|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-02-2007, 11:41 AM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 7
OS: winxp service pack 2
|
multi site trojan/search-daily problem
when using a seach engine it will take me to search-daily when i click on any of the results. also it often says my virtual memory is running low and automatically restarts me. before doing the panda scan the only other thing that brought up a trojan was super anti spyware. it would remove it but always came back upon start up. i even scanned in safe mode and turned system restore off before i restarted.
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-02-2007, 11:43 AM
|
#2 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 7
OS: winxp service pack 2
|
Re: multi site trojan/search-daily problem
Incident Status Location
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Kids\Cookies\kids@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Kids\Cookies\kids@atdmt[2].txt Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Kids\Cookies\kids@burstnet[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Kids\Cookies\kids@doubleclick[1].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Kids\Cookies\kids@enhance[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Kids\Cookies\kids@tribalfusion[1].txt Virus:Trj/Bho.M Disinfected C:\Documents and Settings\Kids\Desktop\zhknu.bak Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Parents\Cookies\parents@247realmedia[1].txt Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Parents\Cookies\parents@2o7[1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Parents\Cookies\parents@adrevolver[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Parents\Cookies\parents@ads.pointroll[1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Parents\Cookies\parents@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Parents\Cookies\parents@atdmt[2].txt Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Parents\Cookies\parents@burstnet[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Parents\Cookies\parents@doubleclick[1].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Parents\Cookies\parents@enhance[2].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Parents\Cookies\parents@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Parents\Cookies\parents@realmedia[2].txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Parents\Cookies\parents@trafficmp[2].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Parents\Cookies\parents@zedo[1].txt Virus:Trj/Bho.M Disinfected C:\Documents and Settings\Parents\Desktop\qwtridt.bak Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Parents\Local Settings\Temp\Cookies\parents@go[2].txt Virus:Trj/Delf.AGE Disinfected C:\Documents and Settings\Parents\zgkvo.bak Spyware:Cookie/888 Not disinfected C:\Rob\Documents and Settings\Kids\Cookies\kids@888[2].txt Spyware:Cookie/Go Not disinfected C:\Rob\Documents and Settings\Kids\Local Settings\Temp\Cookies\kids@go[1].txt Virus:Trj/Delf.AGE Disinfected C:\WINDOWS\system32\fndne.bak Virus:Trj/Delf.AGE Disinfected C:\WINDOWS\system32\pjmsuq.bak Virus:Generic Trojan Disinfected C:\WINDOWS\system32\ysusduus.exe Deckard's System Scanner v20070905.67 Run by Kids on 2007-10-02 13:35:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-10-02 17:35:08 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 256 MiB (512 MiB recommended). -- HijackThis (run as Kids.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:36:53 PM, on 10/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Documents and Settings\Kids\Desktop\dss.exe C:\DOCUME~1\Kids\Desktop\Kids.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.apple.com/itunes/download/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: ZILLAbar BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - (no file) O2 - BHO: (no name) - {42926665-4B94-4A6B-B0D7-8EC357EBAD4F} - c:\windows\system32\ldldldl.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Image Helper - {64D712D1-84D9-281C-CE7D-32439D631863} - (no file) O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {8FE03D5F-3D17-4A04-8DD7-99A8110F382F} - c:\windows\system32\iighyqfm.dll O2 - BHO: (no name) - {AC7C56F6-4C45-44AE-80DA-9208F14608AF} - c:\windows\system32\lgxtywus.dll (file missing) O2 - BHO: (no name) - {C619A278-7CF2-4155-BCEE-3B06BC240F5C} - c:\windows\system32\ldldldl.dll O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file) O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file) O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [] /s O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [DelayShred] "C:\Program Files\McAfee\MSHR\ShrCL.EXE" /P7 /q C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.IE5\W1E30DIF.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.IE5\UVYC07JT.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.IE5\QOMOQ6ID.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.IE5\KDIFYFQ9.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.IE5\6RUDIUUS.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1\Content.SH! C:\DOCUME~1\Kids\LOCALS~1\Temp\TEMPOR~1.SH! O4 - HKCU\..