:\WINDOWS\TISKY009.exe" [08/08/2007 01:00 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [11/04/2005 02:04 PM] "SystemOptimizer"="C:\WINDOWS\system32\vxmfbmgw.dll" [08/09/2007 12:04 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Eomu"="C:\PROGRA~1\COMMON~1\PPATCH~1\mshta.exe" [08/08/2007 01:00 PM] "WebBuying"="C:\Program Files\Web Buying\v1.8.1\webbuying.exe" [] "Vcle"="C:\WINDOWS\?dobe\l?***.exe" [08/01/2007 09:44 AM] "WinPop"="C:\Program Files\WinPop\winpop.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "SpybotDeletingA6798"=command /c del "C:\WINDOWS\system32\ldcore.dll_tobedeleted_old" "SpybotDeletingC2021"=cmd /c del "C:\WINDOWS\system32\ldcore.dll_tobedeleted_old" "SpybotDeletingA8675"=command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun6.exe_tobedeleted" "SpybotDeletingC5120"=cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun6.exe_tobedeleted" "SpybotDeletingA1625"=command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun5.exe_tobedeleted" "SpybotDeletingC6883"=cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun5.exe_tobedeleted" "SpybotDeletingA7497"=command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun4.exe_tobedeleted" "SpybotDeletingC241"=cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun4.exe_tobedeleted" "SpybotDeletingA126"=command /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun3.exe_tobedeleted" "SpybotDeletingC3392"=cmd /c del "C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun3.exe_tobedeleted" "SpybotDeletingA2974"=command /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun3.exe_tobedeleted" "SpybotDeletingC2734"=cmd /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun3.exe_tobedeleted" "SpybotDeletingA550"=command /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun2.exe_tobedeleted" "SpybotDeletingC5028"=cmd /c del "C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun2.exe_tobedeleted" C:\Documents and Settings\Andrew\Start Menu\Programs\Startup\ TA_Start.lnk - C:\WINDOWS\TISKY009.exe [8/8/2007 1:00:19 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [8/20/2005 5:03:16 PM] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/19/2004 1:21:20 PM] Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/19/2004 1:21:20 PM] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\MSN Gaming Zone\prohdy.html FriendlyName= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"= C:\WINDOWS\system32\opnmjkj.dll [08/08/2007 01:00 PM 31254] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkklm] C:\WINDOWS\system32\jkklm.dll 08/08/2007 01:05 PM 231520 C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmjkj] opnmjkj.dll 08/08/2007 01:00 PM 31254 C:\WINDOWS\system32\opnmjkj.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"= c:\windows\system32\ldcore.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Andrew\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo PopUpBlocker] C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iRiver Updater] \Updater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Ati HotKey Poller"=2 (0x2) *Newly Created Service* - DOMAINSERVICE -- Hosts ----------------------------------------------------------------------- 127.0.0.1 ads.web.aol.com 127.0.0.1 ar.atwola.com 127.0.0.1 101order.com 127.0.0.1 123banners.com 127.0.0.1 123found.com 127.0.0.1 180solutions.com 127.0.0.1 247media.com 127.0.0.1 24pm-affiliation.com 127.0.0.1 2o7.net 127.0.0.1 4affiliate.net 1443 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-08-09 at 12:23:04 --------- |
|
     |
| Sponsored Links |
|
08-09-2007, 10:52 PM
|
#2 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,242
OS: N/A
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Quote:
1. Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe * IMPORTANT !!! Place combofix.exe on your Desktop  2. Go to  → Run → paste in the single line command & click OK"%userprofile%\desktop\combofix.exe" /killall3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
|
|
|
|
|
|
08-10-2007, 09:30 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Ok, first of all, thank you very much for your reply. I'll tell you that what I did last night was look at the about.com help page on reviewing hijackthis logs, and I ended up clicking for hijack this to fix all the 01-hosts listed, and maybe a few other items. However, when I started the computer today, I had spyware worse than ever before. In fact, I got a blue screen of death due to all the programs loading (sorry, didn't record the message). Also, I was locked out of the task manager (ctl - alt - del). On my next reboot (and after unplugging the internet) I was able to restore task manager control with "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f" and I forced quit all sorts of junk. I had programs installing on their own (something with the initials BS). Anyway, all that said and done, I was able to get online and read this reply. First time I tried combofix, I got a blue screen saying "KERNAL_STACK_INPAGE_ERROR". I reset the computer and tried again, this time I had errors popping up in the tray saying that "cmd.exe" was corrupt and "explorer.exe" was corrupt in system volume info/_restore.../change.log. Anyway, after a bit, combofix.exe restarted and checkdisk ran, and I was able to get a log report. It is included below, as is the most recent hijack this. Thanks again for your help thusfar.
