|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-02-2007, 01:08 AM
|
#1 (permalink) |
|
Registered User
|
winantispyware removal - impossile
I have norton 360 installed and updated. Even so, i got a bug from nowhere and once in a while i get popups with winantispyware. of course, i didn't install or download anything from that site.
norton 360 found and removed the following viruses, but not this one  :trojan vundo - 6 times trojan nebuler adware.shorty trojan horse after i read some of the posts in this forum, i understood that there are a lot of different opinions on this particular problem. and various fixes, so i decided to start a new thread because my problem seems to be somewhat different. i tried to install combofix. it says that it can't install reg.exe. after 4-5 popups of error send/don't send to microsoft, it says that i need administrative privileges ( and i am logged in as computer administrator ) and the setup shts down. i installed the latest version of hjt from trendsecure.com aand i run it. i saved a log, but it;s too technical for me. i didn't delete nothing, i just run the scan and saved the log. what next ? thank you. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-02-2007, 06:40 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Hello, and welcome to TSF.
You'll find everything we want members to do before creating a malware removal assistance thread here: Please follow MicroBell's 5 Step process outlined here: http://www.techsupportforum.com/secu...tml#post342651 After running through all the steps, please post the requested logs. If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-03-2007, 02:32 PM
|
#3 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
very important: i went to tools-manage add-ons and i disabled 3 weird dll's.100% they had something to do with my pop-up problems.also, with msconfig i disabled another weird dll that was loading at start-up, but that didn't solve the problem.
could't run the panda online scan because the "scan" buttton is just a picture with no link behind. this is my dss log: Deckard's System Scanner v20070905.67 Run by Leo 2005 on 2007-10-03 23:19:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 10: 2007-10-03 20:19:15 UTC - RP675 - Deckard's System Scanner Restore Point 9: 2007-10-03 19:53:40 UTC - RP674 - Removed Microsoft Visual C++ 2005 Redistributable 8: 2007-10-03 19:35:51 UTC - RP673 - System Checkpoint 7: 2007-10-02 10:24:29 UTC - RP672 - Installed DirectX 6: 2007-10-02 10:10:55 UTC - RP671 - Installed BioShock -- First Restore Point -- 1: 2007-10-01 13:52:55 UTC - RP666 - System Checkpoint Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 78% (more than 75%). -- HijackThis (run as Leo 2005.exe) -------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:22:06, on 03.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\explorer.exe C:\Program Files\Microsoft Office 2007\Office12\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\Leo 2005\Desktop\dss.exe C:\Program Files\Common Files\Microsoft Shared\office12\offlb.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Leo 2005.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {827B3A67-61E3-41C4-82B6-E9FDC2D31768} - C:\WINDOWS\system32\ddccb.dll O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\iifddby.dll O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\sihojuvd.dll O2 - BHO: (no name) - {9F3FFDCD-0BB8-44DE-872A-6BE1DEE91C95} - C:\WINDOWS\system32\jkkjj.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\wbfkdnmq.dll",sitypnow O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: ADSL.lnk = ? (User 'SYSTEM') O4 - .DEFAULT Startup: ADSL.lnk = ? (User 'Default user') O4 - Startup: ADSL.lnk = ? O4 - Global Startup: iTunes.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI69DF~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI69DF~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/n...tective-nm.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-36.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120342234327 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1130356325062 O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD983414-25A6-4457-9F7D-7E8B54B18CF8}: NameServer = 193.231.100.130 193.231.100.134 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI69DF~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: iifddby - C:\WINDOWS\SYSTEM32\iifddby.dll O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 13393 bytes -- File Associations ----------------------------------------------------------- .js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe,2 .js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product> R2 CDRPDACC (Arrowkey Device Access) - c:\program files\dvdxcopy platinum\shared\cdrpdacc.sys <Not Verified; Arrowkey; CD Device Access> R2 ElbyCDIO (ElbyCDIO Driver) - c:\windows\system32\drivers\elbycdio.sys <Not Verified; Elaborate Bytes AG; CDRTools> R3 ElbyCDFL - c:\windows\system32\drivers\elbycdfl.sys <Not Verified; SlySoft, Inc.; CloneCD> R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> R3 Pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S3 inibtmgr (WD Bridge Controller Driver) - c:\windows\system32\drivers\inibtmgr.sys <Not Verified; Western Digital; WD 1394 Device Button Manager Driver> S3 P2k (Motorola USB Device) - c:\windows\system32\drivers\p2k.sys <Not Verified; Motorola Inc; P2k Driver> S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> S3 usb2vcom (USB to Serial Bridge Controller) - c:\windows\system32\drivers\usb2vcom.sys <Not Verified; Ark Pioneer Microelectronics Ltd.; USB to Serial Bridge Controller> S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 st330service (SpeedTouch 330 Manager) - c:\program files/thomson speedtouch/st330/service/st330service.exe -service <Not Verified; THOMSON Telecom Belgium; Host Service> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe S4 RetroLauncher (Retrospect Launcher) - c:\progra~1\dantz\retros~1\retrorun.exe <Not Verified; Dantz Development Corporation; Retrospect> S4 RetroWDSvc (Retrospect WD Service) - c:\progra~1\dantz\retros~1\wdsvc.exe <Not Verified; Dantz Development Corporation; Retrospect> S4 SandraDataSrv (Sandra Data Service) - c:\program files\sandra lite 2005\rpcdatasrv.exe <Not Verified; SiSoftware; SiSoftware Sandra 2005.SR3> S4 SandraTheSrv (Sandra Service) - c:\program files\sandra lite 2005\rpcsandrasrv.exe <Not