\Run: [MtdAcq] C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: hegujqjo - C:\WINDOWS\SYSTEM32\ldldldl.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6552 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 axvtrnzu (Microsoft RPC API Helper) - c:\windows\system32\drivers\dtlniwgn.sys R0 szkg - c:\windows\system32\drivers\szkg.sys <Not Verified; iS3 Inc.; Stopzilla> R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> S3 vsdatant - c:\windows\system32\vsdatant.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2007-10-02 11:19:39 446 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2007-10-02 04:32:25 360 --a------ C:\WINDOWS\Tasks\XoftSpySE.job 2007-10-01 01:00:12 350 --a------ C:\WINDOWS\Tasks\McQcTask.job 2007-09-29 15:41:10 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-09-27 04:32:26 370 --a------ C:\WINDOWS\Tasks\RegCure.job 2007-09-15 01:07:13 348 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2006-04-16 09:05:16 346 --a------ C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1137333872.job -- Files created between 2007-09-02 and 2007-10-02 ----------------------------- 2007-10-02 13  07 0 d-------- C:\Program Files\SpywareBlaster2007-10-02 11:37:09 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-02 11:37:06 0 d-------- C:\WINDOWS\LastGood 2007-10-02 04:42:30 0 d-------- C:\WINDOWS\network diagnostic 2007-10-01 10:04:33 34560 --a------ C:\WINDOWS\system32\vqxyullv.dat 2007-10-01 10:04:33 741632 --a------ C:\WINDOWS\system32\ocvhojcj.dat 2007-10-01 10:04:33 35584 --a------ C:\WINDOWS\system32\axjrsrcm.dat 2007-10-01 10:04:31 114944 --a------ C:\WINDOWS\system32\qvmzrtib.dat 2007-09-28 12:48:31 0 dr-h----- C:\Documents and Settings\Parents\Recent 2007-09-28 12:37:41 0 dr-h----- C:\Documents and Settings\Kids\Recent 2007-09-28 12:19:04 0 d-------- C:\Program Files\CCleaner 2007-09-28 10:39:02 0 d-------- C:\Program Files\XoftSpySE 2007-09-28 04:53:49 0 d-------- C:\Documents and Settings\Kids\WINDOWS 2007-09-27 22:55:59 5120 --a------ C:\WINDOWS\system32\drivers\usjgttya.sys 2007-09-17 15:08:47 0 d-------- C:\Program Files\uTorrent 2007-09-04 15:34:28 105406 --a------ C:\WINDOWS\system32\iighyqfm.dll -- Find3M Report --------------------------------------------------------------- 2007-10-02 12:24:34 0 d-------- C:\Program Files\SUPERAntiSpyware 2007-10-02 12:19:54 0 d-------- C:\Program Files\iTunes 2007-10-02 10:08:28 81920 --a------ C:\WINDOWS\system32\ldldldl.dll 2007-09-30 10:00:41 124416 --a------ C:\WINDOWS\system32\sssrlynl.dll 2007-09-27 22:55:56 73728 --a------ C:\WINDOWS\system32\nlhbbzlv.dll 2007-09-17 15:20:06 0 d-------- C:\Documents and Settings\Kids\Application Data\uTorrent 2007-09-14 21:12:00 0 d-------- C:\Program Files\RegCure 2007-08-31 01:00:39 0 d-------- C:\Documents and Settings\Kids\Application Data\Apple Computer 2007-08-25 15:26:00 1744 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-08-22 15:00:03 0 d-------- C:\Program Files\iPod 2007-08-22 14:55:41 0 d-------- C:\Program Files\QuickTime 2007-08-22 14:51:37 0 d-------- C:\Program Files\Apple Software Update 2007-08-22 14:50:42 0 d-------- C:\Program Files\Common Files 2007-08-22 14:50:42 0 d-------- C:\Program Files\Common Files\Apple -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42926665-4B94-4A6B-B0D7-8EC357EBAD4F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64D712D1-84D9-281C-CE7D-32439D631863}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FE03D5F-3D17-4A04-8DD7-99A8110F382F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC7C56F6-4C45-44AE-80DA-9208F14608AF}] c:\windows\system32\lgxtywus.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C619A278-7CF2-4155-BCEE-3B06BC240F5C}] 10/02/2007 10:08 AM 81920 --a------ c:\windows\system32\ldldldl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [08/04/2007 02:33 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [08/15/2007 08:15 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@"=" /s" [] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [09/19/2007 02:07 AM] "DelayShred"="C:\Program Files\McAfee\MSHR\ShrCL.exe" [07/25/2007 03:10 PM] "MtdAcq"="C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe" [09/14/2005 03:40 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 01:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hegujqjo] ldldldl.dll 10/02/2007 10:08 AM 81920 C:\WINDOWS\system32\ldldldl.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hello] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicasaNet] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs bhfklsim -- Hosts ----------------------------------------------------------------------- 127.0.0.1 localhost #***Inserted By STOPzilla*** 127.0.0.1 0websearch.com # ***Inserted By STOPzilla*** 127.0.0.1 2005-search.com # ***Inserted By STOPzilla*** 127.0.0.1 600pics.com # ***Inserted By STOPzilla*** 127.0.0.1 a1.interclick.com # ***Inserted By STOPzilla*** 127.0.0.1 absolutepics.net # ***Inserted By STOPzilla*** 127.0.0.1 ad.yieldmanager.com # ***Inserted By STOPzilla*** 127.0.0.1 alex.fileburst.com # ***Inserted By STOPzilla*** 127.0.0.1 all-tgp.org # ***Inserted By STOPzilla*** 127.0.0.1 all-websearch.com # ***Inserted By STOPzilla*** 150 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-10-02 13:38:07 ------------ Last edited by bryce7885; 10-02-2007 at 11:46 AM. |
