|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-11-2007, 05:00 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 5
OS: XP
|
Pop-ups and recurring infections - can't clean.
Hi and thanks for this service! I have pasted and attached the requested information as described in the '5 steps.' Thanks for your help!
>>>Deckard's main.txt..... Deckard's System Scanner v20070809.63 Run by Marc on 2007-08-11 at 18:37:21 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 4 Restore Point(s) -- 4: 2007-08-11 22:37:30 UTC - RP4 - Deckard's System Scanner Restore Point 3: 2007-08-11 17:16:22 UTC - RP3 - Software Distribution Service 3.0 2: 2007-08-10 16:57:31 UTC - RP2 - After Clean - Good Restore point 1: 2007-08-10 16:56:22 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 77% (more than 75%). Total Physical Memory: 384 MiB (512 MiB recommended). -- HijackThis (run as Marc.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:38:36 PM, on 8/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\Explorer.EXE c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\AOL\1129037481\ee\aolsoftware.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe c:\windows\system\hpsysdrv.exe C:\Documents and Settings\Marc\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Marc.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0CB65F89-932D-4F3E-A795-CC30C66F1D59} - C:\WINDOWS\system32\jkklm.dll O2 - BHO: (no name) - {4DF984CA-140F-7CFE-7876-4AB60F3BF2C3} - C:\WINDOWS\system32\qgtorf.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\byvspqq.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [tbidyvsA] C:\WINDOWS\tbidyvsA.exe O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387 O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63 O4 - HKLM\..\Run: [WinCore32.exe] C:\WINDOWS\system32\WinCore32.exe O4 - HKLM\..\Run: [irdmelt] dlltyxzc.exe O4 - HKLM\..\Run: [jsispsl] C:\WINDOWS\system32\jdnems.exe O4 - HKLM\..\Run: [certds] C:\WINDOWS\system32\cncersh.exe O4 - HKLM\..\Run: [ismdoc] C:\WINDOWS\system32\atlupjhg.exe O4 - HKLM\..\Run: [blwquest] C:\WINDOWS\system32\libevlkf.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/tes...enXInstall.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://asp.mathxl.com/applets/PearsonInstallAsst.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL c:\windows\system32\ldcore.dll O20 - Winlogon Notify: byvspqq - C:\WINDOWS\SYSTEM32\byvspqq.dll O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll O21 - SSODL: PJOJGre - {0DEA13F3-A740-B959-398E-4356508B0CCB} - C:\WINDOWS\system32\gjo.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 12074 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> S1 intelppm (Intel Processor Driver) - c:\windows\system32\drivers\intelppm.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2007-08-03 23:38:47 346 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2007-08-03 23:38:45 338 --a------ C:\WINDOWS\Tasks\McQcTask.job -- Files created between 2007-07-11 and 2007-08-11 ----------------------------- 2007-08-11 18:02:39 0 d-------- C:\Program Files\SpywareBlaster 2007-08-11 13:27:08 0 d-------- C:\Program Files\Trend Micro 2007-08-11 11:08:48 0 d-------- C:\WINDOWS\BDOSCAN8 2007-08-11 00:42:48 0 d-------- C:\Documents and Settings\Marc\Application Data\acccore 2007-08-10 23:55:21 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-08-10 22:18:07 0 d-------- C:\Documents and Settings\Marc\.housecall6.6 2007-08-10 22:17:23 0 d-------- C:\Documents and Settings\Marc\Application Data\Macromedia 2007-08-10 22:01:55 0 d-------- C:\Program Files\Viewpoint 2007-08-10 19:05:37 125504 --a------ C:\WINDOWS\system32\chpemgkg.dll 2007-08-10 19:05:32 70208 --a------ C:\WINDOWS\system32\gesohtwo.dll 2007-08-10 10:16:08 0 d---s---- C:\Documents and Settings\Marc\UserData 2007-08-10 09:21:11 0 d-------- C:\Documents and Settings\Marc\Application Data\InterMute 2007-08-10 09:21:11 0 d-------- C:\Documents and Settings\Marc\Application Data\Identities 2007-08-10 09:21:11 0 d-------- C:\Documents and Settings\Marc\Application Data\Apple Computer 2007-08-10 09:21:10 0 d-------- C:\Documents and Settings\Marc\WINDOWS 2007-08-10 09:21:10 0 d--h----- C:\Documents and Settings\Marc\Templates 2007-08-10 09:21:10 0 dr------- C:\Documents and Settings\Marc\Start Menu 2007-08-10 09:21:10 0 dr-h----- C:\Documents and Settings\Marc\SendTo 2007-08-10 09:21:10 0 dr-h----- C:\Documents and Settings\Marc\Recent 2007-08-10 09:21:10 0 d--h----- C:\Documents and Settings\Marc\PrintHood 2007-08-10 09:21:10 0 d--h----- C:\Documents and Settings\Marc\NetHood 2007-08-10 09:21:10 0 dr------- C:\Documents and Settings\Marc\My Documents 2007-08-10 09:21:10 0 d--h----- C:\Documents and Settings\Marc\Local Settings 2007-08-10 09:21:10 0 dr------- C:\Documents and Settings\Marc\Favorites 