Verified; SiSoftware; SiSoftware Sandra 2005.SR3> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom NetXtreme 57xx Gigabit Controller Device ID: PCI\VEN_14E4&DEV_1677&SUBSYS_01761028&REV_01\4&1D7EFF9E&0&00E0 Manufacturer: Broadcom Name: Broadcom NetXtreme 57xx Gigabit Controller PNP Device ID: PCI\VEN_14E4&DEV_1677&SUBSYS_01761028&REV_01\4&1D7EFF9E&0&00E0 Service: b57w2k Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318} Description: PnP BIOS Extension Device ID: ROOT\SYSTEM\0004 Manufacturer: (Standard system devices) Name: PnP BIOS Extension PNP Device ID: ROOT\SYSTEM\0004 Service: d347bus -- Scheduled Tasks ------------------------------------------------------------- 2007-10-01 09:54:04 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-09-03 and 2007-10-03 ----------------------------- 2007-10-03 21:10:14 86080 --a------ C:\WINDOWS\system32\wbfkdnmq.dll 2007-10-03 21:04:30 493427 ---hs---- C:\WINDOWS\system32\bccdd.bak1 2007-10-03 21:04:04 320608 --a------ C:\WINDOWS\system32\ddccb.dll 2007-10-02 20:02:47 487310 ---hs---- C:\WINDOWS\system32\jjkkj.ini2 2007-10-02 18:27:58 85056 --a------ C:\WINDOWS\system32\hoywojum.dll 2007-10-02 17:16:05 77376 --a------ C:\WINDOWS\system32\sihojuvd.dll 2007-10-02 13:31:58 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\Bioshock 2007-10-02 13:31:50 0 dr-h----- C:\Documents and Settings\Leo 2005\Application Data\SecuROM 2007-10-02 13:10:26 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\InstallShield 2007-10-02 11:41:12 0 d-------- C:\Program Files\DAEMON Tools 4.10 2007-10-02 11:37:41 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-10-02 10:20:31 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\WinRAR 2007-10-02 09:52:40 0 d-------- C:\Program Files\Trend Micro 2007-10-02 08:07:09 85056 --a------ C:\WINDOWS\system32\qsxjfslw.dll 2007-10-02 08:01:36 623953 ---hs---- C:\WINDOWS\system32\nqtwa.bak1 2007-10-02 08:01:05 319072 --a------ C:\WINDOWS\system32\awtqn.dll 2007-10-01 18:53:42 624116 ---hs---- C:\WINDOWS\system32\fhkmp.bak1 2007-10-01 18:53:21 310880 --a------ C:\WINDOWS\system32\pmkhf.dll 2007-10-01 08:38:51 486602 ---hs---- C:\WINDOWS\system32\jjkkj.bak2 2007-09-30 22:23:58 320608 --a------ C:\WINDOWS\system32\vturs.dll 2007-09-30 11:54:57 6448 ---hs---- C:\WINDOWS\system32\jjkkj.bak1 2007-09-30 11:54:38 320608 --a------ C:\WINDOWS\system32\jkkjj.dll 2007-09-29 14:14:38 84032 --a------ C:\WINDOWS\system32\dqfmqvku.dll 2007-09-29 13:33:42 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI 2007-09-29 12:09:44 0 d-------- C:\WINDOWS\system32\AGEIA 2007-09-29 12:09:42 0 d-------- C:\Program Files\AGEIA Technologies 2007-09-28 08:45:29 622302 ---hs---- C:\WINDOWS\system32\ybeeg.bak1 2007-09-28 08:45:05 311392 --a------ C:\WINDOWS\system32\geeby.dll 2007-09-27 10:49:34 6488 ---hs---- C:\WINDOWS\system32\ggjlm.bak1 2007-09-27 10:49:10 305248 --a------ C:\WINDOWS\system32\mljgg.dll 2007-09-26 13:22:57 0 d-------- C:\Program Files\iPod 2007-09-25 20:55:55 614361 ---hs---- C:\WINDOWS\system32\hjkmp.bak1 2007-09-23 21:58:05 613595 ---hs---- C:\WINDOWS\system32\ilnmp.bak1 2007-09-22 19:38:44 615912 --ahs---- C:\WINDOWS\system32\pstwa.ini2 2007-09-21 21  48 621013 --ahs---- C:\WINDOWS\system32\pstwa.bak22007-09-20 11:03:25 44054 --a------ C:\WINDOWS\system32\jkkhfdb.dll 2007-09-20 11:02:42 15872 --a------ C:\d.exe 2007-09-20 11:02:38 2 --a------ C:\-1465867248 2007-09-20 11:02:13 44054 --a------ C:\WINDOWS\system32\urqonll.dll 2007-09-20 10:59:07 44054 --a------ C:\WINDOWS\system32\opnmnkj.dll 2007-09-20 10:58:45 6448 --ahs---- C:\WINDOWS\system32\pstwa.bak1 2007-09-20 10:58:07 44054 --a------ C:\WINDOWS\system32\mljklki.dll 2007-09-20 10:57:12 44054 --a------ C:\WINDOWS\system32\byxwxyv.dll 2007-09-20 10:54:38 44054 --a------ C:\WINDOWS\system32\nnnonkl.dll 2007-09-20 10:53:11 44054 --a------ C:\WINDOWS\system32\iifddby.dll 2007-09-20 10:48:51 0 d-------- C:\Program Files\JAlbum7.2 2007-09-17 21:23:00 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-17 21:23:00 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-17 21:22:58 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2007-09-17 21:22:58 739840 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-12 22:48:47 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\mIRC 2007-09-10 21:12:56 0 d-------- C:\WINDOWS\SxsCaPendDel -- Find3M Report --------------------------------------------------------------- 2007-10-03 23:22:44 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-03 21:04:26 0 d-------- C:\Program Files\Symantec 2007-10-02 18:27:30 647 --a------ C:\case.bin 2007-10-02 13:18:57 0 d-------- C:\Program Files\DC++ 2007-10-02 13:10:55 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-09-29 18:05:00 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\uTorrent 2007-09-29 13:30:05 0 d-------- C:\Program Files\ATI Technologies 2007-09-29 13:24:29 0 d-------- C:\Program Files\Creative 2007-09-29 12:09:14 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-26 18:25:05 0 d-------- C:\Program Files\Yahoo! 2007-09-26 18:24:41 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\Yahoo! 2007-09-26 15:13:58 0 d-------- C:\Program Files\DivX 2007-09-26 13:27:57 0 d-------- C:\Program Files\Apple Software Update 2007-09-26 13:23:14 0 d-------- C:\Program Files\iTunes 2007-09-26 13:10:52 0 d-------- C:\Program Files\Norton 360 2007-09-20 08:57:08 0 d-------- C:\Program Files\NoAdware5.0 2007-09-13 19:56:26 286720 --a------ C:\WINDOWS\iun506.exe <Not Verified; Indigo Rose Corporation; Setup Factory 5.0 Uninstaller> 2007-09-13 19:56:19 0 d-------- C:\Program Files\OPFV 2007 2007-08-31 13:51:46 0 d-------- C:\Program Files\VoipStunt 2007-08-21 21:05:00 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart> 2007-08-21 03:26:52 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2007-08-21 03:26:52 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2007-08-19 15:04:04 0 d-------- C:\Program Files\Text-Reader programs 2007-08-16 01:33:14 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-08-16 01:30:26 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-08-14 23:19:26 0 d-------- C:\Program Files\Declaratii_BASS 2007-08-14 23:19:04 0 d-------- C:\Program Files\D394 2007-08-14 20:25:20 0 d-------- C:\Program Files\ReviSal 2007-08-14 20:24:54 6776 --a------ C:\denumiri_fisiere.bin 2007-08-14 20:16:04 0 d-------- C:\Program Files\Bilant 0607 2007-08-14 20:13:06 770560 --a------ C:\WINDOWS\system32\VFP5ENU.DLL <Not Verified; Microsoft Corporation; Microsoft Visual FoxPro for Windows> 2007-08-14 20:13:06 3223824 --a------ C:\WINDOWS\system32\VFP500.DLL <Not Verified; Microsoft Corporation; Microsoft Visual FoxPro for Windows> 2007-08-14 20:11:02 0 d-------- C:\Program Files\Declaratia 205 (an 2006) 2007-08-14 20:11:00 0 d-------- C:\Program Files\Declaratii fiscale 2007 2007-08-08 22:16:26 0 d-------- C:\Documents and Settings\Leo 2005\Application Data\Apple Computer 2007-07-09 09:41:52 845315 --a------ C:\Raportare_FNUASS.exe <Not Verified; Casa de Asigurari de Sanatate Iasi; Raportare FNUASS> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{827B3A67-61E3-41C4-82B6-E9FDC2D31768}] 03.10.2007 21:04 320608 --a------ C:\WINDOWS\system32\ddccb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{837B45D6-BF85-457D-AABF-6D2E7815F791}] 20.09.2007 10:53 44054 --a------ C:\WINDOWS\system32\iifddby.