Combofix log: ComboFix 07-08-10.8 - "Andrew" 2007-08-10 12:01:01.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.745 [GMT -4:00] Command switches used :: /killall ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\All Users.\documents\settings C:\Documents and Settings\All Users.\documents\settings\desktop.ini C:\Documents and Settings\All Users.\documents\settings\partnership.dll C:\Temp\fse C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\WINDOWS\system32\ijkmp.bak1 C:\WINDOWS\system32\ijkmp.ini C:\WINDOWS\system32\jkklm.dll C:\WINDOWS\system32\ldcore.dll C:\WINDOWS\system32\opnmjkj.dll C:\WINDOWS\system32\pmkji.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CORE -------\LEGACY_DOMAINSERVICE -------\LEGACY_FOPN -------\LEGACY_NET_AGENT -------\core -------\DomainService -------\Net Agent ((((((((((((((((((((((((( Files Created from 2007-07-10 to 2007-08-10 ))))))))))))))))))))))))))))))) 2007-08-10 11:49 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-10 11:41 75,328 --a------ C:\WINDOWS\system32\ohrchbhm.exe 2007-08-10 11:32 30,770 --a------ C:\WINDOWS\system32\is67718.exe 2007-08-10 11:32 169,147 --a------ C:\WINDOWS\TTC-5555.exe 2007-08-10 11:32 135,168 --a------ C:\WINDOWS\tk68.exe 2007-08-10 11:31 86,056 --a------ C:\WINDOWS\system32\install.exe 2007-08-10 11:31 8,782 --a------ C:\WINDOWS\system32\waverevenue.exe 2007-08-10 11:31 67,584 --a------ C:\WINDOWS\system32\l3acdb.dll 2007-08-10 11:31 115,606 --a------ C:\WINDOWS\system32\skna455101.exe 2007-08-09 12:15 <DIR> d-------- C:\Deckard 2007-08-09 12:11 21,312 --a------ C:\WINDOWS\choice.exe 2007-08-09 12:10 <DIR> d-------- C:\ie-spyad 2007-08-09 11:40 75,328 --a------ C:\WINDOWS\system32\apuuhtya.exe 2007-08-09 11:06 <DIR> d-------- C:\hijackthis 2007-08-03 12:57 <DIR> d-------- C:\Program Files\CDCheck 2007-07-20 14:27 <DIR> d-------- C:\Program Files\CKM (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-10 11:55 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-08-10 11:32 639 --a------ C:\WINDOWS\system32\drivers\star.gif 2007-08-10 11:32 550 --a------ C:\WINDOWS\system32\drivers\star_small.gif 2007-08-10 11:32 49 --a------ C:\WINDOWS\system32\drivers\spacer.gif 2007-08-10 11:32 425 --a------ C:\WINDOWS\system32\drivers\star_gray.gif 2007-08-10 11:32 3877 --a------ C:\WINDOWS\system32\drivers\warning_icon.gif 2007-08-10 11:32 291 --a------ C:\WINDOWS\system32\drivers\v.gif 2007-08-10 11:32 283 --a------ C:\WINDOWS\system32\drivers\x.gif 2007-08-10 11:32 223 --a------ C:\WINDOWS\system32\drivers\star_gray_small.gif 2007-08-10 11:32 2090 --a------ C:\WINDOWS\system32\drivers\shadow.jpg 2007-08-10 11:32 1791 --a------ C:\WINDOWS\system32\drivers\win_logo.gif 2007-08-10 11:32 13618 --a------ C:\WINDOWS\system32\drivers\spy_away_box.jpg 2007-08-10 11:31 979 --a------ C:\WINDOWS\system32\drivers\product_2_name_small.gif 2007-08-10 11:31 918 --a------ C:\WINDOWS\system32\drivers\s_detect.htm 2007-08-10 11:31 837 --a------ C:\WINDOWS\system32\drivers\blank.gif 2007-08-10 11:31 835 --a------ C:\WINDOWS\system32\drivers\style.css 2007-08-10 11:31 6575 --a------ C:\WINDOWS\system32\drivers\remove_spyware_button.gif 2007-08-10 11:31 65 --a------ C:\WINDOWS\system32\drivers\sep_hor.gif 2007-08-10 11:31 64 --a------ C:\WINDOWS\system32\drivers\close_icon.gif 2007-08-10 11:31 6373 --a------ C:\WINDOWS\system32\drivers\secuity_center_logo.gif 2007-08-10 11:31 53 --a------ C:\WINDOWS\system32\drivers\sep_vert.gif 2007-08-10 11:31 48933 --a------ C:\WINDOWS\system32\drivers\pt.htm 2007-08-10 11:31 4723 --a------ C:\WINDOWS\system32\drivers\detect.htm 2007-08-10 11:31 360 --a------ C:\WINDOWS\system32\drivers\header_bg.gif 2007-08-10 11:31 3080 --a------ C:\WINDOWS\system32\drivers\product_3_header.gif 2007-08-10 11:31 2922 --a------ C:\WINDOWS\system32\drivers\footer_back.jpg 2007-08-10 11:31 28459 --a------ C:\WINDOWS\system32\drivers\header_1.gif 2007-08-10 11:31 2604 --a------ C:\WINDOWS\system32\drivers\product_1_header.gif 2007-08-10 11:31 2238 --a------ C:\WINDOWS\system32\drivers\download_box.gif 2007-08-10 11:31 2214 --a------ C:\WINDOWS\system32\drivers\product_2_header.gif 2007-08-10 11:31 2186 --a------ C:\WINDOWS\system32\drivers\alert_icon.gif 2007-08-10 11:31 215 --a------ C:\WINDOWS\system32\drivers\main_back.gif 2007-08-10 11:31 1714 --a------ C:\WINDOWS\system32\drivers\product_3_name_small.gif 2007-08-10 11:31 1647 --a------ C:\WINDOWS\system32\drivers\button_freescan.gif 2007-08-10 11:31 1619 --a------ C:\WINDOWS\system32\drivers\button_buynow.gif 2007-08-10 11:31 15421 --a------ C:\WINDOWS\system32\drivers\header_2.gif 2007-08-10 11:31 1330 --a------ C:\WINDOWS\system32\drivers\product_features.gif 2007-08-10 11:31 1253 --a------ C:\WINDOWS\system32\drivers\product_1_name_small.gif 2007-08-10 11:31 12326 --a------ C:\WINDOWS\system32\drivers\box_3.gif 2007-08-10 11:31 12313 --a------ C:\WINDOWS\system32\drivers\box_1.gif 2007-08-10 11:31 1204 --a------ C:\WINDOWS\system32\drivers\infected.gif 2007-08-10 11:31 11927 --a------ C:\WINDOWS\system32\drivers\box_2.gif 2007-08-10 11:31 11077 --a------ C:\WINDOWS\system32\drivers\header_4.gif 2007-08-10 11:31 10260 --a------ C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg 2007-08-10 11:31 10193 --a------ C:\WINDOWS\system32\drivers\header_3.gif 2007-08-10 11:31 1014 --a------ C:\WINDOWS\system32\drivers\icon_warning.gif 2007-08-10 11:30 --------- d-------- C:\Program Files\Windows NT 2007-08-09 14:28 --------- d-------- C:\Program Files\SpywareBlaster 2007-08-09 12:03 --------- d-------- C:\Program Files\xnews 2007-08-09 11:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-13 14:49 --------- d-------- C:\Program Files\mIRC 2007-06-22 12:03 --------- d-------- C:\Program Files\WhereIsMySpace 2007-05-28 11:17 4 --a------ C:\WINDOWS\uccspecb.