2007-08-10 09:21:10 0 d-------- C:\Documents and Settings\Marc\Desktop 2007-08-10 09:21:10 0 d---s---- C:\Documents and Settings\Marc\Cookies 2007-08-10 09:21:10 0 dr-h----- C:\Documents and Settings\Marc\Application Data 2007-08-10 09:21:10 0 d-------- C:\Documents and Settings\Marc\Application Data\Symantec 2007-08-10 09:21:10 0 d-------- C:\Documents and Settings\Marc\Application Data\SampleView 2007-08-10 09:21:10 0 d-------- C:\Documents and Settings\Marc\Application Data\Real 2007-08-10 09:21:09 1572864 --ah----- C:\Documents and Settings\Marc\NTUSER.DAT 2007-08-10 08:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-08-09 19:05:01 1682890 ---hs---- C:\WINDOWS\system32\mlkkj.bak2 2007-08-09 18:35:50 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2007-08-09 18:35:50 0 dr------- C:\Documents and Settings\Administrator\Favorites 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Desktop 2007-08-09 18:35:50 0 d---s---- C:\Documents and Settings\Administrator\Cookies 2007-08-09 18:35:50 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real 2007-08-09 18:35:50 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\InterMute 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2007-08-09 18:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2007-08-09 18:35:49 0 d-------- C:\Documents and Settings\Administrator\WINDOWS 2007-08-09 18:35:49 0 d--h----- C:\Documents and Settings\Administrator\Templates 2007-08-09 18:35:49 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2007-08-09 18:35:49 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2007-08-09 18:35:49 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2007-08-09 18:35:49 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2007-08-09 18:35:49 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2007-08-09 18:35:49 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2007-08-09 18:35:49 0 dr------- C:\Documents and Settings\Administrator\My Documents 2007-08-03 23:42:48 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2007-08-03 23:41:35 78255 --a------ C:\WINDOWS\system32\windows_log_289666 2007-08-03 23:39:03 107083 --a------ C:\WINDOWS\system32\windows_log_270122 2007-08-03 23:37:28 0 d-------- C:\Program Files\McAfee.com 2007-08-03 23:36:51 0 d-------- C:\Program Files\Common Files\McAfee 2007-08-03 23:36:41 0 d-------- C:\Program Files\McAfee 2007-08-03 22:12:32 0 --a------ C:\WINDOWS\system32\windows_log_204371 2007-08-03 22:10:02 95191 --a------ C:\WINDOWS\system32\windows_log_198120 2007-08-03 21:51:46 0 d-------- C:\Program Files\Lavasoft 2007-08-03 21:51:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-08-03 21:51:01 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-03 21:36:28 91084 --a------ C:\WINDOWS\system32\windows_log_205918 2007-08-03 21:34:15 92140 --a------ C:\WINDOWS\system32\windows_log_204703 2007-08-03 21:25:37 103921 --a------ C:\WINDOWS\system32\windows_log_198947 2007-08-03 21:21:29 90315 --a------ C:\WINDOWS\system32\windows_log_195760 2007-08-03 21:17:39 108282 --a------ C:\WINDOWS\system32\windows_log_192722 2007-08-03 21:08:05 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-08-03 20:51:30 46073 --a------ C:\WINDOWS\system32\windows_log_150929 2007-08-03 20:12:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-08-03 17:58:06 0 --a------ C:\WINDOWS\system32\windows_log_0 2007-08-03 17:50:37 0 d-------- C:\Program Files\Common Files\Companion Wizard 2007-08-03 17:49:45 6466 ---hs---- C:\WINDOWS\system32\mlkkj.bak1 2007-08-03 17:49:24 228960 -----n--- C:\WINDOWS\system32\jkklm.dll 2007-08-03 17:40:32 101 --a------ C:\WINDOWS\system32\mit.bat 2007-08-03 17:40:18 31254 -----n--- C:\WINDOWS\system32\byvspqq.dll 2007-08-03 17:34:45 20171 --a------ C:\WINDOWS\system32\21344518341.dll 2007-08-03 17:29:51 171520 --a------ C:\WINDOWS\system32\oobualw.dll 2007-08-03 17:29:25 0 d-------- C:\Documents and Settings\NetworkService\Desktop 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\win 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\W3 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\E5 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\C9 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\C5 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\C3 2007-08-03 17:28:58 0 d-------- C:\WINDOWS\system32\C1 2007-08-03 17:28:53 0 d-------- C:\WINDOWS\system32\b06FdUe 2007-08-03 17:28:53 0 d-------- C:\Temp 2007-08-03 13:07:23 224283 --a------ C:\WINDOWS\Setup167.exe 2007-08-02 09:43:59 282624 --a------ C:\Program Files\TTC.dll 2007-08-01 19:48:54 60928 --a------ C:\WINDOWS\system32\qgtorf.dll 2007-07-30 18:12:52 0 d-------- C:\Program Files\Common Files\qooz 2007-07-30 18:12:51 0 d-------- C:\WINDOWS\qooz -- Find3M Report --------------------------------------------------------------- 