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD4D75-2429-462e-BD4E-443F233F6033}] 02.10.2007 17:16 77376 --a------ C:\WINDOWS\system32\sihojuvd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9F3FFDCD-0BB8-44DE-872A-6BE1DEE91C95}] 30.09.2007 11:54 320608 --a------ C:\WINDOWS\system32\jkkjj.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [17.09.2003 18:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [18.06.2003 09:00] "CTHelper"="CTHELPER.EXE" [09.04.2007 12:32 C:\WINDOWS\SYSTEM32\CtHelper.exe] "Tweak UI"="TWEAKUI.CPL" [25.03.2003 05:49 C:\WINDOWS\SYSTEM32\tweakui.cpl] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [12.07.2007 04:00] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [15.03.2007 06:10] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [12.03.2007 18:30] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [14.09.2007 10:00] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [10.11.2006 12:35] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [10.08.2004 13:00] "SearchIndexer"="C:\WINDOWS\system32\wbfkdnmq.dll" [03.10.2007 21:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [30.11.2006 22:49] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoThumbnailCache"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [05.02.2007 15:39 294400] "{837B45D6-BF85-457D-AABF-6D2E7815F791}"= C:\WINDOWS\system32\iifddby.dll [20.09.2007 10:53 44054] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifddby] iifddby.dll 20.09.2007 10:53 44054 C:\WINDOWS\SYSTEM32\iifddby.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjjq32] winjjq32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\awtsp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ADSL.lnk] backup=C:\WINDOWS\pss\ADSL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Leo 2005^Start Menu^Programs^Startup^Winamp.lnk] backup=C:\WINDOWS\pss\Winamp.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTXFIREG] CTxfiReg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools 4.10\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold] C:\PROGRA~1\MODEMO~1\moh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2kAutostart] V330 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash] "C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime 5\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchIndexer] rundll32.exe "C:\WINDOWS\system32\hoywojum.dll",sitypnow [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetIcon] \Program Files\WDC\SetIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager] WDBtnMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp5_12\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter] wfxsnt40.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wfxsvc"=2 (0x2) "Fax"=2 (0x2) "UleadBurningHelper"=2 (0x2) "Macromedia Licensing Service"=3 (0x3) "WMPNetworkSvc"=2 (0x2) "SandraTheSrv"=3 (0x3) "SandraDataSrv"=3 (0x3) "RetroWDSvc"=2 (0x2) "RetroLauncher"=2 (0x2) "Adobe LM Service"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34030162-e5b5-11d9-a607-00132055a651}] AutoRun\command- J:\BSAutoRun.exe *Newly Created Service* - COMHOST -- End of Deckard's System Scanner: finished at 2007-10-03 23:23:37 ------------ |
|
|
|
|
10-03-2007, 04:23 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- IMPORTANT! First, please delete any existing version of ComboFix you might have. Also delete C:\ComboFix folder if it exists. ComboFix is updated frequently.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-04-2007, 12:46 AM
|
#5 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
i run combofix and in the first window it went through about 27 steps, then deleted a lot of dll's , bak's and some other weird named files. then a message said a new window will appear to complete the cleaning process, and it did. but next, the blue screen of death came up, with this error: KERNEL_STACK_INPAGE_ERROR. so, i had to restart the computer. after reboot, still disconnected from the internet, i run combofix for the second time. after that, i connected to the internet and i run hjt. you'll find both logs below.
ComboFix 07-10-04.5 - Leo 2005 2007-10-04 9:31:04.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.419 [GMT 3:00] Running from: C:\Documents and Settings\Leo 2005\desktop\combofix.exe Command switches used :: /killall . ((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 ))))))))))))))))))))))))))))))) . 2007-10-04 09:19 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 23:18 <DIR> d-------- C:\Deckard 2007-10-03 21:04 320,608 --a------ C:\WINDOWS\SYSTEM32\ddccb.dll 2007-10-02 17:16 77,376 --a------ C:\WINDOWS\SYSTEM32\sihojuvd.dll 2007-10-02 13:31 <DIR> dr-h----- C:\Documents and Settings\Leo 2005\Application Data\SecuROM 2007-10-02 13:31 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\Bioshock 2007-10-02 13:10 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\InstallShield 2007-10-02 11:41 <DIR> d-------- C:\Program Files\DAEMON Tools 4.10 2007-10-02 11:37 685,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys 2007-10-02 10:20 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\WinRAR 2007-10-02 09:52 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-01 18:53 310,880 --a------ C:\WINDOWS\SYSTEM32\pmkhf.dll 2007-09-29 13:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2007-09-29 12:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\AGEIA 2007-09-29 12:09 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-09-26 13:22 <DIR> d-------- C:\Program Files\iPod 2007-09-20 10:48 <DIR> d-------- C:\Program Files\JAlbum7.2 2007-09-18 14:43 43,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys 2007-09-18 14:43 317,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys 2007-09-18 14:43 278,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys 2007-09-17 21:23 823,296 --a------ C:\WINDOWS\SYSTEM32\divx_xx0c.dll 2007-09-17 21:23 823,296 --a------ C:\WINDOWS\SYSTEM32\divx_xx07.dll 2007-09-17 21:22 802,816 --a------ C:\WINDOWS\SYSTEM32\divx_xx11.dll 2007-09-17 21:22 739,840 --a------ C:\WINDOWS\SYSTEM32\DivX.dll 2007-09-12 22:48 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\mIRC 2007-09-12 02:14 156,992 --a------ C:\WINDOWS\SYSTEM32\DivXCodecVersionChecker.exe 2007-09-10 21:12 <DIR> d-------- C:\WINDOWS\SxsCaPendDel . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-04 08:41 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2007-10-03 23:22 --------- d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-03 21:04 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-10-03 21:04 60800 --a------ C:\WINDOWS\SYSTEM32\S32EVNT1.DLL 2007-10-03 21:04 123952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-10-03 21:04 10740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-10-03 21:04 --------- d-------- C:\Program Files\Symantec 2007-10-02 18:27 647 --a------ C:\case.bin 2007-10-02 13:18 --------- d-------- C:\Program Files\DC++ 2007-10-02 13:10 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-10-01 14:48 108144 --a------ C:\WINDOWS\SYSTEM32\CmdLineExt.dll 2007-09-29 18:05 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\uTorrent 2007-09-29 13:30 --------- d-------- C:\Program Files\ATI Technologies 2007-09-29 13:24 --------- d-------- C:\Program Files\Creative 2007-09-29 12:09 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-26 18:25 --------- d-------- C:\Program Files\Yahoo! 2007-09-26 18:24 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\Yahoo! 2007-09-26 18:24 --------- d-------- C:\Documents and Settings\All Users\Application Data\yahoo! 2007-09-26 15:13 --------- d-------- C:\Program Files\DivX 2007-09-26 13:27 --------- d-------- C:\Program Files\Apple Software Update 2007-09-26 13:23 --------- d-------- C:\Program Files\iTunes 2007-09-26 13:10 --------- d-------- C:\Program Files\Norton 360 2007-09-20 08:57 --------- d-------- C:\Program Files\NoAdware5.0 2007-09-18 23:26 --------- d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-09-18 14:44 1430 --a------ C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 14:44 1421 --a------ C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 14:44 1415 --a------ C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 14:44 10658 --a------ C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-13 19:56 286720 --a------ C:\WINDOWS\iun506.exe 2007-09-13 19:56 --------- d-------- C:\Program Files\OPFV 2007 2007-08-31 13:51 --------- d-------- C:\Program Files\VoipStunt 2007-08-22 05:33 46432 --a------ C:\WINDOWS\system32\drivers\ativvpxx.vp 2007-08-22 05:09 352256 --a------ C:\WINDOWS\SYSTEM32\ATIDEMGX.dll 2007-08-22 05:07 307200 --a------ C:\WINDOWS\SYSTEM32\atiiiexx.dll 2007-08-22 05:07 268800 --a------ C:\WINDOWS\SYSTEM32\ati2dvag.dll 2007-08-22 05:07 2417664 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-08-22 05:07 2417664 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\ati2mtag.sys 2007-08-22 04:59 26112 --a------ C:\WINDOWS\SYSTEM32\Ati2mdxx.exe 2007-08-22 04:59 143360 --a------ C:\WINDOWS\SYSTEM32\atipdlxx.dll 2007-08-22 04:58 43520 --a------ C:\WINDOWS\SYSTEM32\ati2edxx.dll 2007-08-22 04:58 122880 --a------ C:\WINDOWS\SYSTEM32\ati2evxx.dll 2007-08-22 04:57 487424 --a------ C:\WINDOWS\SYSTEM32\ati2evxx.exe 2007-08-22 04:56 53248 --a------ C:\WINDOWS\SYSTEM32\ATIDDC.DLL 2007-08-22 04:48 8306688 --a------ C:\WINDOWS\SYSTEM32\atioglx2.dll 2007-08-22 04:47 3091392 --a------ C:\WINDOWS\SYSTEM32\ati3duag.dll 2007-08-22 04:35 1586816 --a------ C:\WINDOWS\SYSTEM32\ativvaxx.dll 2007-08-22 04:21 5435392 --a------ C:\WINDOWS\SYSTEM32\atioglxx.dll 2007-08-22 04:19 266240 --a------ C:\WINDOWS\SYSTEM32\atikvmag.dll 2007-08-22 04:17 17408 --a------ C:\WINDOWS\SYSTEM32\atitvo32.dll 2007-08-22 04:15 172032 --a------ C:\WINDOWS\SYSTEM32\atiok3x2.dll 2007-08-22 04:13 49152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll 2007-08-22 04:11 450560 --a------ C:\WINDOWS\SYSTEM32\ati2cqag.dll 2007-08-21 21:05 593920 --------- C:\WINDOWS\SYSTEM32\ati2sgag.exe 2007-08-21 03:26 81920 --a------ C:\WINDOWS\SYSTEM32\dpl100.dll 2007-08-21 03:26 196608 --a------ C:\WINDOWS\SYSTEM32\dtu100.dll 2007-08-19 15:04 --------- d-------- C:\Program Files\Text-Reader programs 2007-08-16 01:33 524288 --a------ C:\WINDOWS\SYSTEM32\DivXsm.exe 2007-08-16 01:33 43528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-08-16 01:33 3596288 --a------ C:\WINDOWS\SYSTEM32\qt-dx331.dll 2007-08-16 01:33 200704 --a------ C:\WINDOWS\SYSTEM32\ssldivx.dll 2007-08-16 01:33 129784 --------- C:\WINDOWS\SYSTEM32\pxafs.dll 2007-08-16 01:33 120056 --------- C:\WINDOWS\SYSTEM32\pxcpyi64.exe 2007-08-16 01:33 118520 --------- C:\WINDOWS\SYSTEM32\pxinsi64.exe 2007-08-16 01:33 1044480 --a------ C:\WINDOWS\SYSTEM32\libdivx.dll 2007-08-16 01:31 593920 --a------ C:\WINDOWS\SYSTEM32\dpuGUI11.dll 2007-08-16 01:31 57344 --a------ C:\WINDOWS\SYSTEM32\dpv11.dll 2007-08-16 01:31 53248 --a------ C:\WINDOWS\SYSTEM32\dpuGUI10.dll 2007-08-16 01:31 344064 --a------ C:\WINDOWS\SYSTEM32\dpus11.dll 2007-08-16 01:31 294912 --a------ C:\WINDOWS\SYSTEM32\dpu11.dll 2007-08-16 01:31 294912 --a------ C:\WINDOWS\SYSTEM32\dpu10.dll 2007-08-16 01:30 12288 --a------ C:\WINDOWS\SYSTEM32\DivXWMPExtType.dll 2007-08-14 23:19 --------- d-------- C:\Program Files\Declaratii_BASS 2007-08-14 23:19 --------- d-------- C:\Program Files\D394 2007-08-14 20:25 --------- d-------- C:\Program Files\ReviSal 2007-08-14 20:24 6776 --a------ C:\denumiri_fisiere.bin 2007-08-14 20:16 --------- d-------- C:\Program Files\Bilant 0607 2007-08-14 20:13 770560 --a------ C:\WINDOWS\SYSTEM32\VFP5ENU.DLL 2007-08-14 20:13 3223824 --a------ C:\WINDOWS\SYSTEM32\VFP500.DLL 2007-08-14 20:11 --------- d-------- C:\Program Files\Declaratii fiscale 2007 2007-08-14 20:11 --------- d-------- C:\Program Files\Declaratia 205 (an 2006) 2007-08-08 22:16 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\Apple Computer 2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll 2007-07-30 19:19 271224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll 2007-07-30 19:19 207736 --a------ C:\WINDOWS\SYSTEM32\muweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\SYSTEM32\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\SYSTEM32\wups.