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PtiuPbmd"="ptipbm.dll" [2003-01-15 15:41 C:\WINDOWS\system32\ptipbm.dll] "EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-12-20 09:42] "RevoTaskbarApp"="C:\WINDOWS\system32\RevoTask.exe" [2005-04-20 14:44] "mp3infp"="C:\Program Files\mp3infp\mp3infp_regist.exe" [2005-04-25 11:14] "Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 18:58] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52] "hotyge"="C:\Program Files\Windows NT\hotyge3.exe" [2007-08-07 16:30] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-19 13:21:20] Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-19 13:21:20] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\MSN Gaming Zone\prohdy.html FriendlyName= [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkji] C:\WINDOWS\system32\pmkji.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Andrew\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^TA_Start.lnk] path=C:\Documents and Settings\Andrew\Start Menu\Programs\Startup\TA_Start.lnk backup=C:\WINDOWS\pss\TA_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\afbtsukA] C:\WINDOWS\afbtsukA.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo PopUpBlocker] C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eomu] "C:\PROGRA~1\COMMON~1\PPATCH~1\mshta.exe" -vt yazb [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hotyge] C:\Program Files\Windows NT\hotyge22011.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iRiver Updater] \Updater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\vxmfbmgw.dll",forkonce [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vcle] C:\WINDOWS\?dobe\l?***.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying] C:\Program Files\Web Buying\v1.8.1\webbuying.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPop] C:\Program Files\WinPop\winpop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{E1-18-8E-E2-ZN}] C:\DOCUME~1\Andrew\LOCALS~1\Temp\thinksnet.exe CHD003 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{ZN}] C:\WINDOWS\TISKY009.exe SKY009 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Ati HotKey Poller"=2 (0x2) R0 IFPUSB;iriver Internet Audio Player IFP-100;C:\WINDOWS\system32\DRIVERS\ifpusb.sys R0 UlSata;UlSata;C:\WINDOWS\system32\drivers\UlSata.sys R0 Vax347b;Vax347b;C:\WINDOWS\system32\DRIVERS\Vax347b.sys R0 Vax347s;Vax347s;C:\WINDOWS\system32\Drivers\Vax347s.sys R1 mbmiodrvr;mbmiodrvr;\??\C:\WINDOWS\system32\mbmiodrvr.sys R3 LKbdFlt2;Logitech Keyboard Class Filter Driver;C:\WINDOWS\system32\DRIVERS\LKbdFlt2.sys R3 REVO;Service for Revo Driver (WDM);C:\WINDOWS\system32\drivers\revo.sys R3 REVOSENS;REVOSENS;C:\WINDOWS\system32\drivers\revosens.sys S3 UPATC;USBAT Controller Driver;C:\WINDOWS\system32\DRIVERS\upatc.sys S4 ATMsrvc;ATM Service;C:\WINDOWS\System32\ATMsrvc.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-10 12:18:51 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{76CE77C0-85EF-38F6-FBB5-D5607D186745}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{76E21E4E-DA78-2E23-6FEE-08D89E1943D5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C53C2D4A-0301-FEF4-1A8E-9C8DF0BDDE9F}] "pabckgdkjhcpmabfedpgphcocdekfofc"=hex:69,61,6c,69,64,68,63,62,6e,6e,6b,66,61,65,64,6b,68,6c,00,00 "oahbenfdhmfghoncnpelcgcpmakjjh"=hex:69,61,6c,69,64,68,63,62,6e,6e,6b,66,61,65,64,6b,68,6c,00,00 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-10 12:20:57 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-10 12:20 --- E O F --- hijack this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:22:17 PM, on 8/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\WINDOWS\system32\RevoTask.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Windows NT\hotyge3.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\notepad.exe C:\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\system32\RevoTask.exe O4 - HKLM\..\Run: [mp3infp] "C:\Program Files\mp3infp\mp3infp_regist.exe" O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [hotyge] C:\Program Files\Windows NT\hotyge3.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: pmkji - C:\WINDOWS\system32\pmkji.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\prohdy.html -- End of file - 5787 bytes |
|
|
|
|
08-10-2007, 03:18 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,242
OS: N/A
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
We're making progress but not out of the woods yet.