2007-08-11 17:28:09 0 d-------- C:\Program Files\QuickTime 2007-08-11 17:20:27 0 d-------- C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor 2007-08-11 17:19:17 0 d-a------ C:\Program Files\Common Files\LightScribe 2007-08-10 09:03:33 0 d-------- C:\Program Files\Common Files 2007-08-09 22:17:01 0 d-------- C:\Program Files\DivX 2007-08-09 18:19:04 0 d-------- C:\Program Files\AIM 2007-08-03 23:12:07 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-08-03 23:12:00 0 d-------- C:\Program Files\PC-Doctor for Windows 2007-08-03 22:50:49 0 d-------- C:\Program Files\Common Files\??sks 2007-08-01 19:48:56 0 d-------- C:\Program Files\Common Files\??pPatch 2007-07-03 07:42:56 22016 --a------ C:\WINDOWS\b138.exe 2007-06-25 09:53:26 53248 --a------ C:\WINDOWS\uninst1014.exe <Not Verified; ; uninst1016> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CB65F89-932D-4F3E-A795-CC30C66F1D59}] 08/03/2007 05:49 PM 228960 --------- C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DF984CA-140F-7CFE-7876-4AB60F3BF2C3}] 08/01/2007 09:43 AM 60928 --a------ C:\WINDOWS\system32\qgtorf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9BD0828-1FD9-410C-A50F-43EBE65D310F}] 08/03/2007 05:40 PM 31254 --------- C:\WINDOWS\system32\byvspqq.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSPower"="SiSPower.dll" [04/12/2005 11:31 AM C:\WINDOWS\system32\SiSPower.dll] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [02/25/2005 06:34 PM] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [10/14/2004 09:54 AM] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/22/2003 08:38 AM] "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [01/27/2006 01:17 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [08/24/2005 06:59 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [04/13/2005 04:48 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/13/2007 11:07 PM] "tbidyvsA"="C:\WINDOWS\tbidyvsA.exe" [] "i34yuc387"="C:\WINDOWS\i34yuc387" [] "g4356cbvy63"="C:\WINDOWS\g4356cbvy63" [] "WinCore32.exe"="C:\WINDOWS\system32\WinCore32.exe" [] "irdmelt"="dlltyxzc.exe" [] "jsispsl"="C:\WINDOWS\system32\jdnems.exe" [] "certds"="C:\WINDOWS\system32\cncersh.exe" [] "ismdoc"="C:\WINDOWS\system32\atlupjhg.exe" [] "blwquest"="C:\WINDOWS\system32\libevlkf.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:00 AM] "Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [09/25/2006 08:52 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [9/2/2005 8:36:21 PM] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [11/4/2004 10:28:24 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"= C:\WINDOWS\system32\byvspqq.dll [08/03/2007 05:40 PM 31254] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PJOJGre"= {0DEA13F3-A740-B959-398E-4356508B0CCB} - C:\WINDOWS\system32\gjo.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byvspqq] byvspqq.dll 08/03/2007 05:40 PM 31254 C:\WINDOWS\system32\byvspqq.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkklm] C:\WINDOWS\system32\jkklm.dll 08/03/2007 05:49 PM 228960 C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL c:\windows\system32\ldcore.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2007-08-11 at 18:40:44 --------- >>>And Panda's Activescan..... Incident Status Location Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\qgtorf.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\byvspqq.dll Adware:adware/commad Not disinfected Windows Registry Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@2o7[3].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@ad.yieldmanager[2].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@ad.yieldmanager[3].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@ad.yieldmanager[5].txt Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@ads.addynamix[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@atdmt[4].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@atwola[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@drivecleaner[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@errorsafe[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@go[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@go[3].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@server.iad.liveperson[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@systemdoctor[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@tribalfusion[3].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@winantivirus[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@www.errorsafe[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@www.winantiviruspro[1].txt Hacktool:HackTool/KillProcWin.A Not disinfected C:\Documents and Settings\HP_Owner\Local Settings\Temp\CDASilentInstall0501.exe[simple_killw.exe] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Marc\Cookies\marc@2o7[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Marc\Cookies\marc@ad.yieldmanager[2].