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{827B3A67-61E3-41C4-82B6-E9FDC2D31768}] 2007-10-03 21:04 320608 --a------ C:\WINDOWS\system32\ddccb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 18:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 09:00] "CTHelper"="CTHELPER.EXE" [2007-04-09 12:32 C:\WINDOWS\SYSTEM32\CtHelper.exe] "Tweak UI"="TWEAKUI.CPL" [2003-03-25 05:49 C:\WINDOWS\SYSTEM32\tweakui.cpl] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-15 06:10] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ iTunes.lnk - C:\WINDOWS\Installer\{7FF9CD9C-6E0C-4462-9670-F424DCB32DAF}\iTunesIco.exe [2007-09-26 13:23:34] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ iTunes.lnk - C:\WINDOWS\Installer\{7FF9CD9C-6E0C-4462-9670-F424DCB32DAF}\iTunesIco.exe [2007-09-26 13:23:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoThumbnailCache"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifddby] iifddby.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjjq32] winjjq32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ADSL.lnk] backup=C:\WINDOWS\pss\ADSL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Leo 2005^Start Menu^Programs^Startup^Winamp.lnk] backup=C:\WINDOWS\pss\Winamp.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTXFIREG] CTxfiReg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools 4.10\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold] C:\PROGRA~1\MODEMO~1\moh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2kAutostart] V330 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash] "C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime 5\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchIndexer] rundll32.exe "C:\WINDOWS\system32\hoywojum.dll",sitypnow [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetIcon] \Program Files\WDC\SetIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager] WDBtnMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp5_12\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter] wfxsnt40.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wfxsvc"=2 (0x2) "Fax"=2 (0x2) "UleadBurningHelper"=2 (0x2) "Macromedia Licensing Service"=3 (0x3) "WMPNetworkSvc"=2 (0x2) "SandraTheSrv"=3 (0x3) "SandraDataSrv"=3 (0x3) "RetroWDSvc"=2 (0x2) "RetroLauncher"=2 (0x2) "Adobe LM Service"=3 (0x3) R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys R2 CDRPDACC;Arrowkey Device Access;\??\C:\Program Files\dvdXcopy Platinum\Shared\CDRPDACC.SYS S3 bcgame;Nostromo HID Device Minidriver;C:\WINDOWS\system32\drivers\bcgame.sys S3 inibtmgr;WD Bridge Controller Driver;C:\WINDOWS\system32\DRIVERS\inibtmgr.sys S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys S3 usb2vcom;USB to Serial Bridge Controller;C:\WINDOWS\system32\Drivers\usb2vcom.sys S3 XIRLINK;Veo Mobile/Advanced Web Camera;C:\WINDOWS\system32\DRIVERS\ucdnt.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34030162-e5b5-11d9-a607-00132055a651}] AutoRun\command- J:\BSAutoRun.exe *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2007-10-01 06:54:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-04 09:34:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-04 9:35:07 C:\ComboFix-quarantined-files.txt ... 2007-10-04 09:35 . --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:42:44, on 04.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\iTunes\iTunes.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {827B3A67-61E3-41C4-82B6-E9FDC2D31768} - C:\WINDOWS\system32\ddccb.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: ADSL.lnk = ? (User 'SYSTEM') O4 - .DEFAULT Startup: ADSL.lnk = ? (User 'Default user') O4 - Startup: ADSL.lnk = ? O4 - Global Startup: iTunes.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI69DF~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI69DF~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/n...tective-nm.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-36.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120342234327 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1130356325062 O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD983414-25A6-4457-9F7D-7E8B54B18CF8}: NameServer = 193.231.100.130 193.231.100.134 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI69DF~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: iifddby - iifddby.dll (file missing) O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 12306 bytes |
|
|
|
|
10-04-2007, 08:56 AM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Can you please locate and post this log:
C:\ComboFix-quarantined-files.txt
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-04-2007, 12:31 PM
|
#8 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Thank you, leorot.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
10-04-2007, 02:49 PM
|
#9 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
hello,
upon restart of my computer, while it was shutting down, i had to manually turn it off - it took too long to shut down. i've sent you the file - the malware. below is the hjt log. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:47:00, on 04.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE C:\Program Files\iTunes\iTunes.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: ADSL.lnk = ? (User 'SYSTEM') O4 - .DEFAULT Startup: ADSL.lnk = ? (User 'Default user') O4 - Startup: ADSL.lnk = ? O4 - Global Startup: iTunes.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI69DF~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI69DF~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/n...tective-nm.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-36.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120342234327 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1130356325062 O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD983414-25A6-4457-9F7D-7E8B54B18CF8}: NameServer = 193.231.100.130 193.231.100.134 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI69DF~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 12097 bytes |
|
|
|
|
10-04-2007, 02:51 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Interrupting ComboFix is not a good idea. How long is "too long" ?