--------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O4 - HKLM\..\Run: [hotyge] C:\Program Files\Windows NT\hotyge3.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O20 - Winlogon Notify: pmkji - C:\WINDOWS\system32\pmkji.dll (file missing) O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\prohdy.html --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/173189-popups-errorsafe-com-winantispyware2006-drivecleaner2006-etc-log-file-included.html
Collect::
C:\Program Files\Windows NT\hotyge3.exe
C:\WINDOWS\system32\apuuhtya.exe
C:\WINDOWS\system32\ohrchbhm.exe
C:\WINDOWS\system32\is67718.exe
C:\WINDOWS\TTC-5555.exe
C:\WINDOWS\tk68.exe
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\waverevenue.exe
C:\WINDOWS\system32\l3acdb.dll
File::
C:\WINDOWS\system32\skna455101.exe
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\remove_spyware_button.gif
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\close_icon.gif
C:\WINDOWS\system32\drivers\secuity_center_logo.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\header_bg.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\alert_icon.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\icon_warning.gif
C:\Program Files\MSN Gaming Zone\prohdy.html
C:\WINDOWS\pss\TA_Start.lnkStartup
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hotyge"=-
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkji]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andrew^Start Menu^Programs^Startup^TA_Start.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\afbtsukA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eomu]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hotyge]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vcle]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPop]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{E1-18-8E-E2-ZN}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{ZN}]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip Please submit this file The file must be uploaded before proceeding to the next step. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
|
|
|
|
|
08-10-2007, 03:18 PM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,242
OS: N/A
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
|
|
|
|
|
08-11-2007, 04:12 AM
|
#6 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Sorry for the delay. The online scan took nearly 5 hours. Here are the items:
1. Hijackthis log: .Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:57:47 AM, on 8/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\WINDOWS\system32\RevoTask.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\hijackthis\HiJackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\system32\RevoTask.exe O4 - HKLM\..\Run: [mp3infp] "C:\Program Files\mp3infp\mp3infp_regist.exe" O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 5262 bytes 2. Online scan ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, August 11, 2007 6:55:43 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 11/08/2007 Kaspersky Anti-Virus database records: 378528 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ Scan Statistics: Total number of scanned objects: 617344 Number of viruses found: 42 Number of infected objects: 145 Number of suspicious objects: 2 Duration of the scan process: 04:48:46 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007FreeInstall.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007Setup.exe/file05/file2 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007Setup.exe/file05 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007Setup.exe/file26 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007Setup.exe/file39 Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\WinAntiSpyware2007Setup.exe Inno: infected - 4 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\yazzlesnet.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\Deckard\System Scanner\backup\DOCUME~1\Andrew\LOCALS~1\Temp\yazzlesnet.exe NSIS: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.1/wbuninst.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\cert8.db Object is locked skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\history.dat Object is locked skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\key3.db Object is locked skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\parent.lock Object is locked skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\search.sqlite Object is locked skipped C:\Documents and Settings\Andrew\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Andrew\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/is67718.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.ks skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/TTC-5555.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/TTC-5555.exe Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/tk68.exe Infected: Trojan.Win32.BHO.ab skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/install.exe Infected: Trojan-Dropper.Win32.Agent.bfr skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip/waverevenue.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip ZIP: infected - 6 skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Application Data\Mozilla\Firefox\Profiles\ghgtf0tl.