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Marc\Cookies\marc@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Marc\Cookies\marc@adrevolver[3].txt Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Marc\Cookies\marc@ads.addynamix[1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Marc\Cookies\marc@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Marc\Cookies\marc@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Marc\Cookies\marc@atwola[1].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Marc\Cookies\marc@bluestreak[1].txt Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Marc\Cookies\marc@casalemedia[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Marc\Cookies\marc@doubleclick[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Marc\Cookies\marc@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Marc\Cookies\marc@realmedia[2].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Marc\Cookies\marc@stats1.reliablestats[2].txt Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Marc\Cookies\marc@statse.webtrendslive[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Marc\Cookies\marc@systemdoctor[1].txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Marc\Cookies\marc@trafficmp[2].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Marc\Cookies\marc@winantispyware[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Marc\Cookies\marc@winantivirus[1].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Marc\Cookies\marc@www.systemdoctor[2].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Marc\Cookies\marc@www.winantiviruspro[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Marc\Cookies\marc@zedo[2].txt Potentially unwanted tool:Application/ErrorSafe Not disinfected C:\Documents and Settings\Marc\Local Settings\Temporary Internet Files\Content.IE5\YDOT8R01\WinAntiVirusPro2007FreeInstall[1].cab[UWA7P_0001_N91M0809NetInstaller.exe] Adware:Adware/WinAntivirus2006 Not disinfected C:\Documents and Settings\Marc\Local Settings\Temporary Internet Files\Content.IE5\YDOT8R01\WinAntiVirusPro2007FreeInstall[1].cab[UWA7P_0001_N91M0809NetInstaller.inf] Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Adware:Adware/TTC Not disinfected C:\Program Files\TTC.dll Adware:Adware/WebSearch Not disinfected C:\Temp\bY001.exe[kmhp83122.exe] Adware:Adware/WebSearch Not disinfected C:\Temp\bY001.exe[kmhp83122.exe][TTC.dll] Virus:Trj/Downloader.PNC Not disinfected C:\Temp\bY001.exe[wr7317.exe] Spyware:Spyware/Virtumonde Not disinfected C:\Temp\bY001.exe[rsch25.exe] Adware:Adware/Zenosearch Not disinfected C:\Temp\bY001.exe[zn553.exe] Virus:Trj/Downloader.LAF Not disinfected C:\Temp\bY001.exe[tdwn23.exe] Adware:Adware/NSISMedia Not disinfected C:\WINDOWS\Setup167.exe[²îÇ\NSIS.Library.RegTool.v2.²áÇ.exe] Spyware:Cookie/Atwola Not disinfected C:\WINDOWS\Temp\Cookies\hp_owner@atwola[1].txt Adware:Adware/DigInk Not disinfected C:\WINDOWS\uninst1014.exe >>>Extra.txt attached. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-12-2007, 06:37 AM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: Pop-ups and recurring infections - can't clean.
Do a HijackThis scan & place a check next to these items and select "Fix checked":
O2 - BHO: (no name) - {0CB65F89-932D-4F3E-A795-CC30C66F1D59} - C:\WINDOWS\system32\jkklm.dll O2 - BHO: (no name) - {4DF984CA-140F-7CFE-7876-4AB60F3BF2C3} - C:\WINDOWS\system32\qgtorf.dll O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\byvspqq.dll O4 - HKLM\..\Run: [tbidyvsA] C:\WINDOWS\tbidyvsA.exe O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387 O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63 O4 - HKLM\..\Run: [WinCore32.exe] C:\WINDOWS\system32\WinCore32.exe O4 - HKLM\..\Run: [irdmelt] dlltyxzc.exe O4 - HKLM\..\Run: [jsispsl] C:\WINDOWS\system32\jdnems.exe O4 - HKLM\..\Run: [certds] C:\WINDOWS\system32\cncersh.exe O4 - HKLM\..\Run: [ismdoc] C:\WINDOWS\system32\atlupjhg.exe O4 - HKLM\..\Run: [blwquest] C:\WINDOWS\system32\libevlkf.exe O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O20 - Winlogon Notify: byvspqq - C:\WINDOWS\SYSTEM32\byvspqq.dll O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll O21 - SSODL: PJOJGre - {0DEA13F3-A740-B959-398E-4356508B0CCB} - C:\WINDOWS\system32\gjo.dll (file missing) Ignore any prompts for a reboot --------------- 1. Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe * IMPORTANT !!! Place combofix.exe on your Desktop  2. Go to  → Run → paste in the single line command & click OK"%userprofile%\desktop\combofix.exe" /killall3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
08-12-2007, 10:19 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 5
OS: XP
|
Re: Pop-ups and recurring infections - can't clean.