|
|
|
|
10-03-2007, 02:43 PM
|
#3 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,411
OS: N/A
|
Re: multi site trojan/search-daily problem
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that & a fresh Hijackthis log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
10-05-2007, 08:10 AM
|
#4 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 7
OS: winxp service pack 2
|
Re: multi site trojan/search-daily problem
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:09, on 2007-10-05 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Kids\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.apple.com/itunes/download/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: ZILLAbar BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Image Helper - {64D712D1-84D9-281C-CE7D-32439D631863} - (no file) O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {C619A278-7CF2-4155-BCEE-3B06BC240F5C} - c:\windows\system32\ldldldl.dll (file missing) O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file) O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file) O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [MtdAcq] C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [] /s O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: McAfee Application Installer Cleanup (0200221191556356) (0200221191556356mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\020022~1.EXE (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 5832 bytes ComboFix 07-10-05.3 - Kids 2007-10-05 10:18:21.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.74 [GMT -4:00] Running from: C:\Documents and Settings\Kids\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 ))))))))))))))))))))))))))))))) . 2007-10-05 09:53 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-02 13:34 <DIR> d-------- C:\Deckard 2007-10-02 13:06 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-02 11:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-01 10:04 741,632 --a------ C:\WINDOWS\system32\ocvhojcj.dat 2007-10-01 10:04 35,584 --a------ C:\WINDOWS\system32\axjrsrcm.dat 2007-10-01 10:04 34,560 --a------ C:\WINDOWS\system32\vqxyullv.dat 2007-10-01 10:04 118,528 --a------ C:\WINDOWS\system32\qvmzrtib.dat 2007-09-28 12:19 <DIR> d-------- C:\Program Files\CCleaner 2007-09-28 10:39 <DIR> d-------- C:\Program Files\XoftSpySE 2007-09-28 04:53 <DIR> d-------- C:\Documents and Settings\Kids\WINDOWS 2007-09-17 15:08 <DIR> d-------- C:\Program Files\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-02 14:12 --------- d-------- C:\Program Files\SUPERAntiSpyware 2007-10-02 12:19 --------- d-------- C:\Program Files\iTunes 2007-09-30 10:00 124416 --a------ C:\WINDOWS\system32\sssrlynl.dll 2007-09-28 12:38 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-09-27 22:55 73728 --a------ C:\WINDOWS\system32\nlhbbzlv.dll 2007-09-17 15:20 --------- d-------- C:\Documents and Settings\Kids\Application Data\uTorrent 2007-09-14 21:12 --------- d-------- C:\Program Files\RegCure 2007-09-04 15:34 105406 --a------ C:\WINDOWS\system32\iighyqfm.dll 2007-08-31 01:00 --------- d-------- C:\Documents and Settings\Kids\Application Data\Apple Computer 2007-08-22 15:00 --------- d-------- C:\Program Files\iPod 2007-08-22 14:55 --------- d-------- C:\Program Files\QuickTime 2007-08-22 14:54 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-08-22 14:51 --------- d-------- C:\Program Files\Apple Software Update 2007-08-22 14:50 --------- d-------- C:\Program Files\Common Files\Apple 2007-08-22 14:50 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64D712D1-84D9-281C-CE7D-32439D631863}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C619A278-7CF2-4155-BCEE-3B06BC240F5C}] c:\windows\system32\ldldldl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-04 02:33] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-09-19 02:07] "MtdAcq"="C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe" [2005-09-14 15:40] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hello] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicasaNet] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys R3 Smcpwr2n;SMC EtherPower II 10/100 Ethernet Adapter driver ;C:\WINDOWS\system32\DRIVERS\smcpwr2n.sys S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys S2 0200221191556356mcinstcleanup;McAfee Application Installer Cleanup (0200221191556356);C:\WINDOWS\TEMP\020022~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs bhfklsim *Newly Created Service* - 0200221191556356MCINSTCLEANUP *Newly Created Service* - AXVTRNZU . Contents of the 'Scheduled Tasks' folder "2007-09-29 19:41:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2006-04-16 13:05:16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1137333872.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe "2007-09-15 05:07:13 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2007-10-01 05:00:12 C:\WINDOWS\Tasks\McQcTask.job" "2007-10-04 08:38:53 C:\WINDOWS\Tasks\RegCure.job" "2007-10-05 14:02:32 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-10-02 08:32:25 C:\WINDOWS\Tasks\XoftSpySE.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-05 10:21:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-10-05 10:23:43 C:\ComboFix-quarantined-files.txt ... 2007-10-05 10:23 . --- E O F --- Last edited by bryce7885; 10-05-2007 at 08:19 AM. |