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Andrew\My Documents\pspv.zip/pspv.exe Infected: not-a-virus:PSWTool.Win32.PassView.162 skipped C:\Documents and Settings\Andrew\My Documents\pspv.zip ZIP: infected - 1 skipped C:\Documents and Settings\Andrew\ntuser.dat Object is locked skipped C:\Documents and Settings\Andrew\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JW8JA3Q1\retadpu[1].exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\01K3M56P\packed_installer_cnb[1].exe Infected: Trojan-Proxy.Win32.Wopla.ag skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\01K3M56P\retadpu[1].exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\01K3M56P\zgame2[1] Infected: Trojan-Downloader.Win32.Small.erg skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EI7B9VZU\m[2].exe Infected: Rootkit.Win32.Agent.ea skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EI7B9VZU\user9[1].exe Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-08-10.22-34-15.log Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry.exe.vir Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry0.dll.vir Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry2.dll.vir Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry3.dll.vir Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\QooBox\Quarantine\C\Program Files\MSN Gaming Zone\laxu.dll.vir Infected: Trojan.Win32.BHO.ab skipped C:\QooBox\Quarantine\C\Program Files\Windows Media Player\homeqyvi455101.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.c skipped C:\QooBox\Quarantine\C\Program Files\Windows Media Player\homeqyvi5555.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\QooBox\Quarantine\C\WINDOWS\afbtsuk.exe.vir Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\QooBox\Quarantine\C\WINDOWS\afbtsukA.exe.vir Infected: Trojan-Downloader.Win32.VB.ang skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir Infected: not-a-virus:AdWare.Win32.Rond.c skipped C:\QooBox\Quarantine\C\WINDOWS\desktop.html.vir Infected: not-virus:Hoax.Win32.Renos.cy skipped C:\QooBox\Quarantine\C\WINDOWS\dls0523pmw.exe.vir Infected: Trojan-Downloader.Win32.Zlob.bqw skipped C:\QooBox\Quarantine\C\WINDOWS\hrgvx0578.exe.vir Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\QooBox\Quarantine\C\WINDOWS\retadpu27.exe.vir Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\QooBox\Quarantine\C\WINDOWS\retadpu361.exe.vir Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyvtu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\driver\by88.exe.vir Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\QooBox\Quarantine\C\WINDOWS\system32\efcyvtt.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\f02WtR\f02WtR1065.exe.vir Infected: Trojan-Downloader.Win32.VB.awj skipped C:\QooBox\Quarantine\C\WINDOWS\system32\f06WtR\f06WtR1083.exe.vir Infected: Trojan-Downloader.Win32.VB.awj skipped C:\QooBox\Quarantine\C\WINDOWS\system32\fiouqsdq.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\kernelwind32.exe.vir Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\QooBox\Quarantine\C\WINDOWS\system32\max1d1164v.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.i skipped C:\QooBox\Quarantine\C\WINDOWS\system32\msbind32.exe.vir Infected: not-virus:Hoax.Win32.Renos.fn skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mxcruehm.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\QooBox\Quarantine\C\WINDOWS\system32\poof.vir Infected: Trojan-Proxy.Win32.Wopla.ag skipped C:\QooBox\Quarantine\C\WINDOWS\system32\TISKY008.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\QooBox\Quarantine\C\WINDOWS\system32\user10.exe.vir Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxg4am1et2.exe.vir Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxg6ame4.exe.vir Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga1me4t1.exe.vir Infected: Trojan-Downloader.Win32.Small.cxx skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga3me2.exe.vir Infected: Trojan-Downloader.Win32.Small.erg skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga5me3.exe.vir Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga8me6.exe.vir Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vturpqp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\win\w71.exe.vir Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winuqw32.dll.vir Infected: Trojan.Win32.Agent.qt skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wmvds32.dll.vir Infected: Trojan-Downloader.Win32.VB.asx skipped C:\QooBox\Quarantine\C\WINDOWS\system32\Y2\x55.exe.vir Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\QooBox\Quarantine\C\WINDOWS\TISKY009.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\QooBox\Quarantine\C\WINDOWS\tk58.exe.vir Infected: Trojan.Win32.BHO.ab skipped C:\QooBox\Quarantine\catchme2007-08-10_121848.23.zip/opnmjkj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\catchme2007-08-10_121848.23.zip/ldcore.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\QooBox\Quarantine\catchme2007-08-10_121848.23.zip ZIP: infected - 2 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP777\A0098269.exe Infected: not-a-virus:Monitor.Win32.Ardamax.j skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP777\A0098279.exe Infected: not-a-virus:Monitor.Win32.Ardamax.j skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP777\A0098280.exe Infected: not-a-virus:Monitor.Win32.Ardamax.22 skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP779\A0103327.exe Infected: not-a-virus:Monitor.Win32.Perflogger.bs skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP779\A0103328.dll Infected: not-a-virus:Monitor.Win32.Perflogger.ca skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP779\A0103330.exe Infected: not-a-virus:Monitor.Win32.Perflogger.ca skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP779\A0103332.exe Infected: Trojan-Spy.Win32.Perfloger.ab skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104758.dll Infected: not-a-virus:Monitor.Win32.Perflogger.ca skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104760.