|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-15-2007, 05:59 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
help removing trojan and adware
The comcast install man hooked up my wireless at the end of august and turned my firewall off when he did this, i completely forgot he did this and didnt have my firewall up until it was too late. My computer now has a trojan virus on it i think as well as adware. In the bottom right of the screen i get a system alert saying that my computer is infected with Trojan-spy.win32@mx and also comes up and says spyware.cyberlog-x and networm-i.virus@fp when i try to right click on it it just disappears. I also am getting a bunch of pop ups. i have scanned using AVG antispyware, ad-aware 2007, and spybot search and destroy, and avast. still hasn't cleaned it out. i also tried to turn off the system restore and and scan and turn it back on but every time i connect to the internet these things come back. Any insight would be appreciated. thanks
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-15-2007, 07:13 PM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
ok i ran through the 5 steps and here is the main.txt from scan
Deckard's System Scanner v20071014.68 Run by Administrator on 2007-10-15 21:04:14 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-10-16 01:04:29 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 480 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-10-15 21:07:33 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\explorer.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Digital Media Reader\shwicon2k.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\WISPTIS.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Administrator\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {32262E1A-2E89-4935-82FF-6F87C309D6C8} - C:\Program Files\Messenger\horevofC:\WINDOWS\system32\rv1\gccb83122.exe.dll (file missing) O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5D1302DF-EA46-4C1F-B15B-C62CF4D328B6} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\kcojfrtn.dll O2 - BHO: (no name) - {8B932AD1-AD77-4559-ADC3-C7ADB85CF4C4} - C:\WINDOWS\system32\jkkjk.dll O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\krqxhqiu.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\krqxhqiu.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunKist] C:\Program Files\Digital Media Reader\shwicon2k.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\gslencgs.dll",sitypnow O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [SpybotDeletingA8719] command /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" O4 - HKLM\..\RunOnce: [SpybotDeletingC4589] cmd /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" O4 - HKLM\..\RunOnce: [SpybotDeletingA5106] command /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC7988] cmd /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingA466] command /c del "C:\WINDOWS\system32\ezfvarxk.dll" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - CmdMapping - (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKCU) O15 - Trusted Zone: *.imagesrvr.com (HKCU) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1192496157562 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: awttqpn - C:\WINDOWS\system32\awttqpn.dll O20 - Winlogon Notify: krqxhqiu - C:\WINDOWS\system32\krqxhqiu.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 11563 bytes -- File Associations ----------------------------------------------------------- .reg - regfile - shell\open\command - "regedit.exe" "%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 papycpu2 - c:\windows\system32\drivers\papycpu2.sys R1 papyjoy - c:\windows\system32\drivers\papyjoy.sys R1 PCLEPCI - c:\windows\system32\drivers\pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI> R3 ASAPIW2k - c:\windows\system32\drivers\asapiw2k.sys <Not Verified; VOB Computersysteme GmbH; asapi> R3 MarvinBus (Pinnacle Marvin Bus) - c:\windows\system32\drivers\marvinbus.sys <Not Verified; Pinnacle Systems GmbH; Pinnacle Marvin Discrete> S3 EMCFILT (Alcor Micro Corp for Emachine- 9361) - c:\windows\system32\drivers\emcfilt.sys <Not Verified; Alcor Micro Corp.; emcfilt> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager> S3 KodakCCS (Kodak Camera Connection Software) - c:\windows\system32\drivers\kodakccs.exe (file missing) S4 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\3702415D32521 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\3702415D32521 Service: NIC1394 Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom 440x 10/100 Integrated Controller Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_2029161F&REV_01\4&22270378&0&30F0 Manufacturer: Broadcom Name: Broadcom 440x 10/100 Integrated Controller PNP Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_2029161F&REV_01\4&22270378&0&30F0 Service: bcm4sbxp -- Scheduled Tasks ------------------------------------------------------------- 2007-10-11 15:33:09 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2005-08-05 04:05:53 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 1.job -- Files created between 2007-09-15 and 2007-10-15 ----------------------------- 2007-10-15 20:48:10 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-15 20:48:05 0 d-------- C:\WINDOWS\LastGood 2007-10-15 20:33:41 85056 --a------ C:\WINDOWS\system32\gslencgs.dll 2007-10-15 20:24:56 339968 --a------ C:\WINDOWS\system32\krqxhqiu.dll 2007-10-15 20:24:56 339968 --a------ C:\Program Files\Hammer.dll 2007-10-15 20:24:28 389184 --a------ C:\WINDOWS\system32\dnuotnia.exe 2007-10-15 16:17:22 85056 -----n--- C:\WINDOWS\system32\pofxwryy.dll 2007-10-15 16  06 339968 --ah----- C:\WINDOWS\system32\ezfvarxk.dll2007-10-15 16:05:39 389184 --a------ C:\WINDOWS\system32\xlxofnhk.exe 2007-10-14 20:12:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-14 18:50:43 0 d-------- C:\Program Files\Lavasoft 2007-10-14 18:50:42 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-10-14 16:23:16 439507 ---hs---- C:\WINDOWS\system32\kjkkj.ini2 2007-10-13 23:12:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft 2007-10-13 23:09:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-13 22:59:59 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-10-13 22:48:23 75840 --a------ C:\WINDOWS\system32\kcojfrtn.dll 2007-10-13 22:42:23 389184 --a------ C:\WINDOWS\system32\rvffbxqr.exe 2007-10-13 11:21:50 0 d-------- C:\Docum 2007-10-13 10:52:59 0 d-------- C:\Program Files\CONEXANT 2007-10-12 11:50:17 492544 --a------ C:\WINDOWS\system32\WRLogonNtf(2).dll <Not Verified; Webroot Software, Inc.; Spy Sweeper SDK> 2007-10-12 11:49:45 0 d-------- C:\Documents and Settings\Administrator\Application Data\Webroot 2007-10-12 11:49:44 0 d-------- C:\Program Files\Webroot 2007-10-08 17:25:59 432692 ---hs---- C:\WINDOWS\system32\kjkkj.bak2 2007-10-08 16:59:30 480516 ---hs---- C:\WINDOWS\system32\kjkkj.bak1 2007-10-08 16:57:37 316512 --a------ C:\WINDOWS\system32\jkkjk.dll 2007-10-08 16:53:44 0 d-------- C:\WINDOWS\system32\zipz2 2007-10-08 16:53:44 0 d-------- C:\WINDOWS\system32\ss1 2007-10-08 16:53:44 0 d-------- C:\WINDOWS\system32\rv1 2007-10-08 16:53:44 0 d-------- C:\WINDOWS\system32\bbc1 2007-10-08 16:53:22 0 d-------- C:\WINDOWS\system32\b1 2007-10-08 16:53:16 0 d-------- C:\WINDOWS\system32\vMW10a 2007-10-08 16:52:32 36352 --a------ C:\WINDOWS\system32\awttqpn.dll 2007-10-08 16:52:20 35328 --a------ C:\WINDOWS\winshow.exe <Not Verified; ; winshow> 2007-09-28 10:19:52 0 d-------- C:\Program Files\Windows Media Connect 2 2007-09-28 10:16:40 0 d-------- C:\29e87471a2f57be07faf 2007-09-28 10:16:29 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-09-28 10:15:43 0 d-------- C:\33389072f05834bc63ec00b8 2007-09-27 18:21:53 0 d-------- C:\WINDOWS\pss 2007-09-27 17:28:03 0 d-------- C:\Program Files\QuickTime 2007-09-27 17:21:52 0 d-------- C:\Program Files\Apple Software Update 2007-09-27 17:21:51 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple -- Find3M Report --------------------------------------------------------------- 2007-10-15 20:52:25 0 d-------- C:\Documents and Settings\Administrator\Application Data\ComcastToolbar 2007-10-14 21:33:33 0 d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM 2007-10-14 19:57:28 0 d-------- C:\Program Files\Common Files 2007-10-13 14:07:31 0 d-------- C:\Documents and Settings\Administrator\Application Data\Ruckus Network 2007-10-12 10:22:22 0 d-------- C:\Program Files\Google 2007-10-11 19:49:12 2256 --a------ C:\WINDOWS\current_settings.bin 2007-10-09 19:41:41 0 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2007-10-08 11:38:22 0 d-------- C:\Program Files\Java 2007-08-28 16:47:23 3321 --a----c- C:\WINDOWS\mozver.dat 2007-08-18 15:38:57 0 d-------- C:\Program Files\Common Files\Scanner 2007-08-18 15:38:57 0 d-------- C:\Program Files\ComcastToolbar 2007-08-18 15:38:22 0 d-------- C:\Program Files\Common Files\SupportSoft 2007-08-18 15:38:17 0 d-------- C:\Program Files\Comcast 2007-08-18 15:34:49 0 d-------- C:\Program Files\support.com -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32262E1A-2E89-4935-82FF-6F87C309D6C8}] C:\Program Files\Messenger\horevofC:\WINDOWS\system32\rv1\gccb83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D1302DF-EA46-4C1F-B15B-C62CF4D328B6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD4D75-2429-462e-BD4E-443F233F6033}] 10/13/2007 10:48 PM 75840 --a------ C:\WINDOWS\system32\kcojfrtn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B932AD1-AD77-4559-ADC3-C7ADB85CF4C4}] 10/08/2007 04:57 PM 316512 --a------ C:\WINDOWS\system32\jkkjk.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] 10/15/2007 08:24 PM 339968 --a------ C:\WINDOWS\system32\krqxhqiu.