Thank you, sUBs. Logs follow...
ComboFix 07-08-12.5 - "Marc" 2007-08-12 11:58:29.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.126 [GMT -4:00] Command switches used :: /killall * Created a new restore point ADS removed - svchost.exe: deleted 58880 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\HP_Owner\APPLIC~1\.rdr.ini C:\DOCUME~1\HP_Owner\APPLIC~1\WinTouch C:\DOCUME~1\HP_Owner\APPLIC~1\WinTouch\wintouch.cfg C:\DOCUME~1\LOCALS~1\APPLIC~1\.rdr.ini C:\DOCUME~1\NETWOR~1\APPLIC~1\.rdr.ini C:\Documents and Settings\All Users.\documents\settings C:\Documents and Settings\All Users.\documents\settings\desktop.ini C:\Program Files\Common Files\companion wizard C:\Program Files\Common Files\companion wizard\CompWiz.xml C:\Program Files\Common Files\Companion Wizard\CompWiz.xml C:\Program Files\Common Files\ppatch~1 C:\Program Files\Common Files\ppatch~1\n?lookup.exe C:\Program Files\Common Files\sks~1 C:\Program Files\Common Files\sks~1\??sks\ C:\Program Files\TTC.dll C:\temp\0c2 C:\temp\0c2\tmpFF.log C:\temp\brr C:\temp\tn3 C:\WINDOWS\b138.exe C:\WINDOWS\deskcfg.dat C:\WINDOWS\Free Online Dating.ico C:\WINDOWS\system32\21344518341.dll C:\WINDOWS\system32\aamahvod.dll C:\WINDOWS\system32\b06FdUe C:\WINDOWS\system32\byvspqq.dll C:\WINDOWS\system32\C1 C:\WINDOWS\system32\C3 C:\WINDOWS\system32\C5 C:\WINDOWS\system32\C9 C:\WINDOWS\system32\chpemgkg.dll C:\WINDOWS\system32\dovhamaa.ini C:\WINDOWS\system32\E5 C:\WINDOWS\system32\fxstnmnd.exe C:\WINDOWS\system32\gesohtwo.dll C:\WINDOWS\system32\gkgmephc.ini C:\WINDOWS\system32\jkklm.dll C:\WINDOWS\system32\ldinfo.ldr C:\WINDOWS\system32\mit.bat C:\WINDOWS\system32\mlkkj.bak1 C:\WINDOWS\system32\mlkkj.bak2 C:\WINDOWS\system32\mlkkj.ini C:\WINDOWS\system32\pntkuigm.dll C:\WINDOWS\system32\qgtorf.dll C:\WINDOWS\system32\W3 C:\WINDOWS\system32\win C:\WINDOWS\uninst1014.exe D:\Autorun.inf ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_ASC3550U -------\LEGACY_CMDSERVICE -------\LEGACY_CORE -------\LEGACY_DOMAINSERVICE -------\LEGACY_ICF -------\LEGACY_NETWORK_MONITOR -------\LEGACY_NTMLSVC -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS -------\DomainService -------\NtmlSvc ((((((((((((((((((((((((( Files Created from 2007-07-12 to 2007-08-12 ))))))))))))))))))))))))))))))) 2007-08-12 11:56 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-11 18:37 <DIR> d-------- C:\Deckard 2007-08-11 18:02 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-08-11 13:27 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-11 11:08 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2007-08-11 00:42 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\acccore 2007-08-10 23:55 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-08-10 23:30 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-08-10 22:18 <DIR> d-------- C:\DOCUME~1\Marc\.housecall6.6 2007-08-10 22:01 <DIR> d-------- C:\Program Files\Viewpoint 2007-08-10 10:16 <DIR> d---s---- C:\DOCUME~1\Marc\UserData 2007-08-10 09:21 1,572,864 --ah----- C:\DOCUME~1\Marc\NTUSER.DAT 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\WINDOWS 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Symantec 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\SampleView 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Real 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\InterMute 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Apple Computer 2007-08-10 08:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-08-09 18:35 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Real 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\InterMute 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer 2007-08-03 23:42 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2007-08-03 23:40 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2007-08-03 23:40 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2007-08-03 23:40 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2007-08-03 23:40 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2007-08-03 23:40 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2007-08-03 23:39 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2007-08-03 23:37 <DIR> d-------- C:\Program Files\McAfee.com 2007-08-03 23:36 <DIR> d-------- C:\Program Files\McAfee 2007-08-03 23:36 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-08-03 21:51 <DIR> d-------- C:\Program Files\Lavasoft 2007-08-03 21:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-03 21:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-08-03 21:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee 2007-08-03 17:50 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-08-03 17:29 171,520 --a------ C:\WINDOWS\system32\oobualw.dll 2007-08-03 17:28 603,534 --a------ C:\Temp\bY001.exe 2007-08-03 17:28 <DIR> d-------- C:\Temp 2007-08-03 13:07 224,283 --a------ C:\WINDOWS\Setup167.exe 2007-07-30 18:12 <DIR> d-------- C:\WINDOWS\qooz 2007-07-30 18:12 <DIR> d-------- C:\Program Files\Common Files\qooz (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-11 17:28 --------- d-------- C:\Program Files\QuickTime 2007-08-11 17:20 --------- d-------- C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor 2007-08-11 17:19 --------- d-a------ C:\Program Files\Common Files\LightScribe 2007-08-09 22:17 --------- d-------- C:\Program Files\DivX 2007-08-09 18:19 --------- d-------- C:\Program Files\AIM 2007-08-03 23:12 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-08-03 23:12 --------- d-------- C:\Program Files\PC-Doctor for Windows 2007-08-03 17:34 14336 --a------ C:\WINDOWS\system32\svchost.exe 2007-08-03 17:34 14336 --a------ C:\WINDOWS\system32\dllcache\svchost.exe 2007-05-16 11:12 86528 --a------ C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 11:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 11:12 510976 --a------ C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 11:12 1314816 --a------ C:\WINDOWS\system32\dllcache\msoe.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSPower"="SiSPower.dll" [2005-04-12 11:31 C:\WINDOWS\system32\SiSPower.dll] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 18:34] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 09:54] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-01-27 13:17] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-24 18:59] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 04:48] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-13 23:07] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:00] "Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-09-25 20:52] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-09-02 20:36:21] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 22:28:24] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R2 WUSB54GCSVC;WUSB54GCSVC;"C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe" S3 BCM42RLY;BCM42RLY;\??\C:\WINDOWS\System32\BCM42RLY.SYS *Newly Created Service* - GTNDIS5 Contents of the 'Scheduled Tasks' folder 2007-08-04 03:38:47 C:\WINDOWS\Tasks\McDefragTask.job - c:\PROGRA~1\mcafee\mqc\QcConsol.exe 2007-08-04 03:38:45 C:\WINDOWS\Tasks\McQcTask.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-12 12  27Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-12 12:08:36 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-12 12:08 --- E O F --- And... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:16:11 PM, on 8/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\WINDOWS\system32\HPZipm12.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\AOL\1129037481\ee\aolsoftware.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe c:\windows\system\hpsysdrv.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rm1=seconduser R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/tes...enXInstall.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://asp.mathxl.com/applets/PearsonInstallAsst.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 10611 bytes Note: I tried to 'HJT fix' AutoTBar twice. Thanks again for your help! |
|
|
|
|
08-12-2007, 10:30 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: Pop-ups and recurring infections - can't clean.
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
File:: C:\WINDOWS\system32\oobualw.dll C:\Temp\bY001.exe C:\WINDOWS\Setup167.exe C:\WINDOWS\qooz Folder:: C:\Program Files\Viewpoint  Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
08-12-2007, 04:21 PM
|
#5 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 5
OS: XP
|
Re: Pop-ups and recurring infections - can't clean.
Thanks, there is no listing for 'viewpoint' in the remove program function and nothing that looks unusual(although this is my daughter's PC so I'm not too familiar with what she may or may not have installed). One thing, after the ComboFix reboot I received a 'Microsoft Visual C++ Debug Library' pop-up alert with a 'Debug Assertion Failed' message.