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104761.exe Infected: Trojan.Win32.Small.oa skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104762.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104765.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104766.exe Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP789\A0104768.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP791\A0104795.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP793\A0104861.exe Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP794\A0104870.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP795\A0104918.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105957.exe Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105958.exe Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105959.exe Infected: Trojan-Downloader.Win32.Small.cxx skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105960.exe Infected: Trojan-Downloader.Win32.Small.erg skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105962.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105963.exe Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105964.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105965.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105975.exe Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.i skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105976.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105977.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105978.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105980.dll Infected: Trojan.Win32.BHO.ab skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105981.dll Infected: not-a-virus:AdWare.Win32.TTC.c skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105982.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105984.exe Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105985.exe Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105986.exe Infected: Trojan-Downloader.Win32.VB.ang skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105987.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105988.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105991.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105993.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105994.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105995.dll Infected: Trojan.Win32.Agent.qt skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0105999.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106003.exe Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106005.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106006.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106007.dll Infected: not-a-virus:FraudTool.Win32.BraveSentry.b skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106009.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106012.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106013.exe Infected: Trojan-Downloader.Win32.VB.awj skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106014.exe Infected: Trojan-Downloader.Win32.VB.awj skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106017.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106019.dll Infected: Trojan-Downloader.Win32.VB.asx skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106022.exe Infected: Trojan-Downloader.Win32.Zlob.bqw skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106025.exe Infected: Trojan.Win32.BHO.ab skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106026.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106027.exe Infected: Email-Worm.Win32.Zhelatin.gr skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0106033.exe Infected: not-virus:Hoax.Win32.Renos.fn skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0108001.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.c skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP796\A0108001.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP797\change.log Object is locked skipped C:\temp\mIRC v6.16 + Keygen\mIRC v6.16.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\temp\mIRC v6.16 + Keygen\mIRC v6.16.exe mIRC: infected - 1 skipped C:\temp\mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\temp\mirc616.exe mIRC: infected - 1 skipped C:\temp\pspv\pspv.exe Infected: not-a-virus:PSWTool.Win32.PassView.162 skipped C:\temp\rockxp.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\temp\rockxp.exe/data.rar/keyms.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\temp\rockxp.exe/data.rar/RAS.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\temp\rockxp.exe/data.rar/RockXp_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\temp\rockxp.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\temp\rockxp.exe RarSFX: infected - 5 skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP797\change.log Object is locked skipped G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped G:\System Volume Information\_restore{5A21D8ED-659C-43A3-8F99-694D3CC246D0}\RP797\change.log Object is locked skipped Scan process completed. 3. ComboFix log ComboFix 07-08-10.8 - "Andrew" 2007-08-10 22:24:59.