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\krqxhqiu.dll [10/15/2007 08:24 PM 339968] [-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [03/26/2004 08:20 PM] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03/26/2004 08:20 PM] "@"="" [] "SunKist"="C:\Program Files\Digital Media Reader\shwicon2k.exe" [05/26/2004 08:57 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [10/31/2003 10:42 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [01/15/2007 01:28 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/01/2007 10:20 PM] "PCLEUSBTip"="C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [] "PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [11/10/2003 04:06 PM] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM] "SearchIndexer"="C:\WINDOWS\system32\gslencgs.dll" [10/15/2007 08:33 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="C:\Program Files\AIM6\aim6.exe" [04/27/2007 05:17 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/27/2007 11:44 AM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08/31/2007 04:46 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "Spybot - Search & Destroy"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck "SpybotDeletingA8719"=command /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" "SpybotDeletingC4589"=cmd /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" "SpybotDeletingA5106"=command /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" "SpybotDeletingC7988"=cmd /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" "SpybotDeletingA466"=command /c del "C:\WINDOWS\system32\ezfvarxk.dll" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{F884BE4E-64D5-43FE-80A4-DB8D63C748F0}"= C:\WINDOWS\system32\awttqpn.dll [10/08/2007 04:52 PM 36352] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awttqpn] awttqpn.dll 10/08/2007 04:52 PM 36352 C:\WINDOWS\system32\awttqpn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\krqxhqiu] krqxhqiu.dll 10/15/2007 08:24 PM 339968 C:\WINDOWS\system32\krqxhqiu.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjk.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares lite] "C:\Program Files\ARES\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\areslite] "C:\Program Files\Ares Lite Edition\AresLite.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] %WINDIR%\SMINST\RECGUARD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] %WINDIR%\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow] "C:\WINDOWS\winshow.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "PrismXL"=2 (0x2) "Bonjour Service"=2 (0x2) "sprtsvc_ddoctorv2"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a25a163-0586-11da-b662-806d6172696f}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480 -- Hosts ----------------------------------------------------------------------- 127.0.0.1 007guard.com 127.0.0.1 www.007guard.com 127.0.0.1 008i.com 127.0.0.1 008k.com 127.0.0.1 www.008k.com 127.0.0.1 00hq.com 127.0.0.1 www.00hq.com 127.0.0.1 010402.com 127.0.0.1 032439.com 127.0.0.1 www.032439.com 6775 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-10-15 21:09:39 ------------ THIS IS THE EXTRA.TXT Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Mobile Intel(R) Pentium(R) 4 CPU 2.80GHz CPU 1: Mobile Intel(R) Pentium(R) 4 CPU 2.80GHz Percentage of Memory in Use: 65% Physical Memory (total/avail): 479.36 MiB / 167.44 MiB Pagefile Memory (total/avail): 1123.36 MiB / 647.43 MiB Virtual Memory (total/avail): 2047.88 MiB / 1909.68 MiB C: is Fixed (NTFS) - 33.87 GiB total, 8.55 GiB free. D: is Fixed (FAT32) - 3.38 GiB total, 2.69 GiB free. E: is CDROM (No Media) \\.\PHYSICALDRIVE0 - FUJITSU MHT2040AT - 37.26 GiB - 2 partitions \PARTITION0 (bootable) - Installable File System - 33.87 GiB - C: \PARTITION1 - Unknown - 3.39 GiB - D: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. AV: avast! antivirus 4.7.942 [VPS 000781-2] v4.7.942 (ALWIL Software) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Ruckus Player\\Ruckus.exe"="C:\\Program Files\\Ruckus Player\\Ruckus.exe:*:Enabled:Ruckus" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe:*:Enabled:Render Manager" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe:*:Enabled:Studio" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile" "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe:*:Enabled:umi" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Disabled:EasyShare" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Administrator\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=STEVE ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Administrator LOGONSERVER=\\STEVE NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\PROGRA~1\Java\J2RE14~1.1_0\bin;C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Pinnacle\Shared Files;C:\Program Files\Pinnacle\Shared Files\Filter;. PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0401 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp USERDOMAIN=STEVE USERNAME=Administrator USERPROFILE=C:\Documents and Settings\Administrator windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\PROGRA~1\RUCKUS~1\UNWISE.EXE /a C:\PROGRA~1\RUCKUS~1\INSTALL.LOG --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Reader 6.