Was a ComboFix log created? Please post it.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-04-2007, 02:58 PM
|
#13 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
ComboFix 07-10-04.5 - Leo 2005 2007-10-04 23:32:50.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.362 [GMT 3:00] Running from: C:\Documents and Settings\Leo 2005\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Leo 2005\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\SYSTEM32\ddccb.dll C:\WINDOWS\SYSTEM32\pmkhf.dll C:\WINDOWS\SYSTEM32\sihojuvd.dll . ((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 ))))))))))))))))))))))))))))))) . 2007-10-04 09:19 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 23:18 <DIR> d-------- C:\Deckard 2007-10-02 13:31 <DIR> dr-h----- C:\Documents and Settings\Leo 2005\Application Data\SecuROM 2007-10-02 13:31 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\Bioshock 2007-10-02 13:10 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\InstallShield 2007-10-02 11:41 <DIR> d-------- C:\Program Files\DAEMON Tools 4.10 2007-10-02 11:37 685,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys 2007-10-02 10:20 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\WinRAR 2007-10-02 09:52 <DIR> d-------- C:\Program Files\Trend Micro 2007-09-29 13:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2007-09-29 12:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\AGEIA 2007-09-29 12:09 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-09-26 13:22 <DIR> d-------- C:\Program Files\iPod 2007-09-20 10:48 <DIR> d-------- C:\Program Files\JAlbum7.2 2007-09-18 14:43 43,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtspx.sys 2007-09-18 14:43 317,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtspl.sys 2007-09-18 14:43 278,576 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\srtsp.sys 2007-09-17 21:23 823,296 --a------ C:\WINDOWS\SYSTEM32\divx_xx0c.dll 2007-09-17 21:23 823,296 --a------ C:\WINDOWS\SYSTEM32\divx_xx07.dll 2007-09-17 21:22 802,816 --a------ C:\WINDOWS\SYSTEM32\divx_xx11.dll 2007-09-17 21:22 739,840 --a------ C:\WINDOWS\SYSTEM32\DivX.dll 2007-09-12 22:48 <DIR> d-------- C:\Documents and Settings\Leo 2005\Application Data\mIRC 2007-09-12 02:14 156,992 --a------ C:\WINDOWS\SYSTEM32\DivXCodecVersionChecker.exe 2007-09-10 21:12 <DIR> d-------- C:\WINDOWS\SxsCaPendDel . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-04 09:41 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2007-10-03 23:22 --------- d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-03 21:04 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-10-03 21:04 123952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-10-03 21:04 10740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-10-03 21:04 --------- d-------- C:\Program Files\Symantec 2007-10-02 18:27 647 --a------ C:\case.bin 2007-10-02 13:18 --------- d-------- C:\Program Files\DC++ 2007-10-02 13:10 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-29 18:05 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\uTorrent 2007-09-29 13:30 --------- d-------- C:\Program Files\ATI Technologies 2007-09-29 13:24 --------- d-------- C:\Program Files\Creative 2007-09-29 12:09 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-26 18:25 --------- d-------- C:\Program Files\Yahoo! 2007-09-26 18:24 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\Yahoo! 2007-09-26 18:24 --------- d-------- C:\Documents and Settings\All Users\Application Data\yahoo! 2007-09-26 15:13 --------- d-------- C:\Program Files\DivX 2007-09-26 13:27 --------- d-------- C:\Program Files\Apple Software Update 2007-09-26 13:23 --------- d-------- C:\Program Files\iTunes 2007-09-26 13:10 --------- d-------- C:\Program Files\Norton 360 2007-09-20 08:57 --------- d-------- C:\Program Files\NoAdware5.0 2007-09-18 23:26 --------- d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-09-18 14:44 1430 --a------ C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 14:44 1421 --a------ C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 14:44 1415 --a------ C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 14:44 10658 --a------ C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-13 19:56 286720 --a------ C:\WINDOWS\iun506.exe 2007-09-13 19:56 --------- d-------- C:\Program Files\OPFV 2007 2007-08-31 13:51 --------- d-------- C:\Program Files\VoipStunt 2007-08-22 05:33 46432 --a------ C:\WINDOWS\system32\drivers\ativvpxx.vp 2007-08-22 05:07 2417664 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-08-22 04:13 49152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll 2007-08-19 15:04 --------- d-------- C:\Program Files\Text-Reader programs 2007-08-16 01:33 43528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-08-14 23:19 --------- d-------- C:\Program Files\Declaratii_BASS 2007-08-14 23:19 --------- d-------- C:\Program Files\D394 2007-08-14 20:25 --------- d-------- C:\Program Files\ReviSal 2007-08-14 20:24 6776 --a------ C:\denumiri_fisiere.bin 2007-08-14 20:16 --------- d-------- C:\Program Files\Bilant 0607 2007-08-14 20:11 --------- d-------- C:\Program Files\Declaratii fiscale 2007 2007-08-14 20:11 --------- d-------- C:\Program Files\Declaratia 205 (an 2006) 2007-08-08 22:16 --------- d-------- C:\Documents and Settings\Leo 2005\Application Data\Apple Computer 2007-07-09 09:41 845315 --a------ C:\Raportare_FNUASS.exe 2007-05-27 00:06 9232 --a------ C:\Documents and Settings\Leo 2005\mqdmmdfl.sys 2007-05-27 00:06 92064 --a------ C:\Documents and Settings\Leo 2005\mqdmmdm.sys 2007-05-27 00:06 79328 --a------ C:\Documents and Settings\Leo 2005\mqdmserd.sys 2007-05-27 00:06 66656 --a------ C:\Documents and Settings\Leo 2005\mqdmbus.sys 2007-05-27 00:06 6208 --a------ C:\Documents and Settings\Leo 2005\mqdmcmnt.sys 2007-05-27 00:06 5936 --a------ C:\Documents and Settings\Leo 2005\mqdmwhnt.sys 2007-05-27 00:06 4048 --a------ C:\Documents and Settings\Leo 2005\mqdmcr.sys 2007-05-27 00:06 25600 --a------ C:\Documents and Settings\Leo 2005\usbsermptxp.sys 2007-05-27 00:06 22768 --a------ C:\Documents and Settings\Leo 2005\usbsermpt.sys 2005-07-01 21:46 251 --a------ C:\Program Files\wt3d.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 18:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 09:00] "CTHelper"="CTHELPER.EXE" [2007-04-09 12:32 C:\WINDOWS\SYSTEM32\CtHelper.exe] "Tweak UI"="TWEAKUI.CPL" [2003-03-25 05:49 C:\WINDOWS\SYSTEM32\tweakui.cpl] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-15 06:10] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-10 13:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ iTunes.lnk - C:\WINDOWS\Installer\{7FF9CD9C-6E0C-4462-9670-F424DCB32DAF}\iTunesIco.exe [2007-09-26 13:23:34] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ iTunes.lnk - C:\WINDOWS\Installer\{7FF9CD9C-6E0C-4462-9670-F424DCB32DAF}\iTunesIco.exe [2007-09-26 13:23:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoThumbnailCache"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ADSL.lnk] backup=C:\WINDOWS\pss\ADSL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Leo 2005^Start Menu^Programs^Startup^Winamp.lnk] backup=C:\WINDOWS\pss\Winamp.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTXFIREG] CTxfiReg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools 4.10\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office 2007\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold] C:\PROGRA~1\MODEMO~1\moh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2kAutostart] V330 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash] "C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime 5\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetIcon] \Program Files\WDC\SetIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager] WDBtnMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp5_12\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter] wfxsnt40.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wfxsvc"=2 (0x2) "Fax"=2 (0x2) "UleadBurningHelper"=2 (0x2) "Macromedia Licensing Service"=3 (0x3) "WMPNetworkSvc"=2 (0x2) "SandraTheSrv"=3 (0x3) "SandraDataSrv"=3 (0x3) "RetroWDSvc"=2 (0x2) "RetroLauncher"=2 (0x2) "Adobe LM Service"=3 (0x3) R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys R2 CDRPDACC;Arrowkey Device Access;\??\C:\Program Files\dvdXcopy Platinum\Shared\CDRPDACC.SYS R3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys R3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys R3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys S3 bcgame;Nostromo HID Device Minidriver;C:\WINDOWS\system32\drivers\bcgame.sys S3 inibtmgr;WD Bridge Controller Driver;C:\WINDOWS\system32\DRIVERS\inibtmgr.sys S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe -k p2psvc S3 usb2vcom;USB to Serial Bridge Controller;C:\WINDOWS\system32\Drivers\usb2vcom.sys S3 XIRLINK;Veo Mobile/Advanced Web Camera;C:\WINDOWS\system32\DRIVERS\ucdnt.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34030162-e5b5-11d9-a607-00132055a651}] AutoRun\command- J:\BSAutoRun.exe *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2007-10-01 06:54:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-04 23:40:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-04 23:42:31 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-04 23:42 C:\ComboFix2.txt ... 2007-10-04 09:35 . --- E O F --- |
|
|
|
|
10-04-2007, 02:58 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Part of ComboFix routine is to restart Windows. If you force a manual shutdown on the machine, the process is interrupted.