Other info in the alert: Program: C\hp\drivers\hplsbwatcher\lsburnwatcher.exe File: C:\program files\microsoft visual studios.net 2003\vc7\atlmfc\include\atfile.h Line: 188 Expression: m_h !=0 Anyway, here are the logs... ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, August 12, 2007 6:16:34 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 12/08/2007 Kaspersky Anti-Virus database records: 379047 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 80721 Number of viruses found: 21 Number of infected objects: 47 Number of suspicious objects: 2 Duration of the scan process: 01:57:40 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\WINDOWS\temp\botFFC5.tmp Infected: Trojan-Proxy.Win32.Xorpix.ar skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{42A879BC-DDCE-48AC-AD50-24AB32145C72}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR3.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19e26cec064e9195496f0b92ff8bcf4b_077e7ab7-aa53-44fb-a82a-28c9e931a4f8 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\216f2eb77c793b4ddb489a6228420f30_077e7ab7-aa53-44fb-a82a-28c9e931a4f8 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/win3F.tmp.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe/file01 Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe/file02/file01 Infected: Trojan-Downloader.Win32.Agent.alr skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe/file02 Infected: Trojan-Downloader.Win32.Agent.alr skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe/file18 Infected: not-a-virus:FraudTool.Win32.WinAntiVirus.2006 skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe/file83 Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe Inno: infected - 5 skipped C:\Documents and Settings\HP_Owner\Shared\(Better Version) megatech 54.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\(naked) megatech 21.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\by Fry - megatech 40.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\HuMMeR megatech 45.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\Imogen Heap- Foolish.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\megatech 08.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\shared by m0m get the party ktu remix 25.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\Top of Charts - 2005 (love).wma Infected: Trojan-Downloader.WMA.Wimad.k skipped C:\Documents and Settings\HP_Owner\Shared\your love shines on me 23.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\HP_Owner\Shared\[[ your love shines on me 29.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Marc\.housecall6.6\Quarantine\02 - your love shines on me 50.wma.bac_a01760 Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\Marc\.housecall6.6\Quarantine\1CB.tmp.bac_a01760/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\Documents and Settings\Marc\.housecall6.6\Quarantine\1CB.tmp.bac_a01760 NSIS: infected - 1 skipped C:\Documents and Settings\Marc\.housecall6.6\Quarantine\1CB.tmp.bac_a01760 CryptFF.b: infected - 1 skipped C:\Documents and Settings\Marc\.housecall6.6\Quarantine\[release] megatech 50.wma.bac_a01760 Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\Marc\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Marc\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped C:\Documents and Settings\Marc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Marc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Marc\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Marc\Local Settings\Temp\hpodvd09.log Object is locked skipped C:\Documents and Settings\Marc\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Marc\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Marc\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\QooBox\Quarantine\C\Program Files\TTC.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0002/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0006 Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0007 Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0008 Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0009 Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0010 Infected: Trojan-Downloader.Win32.Small.dxm skipped C:\QooBox\Quarantine\C\Temp\bY001.exe.vir NSIS: infected - 7 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\chpemgkg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\QooBox\Quarantine\catchme2007-08-12_120558.43.zip/jkklm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped C:\QooBox\Quarantine\catchme2007-08-12_120558.43.zip/byvspqq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\catchme2007-08-12_120558.43.zip ZIP: infected - 2 skipped C:\QooBox\Quarantine\catchme2007-08-12_153344.23.zip/oobualw.dll Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\QooBox\Quarantine\catchme2007-08-12_153344.23.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP2\A0000071.sys Infected: Trojan.Win32.Patched.ad skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP2\A0000076.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP5\A0000146.exe:exe.exe:$DATA Infected: Trojan.Win32.Obfuscated.gp skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP5\A0000168.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP5\A0000170.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP5\A0000188.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP5\A0000189.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP6\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{28EECD8B-AFFA-41D0-B313-2EB916DD74D6}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_vQMUL6baMD6KEGC Object is locked skipped C:\WINDOWS\Temp\mcmsc_CV6dv9ZNNCcKYhx Object is locked skipped C:\WINDOWS\Temp\mcmsc_Oznik9jNYIprKkl Object is locked skipped C:\WINDOWS\Temp\mcmsc_TXsrFPOAF1HSxi3 Object is locked skipped C:\WINDOWS\Temp\mcmsc_VNYNmISjnKPbscL Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\I386\Apps\APP20310\src\HPSummer2005.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.MyWay.j skipped D:\I386\Apps\APP20310\src\HPSummer2005.exe WiseSFX: infected - 1 skipped D:\I386\Apps\APP20310\src\HPSummer2005.exe WiseSFX Dropper: infected - 1 skipped D:\System Volume Information\_restore{2466A83D-1B81-456E-9766-38C2B7E48210}\RP6\change.log Object is locked skipped Scan process completed. ComboFix 07-08-12.5 - "Marc" 2007-08-12 15:29:42.