|
|
|
|
10-05-2007, 11:30 AM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,411
OS: N/A
|
Re: multi site trojan/search-daily problem
Do a HijackThis scan & place a check next to these items and select "Fix checked":
O2 - BHO: Image Helper - {64D712D1-84D9-281C-CE7D-32439D631863} - (no file) O2 - BHO: (no name) - {C619A278-7CF2-4155-BCEE-3B06BC240F5C} - c:\WINDOWS\system32\ldldldl.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
File::
C:\WINDOWS\system32\ocvhojcj.dat
C:\WINDOWS\system32\axjrsrcm.dat
C:\WINDOWS\system32\vqxyullv.dat
C:\WINDOWS\system32\qvmzrtib.dat
C:\WINDOWS\system32\sssrlynl.dll
C:\WINDOWS\system32\nlhbbzlv.dll
C:\WINDOWS\system32\iighyqfm.dll
NetSvc::
bhfklsim
Driver::
bhfklsim
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64D712D1-84D9-281C-CE7D-32439D631863}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C619A278-7CF2-4155-BCEE-3B06BC240F5C}]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
10-05-2007, 06:34 PM
|
#6 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 7
OS: winxp service pack 2
|
Re: multi site trojan/search-daily problem
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:37:05 PM, on 10/5/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\McAfee\MSC\mcuimgr.exe C:\Documents and Settings\Kids\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.apple.com/itunes/download/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: ZILLAbar BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file) O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - (no file) O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [MtdAcq] C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: McAfee Application Installer Cleanup (0200221191556356) (0200221191556356mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\020022~1.EXE (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 5807 bytes ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, October 05, 2007 8:36:11 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 6/10/2007 Kaspersky Anti-Virus database records: 428073 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 53794 Number of viruses found: 2 Number of infected objects: 2 Number of suspicious objects: 0 Duration of the scan process: 01:22:09 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\WINDOWS\temp\usjgttya.sys Infected: Rootkit.Win32.Podnuha.c skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{7F1EEE99-C5F1-4B93-A745-E21E08105AE1}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR2.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\Kids\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped C:\Documents and Settings\Kids\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Kids\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Kids\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Kids\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kids\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Kids\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kids\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Kids\NtUser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{723D6F3C-9EB6-47E3-B6BE-4BAF5D428609}\RP6\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\nlhbbzlv.dll.bak Infected: Trojan-Dropper.Win32.Agent.bzw skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcmsc_8H1lVNIS3dDKh9x Object is locked skipped C:\WINDOWS\Temp\mcmsc_opcJCPdSwhwjzQt Object is locked skipped C:\WINDOWS\Temp\mcmsc_RPfk1nnDrAvayEP Object is locked skipped C:\WINDOWS\Temp\mcmsc_VPi0Jo3b0mEHUvb Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ComboFix 07-10-05.3 - Kids 2007-10-05 18:40:49.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.72 [GMT -4:00] Running from: C:\Documents and Settings\Kids\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Kids\Desktop\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\axjrsrcm.dat C:\WINDOWS\system32\iighyqfm.dll C:\WINDOWS\system32\nlhbbzlv.dll C:\WINDOWS\system32\ocvhojcj.dat C:\WINDOWS\system32\qvmzrtib.dat C:\WINDOWS\system32\sssrlynl.dll C:\WINDOWS\system32\vqxyullv.dat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\axjrsrcm.dat C:\WINDOWS\system32\iighyqfm.dll C:\WINDOWS\system32\nlhbbzlv.dll C:\WINDOWS\system32\ocvhojcj.dat C:\WINDOWS\system32\qvmzrtib.dat C:\WINDOWS\system32\sssrlynl.dll C:\WINDOWS\system32\vqxyullv.dat . ((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 ))))))))))))))))))))))))))))))) . 