Edit...thanks for the log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-04-2007, 03:16 PM
|
#15 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
SearchIndexer.exe is generally a legit Windows process, related to a Search function, sometimes of MS Office.
One thing malware does is try to emulate legit items, to better hide itself. I realize you're seeing the O4 startup entry of SearchIndexer but they are not the same. You can check the file's properties by right clicking on it, select properties, and scan it at VirusTotal: Please go to: VirusTotal
Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-06-2007, 06:46 AM
|
#16 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
Fisier SearchIndexer.exe primit la data de 2007.10.06 14:36:44 (CET)
Antivirus Versiune Ultima actualizare Rezultat AhnLab-V3 2007.10.6.0 2007.10.05 - AntiVir 7.6.0.20 2007.10.05 - Authentium 4.93.8 2007.10.05 - Avast 4.7.1051.0 2007.10.05 - AVG 7.5.0.488 2007.10.06 - BitDefender 7.2 2007.10.06 - CAT-QuickHeal 9.00 2007.10.06 - ClamAV 0.91.2 2007.10.06 - DrWeb 4.44.0.09170 2007.10.06 - eSafe 7.0.15.0 2007.10.04 - eTrust-Vet 31.2.5190 2007.10.06 - Ewido 4.0 2007.10.06 - FileAdvisor 1 2007.10.06 - Fortinet 3.11.0.0 2007.10.06 - F-Prot 4.3.2.48 2007.10.05 - F-Secure 6.70.13030.0 2007.10.05 - Ikarus T3.1.1.12 2007.10.06 - Kaspersky 7.0.0.125 2007.10.06 - McAfee 5135 2007.10.05 - Microsoft 1.2908 2007.10.06 - NOD32v2 2575 2007.10.06 - Norman 5.80.02 2007.10.05 - Panda 9.0.0.4 2007.10.06 - Prevx1 V2 2007.10.06 - Rising 19.43.50.00 2007.10.06 - Sophos 4.22.0 2007.10.06 - Sunbelt 2.2.907.0 2007.10.06 - Symantec 10 2007.10.06 - TheHacker 6.2.6.078 2007.10.06 - VBA32 3.12.2.4 2007.10.05 - VirusBuster 4.3.26:9 2007.10.05 - Webwasher-Gateway 6.0.1 2007.10.05 - Informatii suplimentare File size: 300032 bytes MD5: 2ec497aa4b728d1b1a368acf2e309e8b SHA1: d88a127a212391b82204b52f8bc9f1d7aefd6026 Last edited by tetonbob; 10-06-2007 at 07:49 AM. |
|
|
|
|
10-06-2007, 07:51 AM
|
#17 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
do you have the Kaspersky online scan log?
Please be sure to follow the instructions for saving the log. The above information was posted as html code, which I've edited into something readable.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-06-2007, 06:26 PM
|
#18 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
I had to leave the house in the middle of kaspersky scan, which took 3 hours to complete. here is the log - sorry about the html earlier.
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, October 07, 2007 3:25:21 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 6/10/2007 Kaspersky Anti-Virus database records: 428248 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ J:\ K:\ Scan Statistics: Total number of scanned objects: 204409 Number of viruses found: 19 Number of infected objects: 69 Number of suspicious objects: 0 Duration of the scan process: 03:25:29 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\cqvrpygd.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\daufdwil.exe Infected: Trojan.Win32.Agent.bck skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\fxwskgky.exe Infected: Trojan.Win32.Agent.bck skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\kvlfpnkb.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\madnhhwd.dll Infected: Trojan.Win32.BHO.hj skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\nakxruxq.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\sjxqsjpk.dll Infected: Trojan.Win32.BHO.hj skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\tplhpjev.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\vdpusisg.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\vtpnslai.exe Infected: Trojan.Win32.Agent.bck skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\xlnjfkog.exe Infected: Trojan.Win32.Agent.bck skipped C:\Deckard\System Scanner\backup\DOCUME~1\LEO200~1\LOCALS~1\Temp\yjacmkfw.exe Infected: Trojan.Win32.Agent.bck skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.162.Crwl Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.162.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.ci Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wsb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010019.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010020.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy376.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf1.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf4.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_81c.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7FF83719.exe Infected: not-a-virus:AdTool.Win32.WhenU.i skipped C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\F98CCA01.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\Leo 2005\Application Data\Microsoft\Templates\Normal.dotm Object is locked skipped C:\Documents and Settings\Leo 2005\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Leo 2005\Desktop\[4]-Submit_2007-10-04@23.32.zip/pmkhf.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wa skipped C:\Documents and Settings\Leo 2005\Desktop\[4]-Submit_2007-10-04@23.32.zip ZIP: infected - 1 skipped C:\Documents and Settings\Leo 2005\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\History\History.IE5\MSHist012007100620071007\index.dat Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temp\Perflib_Perfdata_b74.dat Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temp\~DF8801.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.Word\~WRF{6EC326C3-8693-4712-8416-45E6B323CB29}.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.Word\~WRS{1C85DC32-6B35-4FD8-B842-8EB143A330E7}.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.Word\~WRS{611D02BC-C81C-4CB7-9166-D1FC0F065893}.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.Word\~WRS{6AEC8AF6-4498-40AF-8A2F-43E56A0296E3}.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\Local Settings\Temporary Internet Files\Content.Word\~WRS{B02EF10A-C3E0-4DFD-84A2-535571E45513}.tmp Object is locked skipped C:\Documents and Settings\Leo 2005\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped C:\Documents and Settings\Leo 2005\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Leo 2005\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Desktop Search\Logs\UNCFATPHLog.txt Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JAJ6JBSL\index[2].htm Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\Bonus\Log\Shazam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAD.dat Object is locked skipped C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWADMT.dat Object is locked skipped C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.dat Object is locked skipped C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.ldb Object is locked skipped C:\Program Files\Common Files\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/trivia.exe/MIRC32.EXE Infected: not-a-virus:Client-IRC.Win32.mIRC.561 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/trivia.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.561 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/Script.exe/data.rar/mIRC/mIRC32.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/Script.exe/data.rar Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/Script.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/idents.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/channel.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/events.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/dialog1.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/dialog3.