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.713 [GMT -4:00] Command switches used :: C:\Documents and Settings\Andrew\Desktop\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\skna455101.exe C:\WINDOWS\system32\drivers\star.gif C:\WINDOWS\system32\drivers\star_small.gif C:\WINDOWS\system32\drivers\spacer.gif C:\WINDOWS\system32\drivers\star_gray.gif C:\WINDOWS\system32\drivers\warning_icon.gif C:\WINDOWS\system32\drivers\v.gif C:\WINDOWS\system32\drivers\x.gif C:\WINDOWS\system32\drivers\star_gray_small.gif C:\WINDOWS\system32\drivers\shadow.jpg C:\WINDOWS\system32\drivers\win_logo.gif C:\WINDOWS\system32\drivers\spy_away_box.jpg C:\WINDOWS\system32\drivers\product_2_name_small.gif C:\WINDOWS\system32\drivers\s_detect.htm C:\WINDOWS\system32\drivers\blank.gif C:\WINDOWS\system32\drivers\style.css C:\WINDOWS\system32\drivers\remove_spyware_button.gif C:\WINDOWS\system32\drivers\sep_hor.gif C:\WINDOWS\system32\drivers\close_icon.gif C:\WINDOWS\system32\drivers\secuity_center_logo.gif C:\WINDOWS\system32\drivers\sep_vert.gif C:\WINDOWS\system32\drivers\pt.htm C:\WINDOWS\system32\drivers\detect.htm C:\WINDOWS\system32\drivers\header_bg.gif C:\WINDOWS\system32\drivers\product_3_header.gif C:\WINDOWS\system32\drivers\footer_back.jpg C:\WINDOWS\system32\drivers\header_1.gif C:\WINDOWS\system32\drivers\product_1_header.gif C:\WINDOWS\system32\drivers\download_box.gif C:\WINDOWS\system32\drivers\product_2_header.gif C:\WINDOWS\system32\drivers\alert_icon.gif C:\WINDOWS\system32\drivers\main_back.gif C:\WINDOWS\system32\drivers\product_3_name_small.gif C:\WINDOWS\system32\drivers\button_freescan.gif C:\WINDOWS\system32\drivers\button_buynow.gif C:\WINDOWS\system32\drivers\header_2.gif C:\WINDOWS\system32\drivers\product_features.gif C:\WINDOWS\system32\drivers\product_1_name_small.gif C:\WINDOWS\system32\drivers\box_3.gif C:\WINDOWS\system32\drivers\box_1.gif C:\WINDOWS\system32\drivers\infected.gif C:\WINDOWS\system32\drivers\box_2.gif C:\WINDOWS\system32\drivers\header_4.gif C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg C:\WINDOWS\system32\drivers\header_3.gif C:\WINDOWS\system32\drivers\icon_warning.gif C:\Program Files\MSN Gaming Zone\prohdy.html C:\WINDOWS\pss\TA_Start.lnkStartup ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Windows NT\hotyge3.exe C:\WINDOWS\pss\TA_Start.lnkStartup C:\WINDOWS\system32\apuuhtya.exe C:\WINDOWS\system32\drivers\alert_icon.gif C:\WINDOWS\system32\drivers\blank.gif C:\WINDOWS\system32\drivers\box_1.gif C:\WINDOWS\system32\drivers\box_2.gif C:\WINDOWS\system32\drivers\box_3.gif C:\WINDOWS\system32\drivers\button_buynow.gif C:\WINDOWS\system32\drivers\button_freescan.gif C:\WINDOWS\system32\drivers\close_icon.gif C:\WINDOWS\system32\drivers\detect.htm C:\WINDOWS\system32\drivers\download_box.gif C:\WINDOWS\system32\drivers\footer_back.jpg C:\WINDOWS\system32\drivers\header_1.gif C:\WINDOWS\system32\drivers\header_2.gif C:\WINDOWS\system32\drivers\header_3.gif C:\WINDOWS\system32\drivers\header_4.gif C:\WINDOWS\system32\drivers\header_bg.gif C:\WINDOWS\system32\drivers\icon_warning.gif C:\WINDOWS\system32\drivers\infected.gif C:\WINDOWS\system32\drivers\main_back.gif C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg C:\WINDOWS\system32\drivers\product_1_header.gif C:\WINDOWS\system32\drivers\product_1_name_small.gif C:\WINDOWS\system32\drivers\product_2_header.gif C:\WINDOWS\system32\drivers\product_2_name_small.gif C:\WINDOWS\system32\drivers\product_3_header.gif C:\WINDOWS\system32\drivers\product_3_name_small.gif C:\WINDOWS\system32\drivers\product_features.gif C:\WINDOWS\system32\drivers\pt.htm C:\WINDOWS\system32\drivers\remove_spyware_button.gif C:\WINDOWS\system32\drivers\s_detect.htm C:\WINDOWS\system32\drivers\secuity_center_logo.gif C:\WINDOWS\system32\drivers\sep_hor.gif C:\WINDOWS\system32\drivers\sep_vert.gif C:\WINDOWS\system32\drivers\shadow.jpg C:\WINDOWS\system32\drivers\spacer.gif C:\WINDOWS\system32\drivers\spy_away_box.jpg C:\WINDOWS\system32\drivers\star.gif C:\WINDOWS\system32\drivers\star_gray.gif C:\WINDOWS\system32\drivers\star_gray_small.gif C:\WINDOWS\system32\drivers\star_small.gif C:\WINDOWS\system32\drivers\style.css C:\WINDOWS\system32\drivers\v.gif C:\WINDOWS\system32\drivers\warning_icon.gif C:\WINDOWS\system32\drivers\win_logo.gif C:\WINDOWS\system32\drivers\x.gif C:\WINDOWS\system32\install.exe C:\WINDOWS\system32\is67718.exe C:\WINDOWS\system32\l3acdb.dll C:\WINDOWS\system32\ohrchbhm.exe C:\WINDOWS\system32\waverevenue.exe C:\WINDOWS\tk68.exe C:\WINDOWS\TTC-5555.exe ((((((((((((((((((((((((( Files Created from 2007-07-11 to 2007-08-11 ))))))))))))))))))))))))))))))) 2007-08-10 11:49 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-09 12:15 <DIR> d-------- C:\Deckard 2007-08-09 12:11 21,312 --a------ C:\WINDOWS\choice.exe 2007-08-09 12:10 <DIR> d-------- C:\ie-spyad 2007-08-09 11:06 <DIR> d-------- C:\hijackthis 2007-08-03 12:57 <DIR> d-------- C:\Program Files\CDCheck 2007-07-20 14:27 <DIR> d-------- C:\Program Files\CKM (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-10 22:32 --------- d-------- C:\Program Files\Windows NT 2007-08-10 12:29 --------- d-------- C:\Program Files\SpywareBlaster 2007-08-10 11:55 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-08-09 12:03 --------- d-------- C:\Program Files\xnews 2007-08-09 11:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-13 14:49 --------- d-------- C:\Program Files\mIRC 2007-06-22 12:03 --------- d-------- C:\Program Files\WhereIsMySpace 2007-05-28 11:17 4 --a------ C:\WINDOWS\uccspecb.