2007-10-05 09:53 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-02 13:34 <DIR> d-------- C:\Deckard 2007-10-02 13:06 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-02 11:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-09-28 12:19 <DIR> d-------- C:\Program Files\CCleaner 2007-09-28 10:39 <DIR> d-------- C:\Program Files\XoftSpySE 2007-09-28 04:53 <DIR> d-------- C:\Documents and Settings\Kids\WINDOWS 2007-09-17 15:08 <DIR> d-------- C:\Program Files\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-02 14:12 --------- d-------- C:\Program Files\SUPERAntiSpyware 2007-10-02 12:19 --------- d-------- C:\Program Files\iTunes 2007-09-28 12:38 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-09-17 15:20 --------- d-------- C:\Documents and Settings\Kids\Application Data\uTorrent 2007-09-14 21:12 --------- d-------- C:\Program Files\RegCure 2007-08-31 01:00 --------- d-------- C:\Documents and Settings\Kids\Application Data\Apple Computer 2007-08-22 15:00 --------- d-------- C:\Program Files\iPod 2007-08-22 14:55 --------- d-------- C:\Program Files\QuickTime 2007-08-22 14:54 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-08-22 14:51 --------- d-------- C:\Program Files\Apple Software Update 2007-08-22 14:50 --------- d-------- C:\Program Files\Common Files\Apple 2007-08-22 14:50 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-05_10.22.04.56 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 32,768 2007-10-05 22:29:38 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 32,768 2007-10-05 22:29:38 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat --sha-w 32,768 2007-10-05 22:29:38 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ----a-w 32,768 2007-10-05 13:18:19 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 32,768 2007-10-05 13:18:19 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat ----a-w 32,768 2007-10-05 13:18:19 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-04 02:33] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-09-19 02:07] "MtdAcq"="C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe" [2005-09-14 15:40] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] "@"=" /s" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hello] «‘|ë‘|4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicasaNet] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys R3 Smcpwr2n;SMC EtherPower II 10/100 Ethernet Adapter driver ;C:\WINDOWS\system32\DRIVERS\smcpwr2n.sys S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys S2 0200221191556356mcinstcleanup;McAfee Application Installer Cleanup (0200221191556356);C:\WINDOWS\TEMP\020022~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys . Contents of the 'Scheduled Tasks' folder "2007-09-29 19:41:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2006-04-16 13:05:16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1137333872.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe "2007-09-15 05:07:13 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2007-10-01 05:00:12 C:\WINDOWS\Tasks\McQcTask.job" "2007-10-04 08:38:53 C:\WINDOWS\Tasks\RegCure.job" "2007-10-05 22:46:42 C:\WINDOWS\Tasks\XoftSpySE 2.job" "2007-10-02 08:32:25 C:\WINDOWS\Tasks\XoftSpySE.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-05 18:46:15 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-05 18:49:38 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-05 18:49 C:\ComboFix2.txt ... 2007-10-05 10:23 . --- E O F --- didnt seem to have any problems doing those steps. although i did get the "virtual memory running low" warning during the online scan, but luckily the computer didn't restart. the computer hasn't been restarting on its own as frequently as before. edit:clicking on search engine results seems to be working properly now. its not taking me to search daily sites anymore. Last edited by bryce7885; 10-05-2007 at 06:37 PM. |
|
|
|
|
10-05-2007, 06:39 PM
|
#7 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,411
OS: N/A
|
Re: multi site trojan/search-daily problem
Quote:
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\WINDOWS\system32\nlhbbzlv.dll.bak" ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) for %%g in ( "%systemdrive%\VundoFix Backups" %systemdrive%\Deckard %systemdrive%\Qoobox ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! nircmd wait 7000 del %0 It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
|
10-06-2007, 08:03 PM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,411
OS: N/A
|
Re: multi site trojan/search-daily problem
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
|
10-06-2007, 09:44 PM
|
#10 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 7
OS: winxp service pack 2
|
Re: multi site trojan/search-daily problem
thank you so much for your patience and help. i have spywareblaster and iespyad now. I had mcafee with firewall protection before coming here, but i will make sure to keep it updated better. I also had regcure.
I do still have one minor annoyance i didn't mention. the system32 folder opens on startup. no big deal though |
|
|
|
|
10-07-2007, 07:51 AM
|
#11 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,411
OS: N/A
|
Re: multi site trojan/search-daily problem
Try this ...
Open NOTEPAD.exe and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Quote:
It should look like this:  Double click on fix.reg & allow it to merge into the registry Reboot & see if it's it's any better
__________________
Question - what have you done for the community today? |
|
|
|
|
| Thread Tools | |
|
|