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/sys/events2.ini Infected: Flooder.IRC.Extreme.821 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas:Trivia/xtreme_s[07-05].zip Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst Mail MS Mail: infected - 13 skipped C:\Program Files\NoAdware5.0\NoAdware5.exe Infected: not-a-virus:FraudTool.Win32.NoAdware.a skipped C:\Program Files\NoAdware5.0\nutils.dll Infected: not-a-virus:FraudTool.Win32.NoAdware.a skipped C:\Program Files\Norton 360\Log\AutoProtect.log Object is locked skipped C:\Program Files\Norton 360\Log\AVContext.log Object is locked skipped C:\Program Files\Norton 360\Log\AVManual.log Object is locked skipped C:\Program Files\Norton 360\Log\Backup.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetTempFiles.log Object is locked skipped C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log Object is locked skipped C:\Program Files\Norton 360\Log\EmailScan.log Object is locked skipped C:\Program Files\Norton 360\Log\InternetSecurity.log Object is locked skipped C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log Object is locked skipped C:\Program Files\Norton 360\Log\ISIOTraffic.log Object is locked skipped C:\Program Files\Norton 360\Log\ISNewNetwork.log Object is locked skipped C:\Program Files\Norton 360\Log\LiveUpdate.log Object is locked skipped C:\Program Files\Norton 360\Log\NCO.log Object is locked skipped C:\Program Files\Norton 360\Log\VABrowserSettings.log Object is locked skipped C:\Program Files\Norton 360\Log\VAIPAddresses.log Object is locked skipped C:\Program Files\Norton 360\Log\VAWeakPasswords.log Object is locked skipped C:\Program Files\Norton 360\Log\WDFScanner.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\billing_Leo 2005.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\client_Leo 2005.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\network_Leo 2005.log Object is locked skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\byxwxyv.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\iifddby.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\jkkhfdb.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\mljklki.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\nnnonkl.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\opnmnkj.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\urqonll.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\wbfkdnmq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wm skipped C:\qoobox\Quarantine\catchme2007-10-04_ 93358.82.zip/iifddby.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\qoobox\Quarantine\catchme2007-10-04_ 93358.82.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP666\A0141629.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wa skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143933.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143937.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143940.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143941.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143942.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143944.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143947.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wm skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP676\A0143965.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP678\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\ACEEvent.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Media Ce.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\ODiag.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\OSession.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\TEMP\JET33E7.tmp Object is locked skipped C:\WINDOWS\TEMP\JET360A.tmp Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\{00000004-00000000-00000001-00001102-00000004-20061102}.CDF Object is locked skipped D:\mirc 6_21\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped D:\mirc6_03\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped D:\PnP405_dan\mirc32.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.591 skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped H:\dc++\BioShock\ Bioshock activation crack.zip/Bioshock.exe Infected: Backdoor.Win32.Agobot.aju skipped H:\dc++\BioShock\ Bioshock activation crack.zip ZIP: infected - 1 skipped H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe RarSFX: infected - 3 skipped H:\dc++\programe\Nero-7.8.5.0_eng_update.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped H:\dc++\programe\Nero-7.8.5.0_eng_update.exe RAR: infected - 1 skipped H:\dc++\programe\noadware 5.exe/file1 Infected: not-a-virus:FraudTool.Win32.NoAdware.a skipped H:\dc++\programe\noadware 5.exe/file3 Infected: not-a-virus:FraudTool.Win32.NoAdware.a skipped H:\dc++\programe\noadware 5.exe Inno: infected - 2 skipped H:\dc++\programe\spioneaza alt calc\RADMIN21.EXE/AdmDll.dll Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.20 skipped H:\dc++\programe\spioneaza alt calc\RADMIN21.EXE/raddrv.dll Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.20 skipped H:\dc++\programe\spioneaza alt calc\RADMIN21.EXE/radmin.exe Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.21 skipped H:\dc++\programe\spioneaza alt calc\RADMIN21.EXE/r_server.exe Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.21 skipped H:\dc++\programe\spioneaza alt calc\RADMIN21.EXE Gentee: infected - 4 skipped H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped H:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP678\change.log Object is locked skipped Scan process completed. |
|
|
|
|
10-06-2007, 07:30 PM
|
#19 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home
|
Re: winantispyware removal - impossile
Cracks and keygens are frequently the source for infection. We do not condone the use of illegal software. I would highly recommend you uninstall Bioshock, and delete these files:
H:\dc++\BioShock\ Bioshock activation crack.zip/Bioshock.exe ------> Backdoor.Win32.Agobot.aju H:\dc++\BioShock\ Bioshock activation crack.zip ZIP: infected - 1 H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar/xpkey.exe ------> PSWTool.Win32.RAS.a H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar/officekey.exe ------> PSWTool.Win32.RAS.a H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe/data.rar ------> PSWTool.Win32.RAS.a H:\dc++\Make Your Copy of Windows 100% Genuine in 2 Seconds\keyfinder.exe RarSFX: infected - 3 I see you use P2P (file sharing) applications. While the program itself may be clean, the downloads often are not. References for the risk of these programs are here, here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. NoAdware used to be listed on Eric Howes' rogueware list. While it's been de-listed, there are other more respected applications such as Ad-Aware, Spybot Search & Destroy, SUPERAntiSpyware and AVG Anti-Spyware which all have free versions. I'd recommend you uninstall it. Your MS Outlook inbox has an old infected mail in it: C:\Program Files\Microsoft Office 2003\outlook_june24_2005.pst/Personal Folders/Inbox/05 Oct 2004 13:22 from "ANCA"Anamaria Bondrea Sas Delete it. Please use Symantec's guide to remove the Norton Quarantine files. Is your Norton Subscription current? If not, it's as if not having an AntiVirus at all. I can recommend several excellent free AV products for to to choose from if necessary. Go to Start > Run and copy/paste the following command, then press Enter. ComboFix /u Tell me the result of this command.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
10-07-2007, 10:03 AM
|
#20 (permalink) |
|
Registered User
|
Re: winantispyware removal - impossile
hello,
i deleted everything u told me to and i unistalled noadware and combofix. yes, my norton antivirus is up to date, all the time. but apparently is not as good as everybody says it is. which antivirus do u use ? |
|
|
|
| Thread Tools | |
|
|
-> Run -> paste in the following single line command & click OK