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PtiuPbmd"="ptipbm.dll" [2003-01-15 15:41 C:\WINDOWS\system32\ptipbm.dll] "EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-12-20 09:42] "RevoTaskbarApp"="C:\WINDOWS\system32\RevoTask.exe" [2005-04-20 14:44] "mp3infp"="C:\Program Files\mp3infp\mp3infp_regist.exe" [2005-04-25 11:14] "Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 18:58] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-19 13:21:20] Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-19 13:21:20] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo PopUpBlocker] C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iRiver Updater] \Updater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\vxmfbmgw.dll",forkonce [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Ati HotKey Poller"=2 (0x2) R0 IFPUSB;iriver Internet Audio Player IFP-100;C:\WINDOWS\system32\DRIVERS\ifpusb.sys R0 UlSata;UlSata;C:\WINDOWS\system32\drivers\UlSata.sys R0 Vax347b;Vax347b;C:\WINDOWS\system32\DRIVERS\Vax347b.sys R0 Vax347s;Vax347s;C:\WINDOWS\system32\Drivers\Vax347s.sys R1 mbmiodrvr;mbmiodrvr;\??\C:\WINDOWS\system32\mbmiodrvr.sys R3 LKbdFlt2;Logitech Keyboard Class Filter Driver;C:\WINDOWS\system32\DRIVERS\LKbdFlt2.sys R3 REVO;Service for Revo Driver (WDM);C:\WINDOWS\system32\drivers\revo.sys R3 REVOSENS;REVOSENS;C:\WINDOWS\system32\drivers\revosens.sys S3 UPATC;USBAT Controller Driver;C:\WINDOWS\system32\DRIVERS\upatc.sys S4 ATMsrvc;ATM Service;C:\WINDOWS\System32\ATMsrvc.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-10 22:34:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{76CE77C0-85EF-38F6-FBB5-D5607D186745}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{76E21E4E-DA78-2E23-6FEE-08D89E1943D5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C53C2D4A-0301-FEF4-1A8E-9C8DF0BDDE9F}] "pabckgdkjhcpmabfedpgphcocdekfofc"=hex:69,61,6c,69,64,68,63,62,6e,6e,6b,66,61,65,64,6b,68,6c,00,00 "oahbenfdhmfghoncnpelcgcpmakjjh"=hex:69,61,6c,69,64,68,63,62,6e,6e,6b,66,61,65,64,6b,68,6c,00,00 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-10 22:36:33 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-10 22:35 C:\ComboFix2.txt ... 2007-08-10 12:20 --- E O F --- |
|
|
|
|
08-11-2007, 04:29 AM
|
#7 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Ok, to answer how computer is behaving now, everything seems fine. I do not see any obvious suspicious programs running in the task manager. I haven't got any popups, and no fake ad scanners are trying to install and run. The only thing that isn't back to normal is my desktop icons. Before this all began, my desk top icons title background color was set to transparent, and now they are no longer transparent, but solid black (when this stuff started happening, the first thing I noticed was the desktop icon title background color changed from transparent to blue. I have not found a way to change them back, but it is probably something simple that I'll google for). Anyway, thanks a lot for your help so far, it is really appreciated!
|
|
|
|
|
08-11-2007, 06:40 AM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,242
OS: N/A
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\Andrew\Desktop\[4]-Submit_2007-08-10_222458.14.zip"
"C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JW8JA3Q1\retadpu[1].exe"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"C:\Program Files\CKM"
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
"C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5"
%systemdrive%\VundoFix Backups
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says ------------ Go to Control Panel click Display>Desktop>Customize Desktop>Website Under the 'Web pages' box, Delete everything present.
__________________
|
|
|
|
|
08-11-2007, 12:46 PM
|
#9 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
Ok the program ran. It said "Deleted successfully" and then closed itself. As for the Webpages on the desktop, there were none listed. You have been a big help, thanks so much.
|
|
|
|
|
08-12-2007, 08:30 AM
|
#10 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: WinXP
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
OK, I just ran Ad-aware and it removed one tracking cookie (live365.com). I then ran spybot and it found 24 items: for BraveSentry, 3 .Ink files, a directory, "kr_done1" and a registry setting; a registry entry for CoolWWWSearch.GonnaSearch; 3 tracking cookies for Winsoftware.WinAntiVirusPro2006; 3 tracking cookies for Zedo; 4 tracking cookies for ReliableStats; 5 tracking cookies for ErrorProtector (all of these in firefox), and 2 registry entries for Microsoft.Windows.ActiveDesktop. Spybot was able to fix them all. Not sure if this means I am still infected with something or if this was just cleanup from the last bit, so here is my latest hijackthis log, if that helps. Thanks again.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:28:48 AM, on 8/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\WINDOWS\system32\RevoTask.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\xnews\Xnews.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\hijackthis\HiJackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\system32\RevoTask.exe O4 - HKLM\..\Run: [mp3infp] "C:\Program Files\mp3infp\mp3infp_regist.exe" O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 5794 bytes |
|
|
|
|
08-12-2007, 08:39 AM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,242
OS: N/A
|
Re: Popups, errorsafe.com, WinAntiSpyware2006, drivecleaner2006, etc - log file inclu
I don't consider cookies to be threat. Perhaps, an invasion of privacy but not a real threat. Cookies are something that gets supplanted everytime we visit a website. LOL ... even TSF has cookies.
Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
|
|
|
|
| Thread Tools | |
|
|