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.130 [GMT -4:00] Command switches used :: C:\Documents and Settings\Marc\Desktop\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\oobualw.dll C:\Temp\bY001.exe C:\WINDOWS\Setup167.exe C:\WINDOWS\qooz ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Viewpoint C:\Temp\bY001.exe C:\WINDOWS\Setup167.exe C:\WINDOWS\system32\oobualw.dll ((((((((((((((((((((((((( Files Created from 2007-07-12 to 2007-08-12 ))))))))))))))))))))))))))))))) 2007-08-12 11:56 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-11 18:37 <DIR> d-------- C:\Deckard 2007-08-11 18:02 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-08-11 13:27 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-11 11:08 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2007-08-11 00:42 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\acccore 2007-08-10 23:55 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-08-10 23:30 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-08-10 22:18 <DIR> d-------- C:\DOCUME~1\Marc\.housecall6.6 2007-08-10 10:16 <DIR> d---s---- C:\DOCUME~1\Marc\UserData 2007-08-10 09:21 1,572,864 --ah----- C:\DOCUME~1\Marc\NTUSER.DAT 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\WINDOWS 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Symantec 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\SampleView 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Real 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\InterMute 2007-08-10 09:21 <DIR> d-------- C:\DOCUME~1\Marc\APPLIC~1\Apple Computer 2007-08-10 08:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-08-09 18:35 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Real 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\InterMute 2007-08-09 18:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer 2007-08-03 23:42 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2007-08-03 23:40 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2007-08-03 23:40 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2007-08-03 23:40 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2007-08-03 23:40 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2007-08-03 23:40 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2007-08-03 23:39 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2007-08-03 23:37 <DIR> d-------- C:\Program Files\McAfee.com 2007-08-03 23:36 <DIR> d-------- C:\Program Files\McAfee 2007-08-03 23:36 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-08-03 21:51 <DIR> d-------- C:\Program Files\Lavasoft 2007-08-03 21:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-03 21:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-08-03 21:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee 2007-08-03 17:50 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-08-03 17:28 <DIR> d-------- C:\Temp 2007-07-30 18:12 <DIR> d-------- C:\WINDOWS\qooz 2007-07-30 18:12 <DIR> d-------- C:\Program Files\Common Files\qooz (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-11 17:28 --------- d-------- C:\Program Files\QuickTime 2007-08-11 17:20 --------- d-------- C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor 2007-08-11 17:19 --------- d-a------ C:\Program Files\Common Files\LightScribe 2007-08-09 22:17 --------- d-------- C:\Program Files\DivX 2007-08-09 18:19 --------- d-------- C:\Program Files\AIM 2007-08-03 23:12 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-08-03 23:12 --------- d-------- C:\Program Files\PC-Doctor for Windows 2007-08-03 17:34 14336 --a------ C:\WINDOWS\system32\svchost.exe 2007-08-03 17:34 14336 --a------ C:\WINDOWS\system32\dllcache\svchost.exe 2007-05-16 11:12 86528 --a------ C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 11:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 11:12 510976 --a------ C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 11:12 1314816 --a------ C:\WINDOWS\system32\dllcache\msoe.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSPower"="SiSPower.dll" [2005-04-12 11:31 C:\WINDOWS\system32\SiSPower.dll] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 18:34] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 09:54] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-01-27 13:17] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-24 18:59] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 04:48] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-13 23:07] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:00] "Aim6"="C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" [2006-09-25 20:52] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-09-02 20:36:21] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 22:28:24] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R2 WUSB54GCSVC;WUSB54GCSVC;"C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe" S3 BCM42RLY;BCM42RLY;\??\C:\WINDOWS\System32\BCM42RLY.SYS Contents of the 'Scheduled Tasks' folder 2007-08-04 03:38:47 C:\WINDOWS\Tasks\McDefragTask.job - c:\PROGRA~1\mcafee\mqc\QcConsol.exe 2007-08-04 03:38:45 C:\WINDOWS\Tasks\McQcTask.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-12 15:33:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-12 15:37:09 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-12 15:37 C:\ComboFix2.txt ... 2007-08-12 12:08 --- E O F --- |
|
|
|
|
08-12-2007, 04:29 PM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: Pop-ups and recurring infections - can't clean.
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe"
"C:\Documents and Settings\HP_Owner\Shared\(Better Version) megatech 54.wma"
"C:\Documents and Settings\HP_Owner\Shared\(naked) megatech 21.wma"
"C:\Documents and Settings\HP_Owner\Shared\by Fry - megatech 40.wma"
"C:\Documents and Settings\HP_Owner\Shared\HuMMeR megatech 45.wma"
"C:\Documents and Settings\HP_Owner\Shared\Imogen Heap- Foolish.wma"
"C:\Documents and Settings\HP_Owner\Shared\megatech 08.wma"
'C:\Documents and Settings\HP_Owner\Shared\shared by m0m get the party ktu remix 25.wma"
"C:\Documents and Settings\HP_Owner\Shared\Top of Charts - 2005 (love).wma"
"C:\Documents and Settings\HP_Owner\Shared\your love shines on me 23.wma"
"C:\Documents and Settings\HP_Owner\Shared\[[ your love shines on me 29.wma"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"C:\Documents and Settings\Marc\.housecall6.6\Quarantine"
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
"%systemdrive%\VundoFix Backups"
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
08-12-2007, 04:30 PM
|
#7 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: Pop-ups and recurring infections - can't clean.
Quote:
__________________
Question - what have you done for the community today? |
|
|
|
|
|
08-13-2007, 08:59 PM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: Pop-ups and recurring infections - can't clean.
Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