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001} Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log AIM 6 --> C:\Program Files\AIM6\uninst.exe Apple Software Update --> MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6} Autodesk DWF Viewer --> C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe Bonjour Core for Windows --> MsiExec.exe /I{56DF5C9E-6392-46D3-B366-297B14E1DAAF} Canon iP1600 --> C:\WINDOWS\system32\CNMCP75.exe "-PRINTERNAMECanon iP1600" "-HELPERDLLC:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP1600 Installer\Inst2\cnmis.dll" "-RCDLLcnmi0409.dll" Canon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini CCScore --> MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992} Comcast High-Speed Internet Install Wizard --> C:\Program Files\support.com\uninstall\chsi_uninstaller.exe Comcast Toolbar --> C:\Program Files\ComcastToolbar\uninstall.exe Conexant AC-Link Audio --> CIAunwdm.exe Desktop Doctor --> MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908} Digital Media Reader --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{A607AC66-0C76-4519-9751-E12A93BF8EB2} DiscAPI (Studio 10) --> MsiExec.exe /X{A77F3C2D-50CC-4A29-A1FB-1E018BE4DCA2} DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC Easy-WebPrint --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu" ESSCDBK --> MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD} ESScore --> MsiExec.exe /I{9D8FEE90-0377-49A9-AEFB-525BDE549BA4} ESSgui --> MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A} ESShelp --> MsiExec.exe /I{87843A41-7808-4F2E-B13F-25C1E67CF2FD} ESSini --> MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765} ESSPCD --> MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5} ESSSONIC --> MsiExec.exe /I{4F677FC7-7AA8-412B-A957-F13CBE1C7331} ESSTOOLS --> MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589} ESSvpaht --> MsiExec.exe /I{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69} ESSvpot --> MsiExec.exe /I{48C82F7A-F100-4DAB-A310-8E18BF2159E1} Full Tilt Poker --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -l0x9 Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar4.dll" HLPIndex --> MsiExec.exe /I{38441BE7-79B0-42B8-8297-833704F949FE} HLPRFO --> MsiExec.exe /I{AADAC983-FDE9-42FA-8FD9-7BB324155593} Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" InCD EasyWrite Reader --> C:\WINDOWS\unmrw.exe /UNINSTALL Intel(R) Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_3582 iPod for Windows 2005-06-26 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{654F0312-CB3D-4FE2-962C-6BB9752E9146} /l1033 iTunes --> MsiExec.exe /I{446DBFFA-4088-48E3-8932-74316BA4CAE4} J2SE Runtime Environment 5.0 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030} Java 2 Runtime Environment, SE v1.4.1_04 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ACD27BF3-7CDC-11D7-9D4D-00010240CE95}\setup.exe" Anytext Java 2 Runtime Environment, SE v1.4.2 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142000} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Kodak EasyShare software --> C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_1e0007_234ec1\Setup.exe /APR-REMOVE KSU --> MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267} LimeWire 4.12.11 --> "C:\Program Files\LimeWire\uninstall.exe" Macromedia Flash Player 8 --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\swflash.inf,DefaultUninstall,5 Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office Standard Edition 2003 --> MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Microsoft Works --> MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44} Mozilla Firefox (2.0.0.7) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Nero BurnRights --> C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL Nero OEM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL Notifier --> MsiExec.exe /I{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2} OTtBPSDK --> MsiExec.exe /I{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353} PCDADDIN --> MsiExec.exe /I{65D85050-5610-4A91-A3B1-D5C744291AD4} PCDHELP --> MsiExec.exe /I{C99DCDA4-7407-4F72-A77E-C81C551D0C4E} Pinnacle Instant DVD Recorder --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF781A5C-58F5-4BFD-87F9-E4F14D382F25}\Setup.exe" -l0x9 UNINSTALL PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall proDAD Heroglyph 2.5 --> "C:\Program Files\proDAD\Heroglyph-2.5\uninstall.exe" uninstall spcp PATHVERSION 2.5 MAINNAME Heroglyph QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC} RAPID (Studio 10) --> MsiExec.exe /X{EEECE229-49F6-4851-A73A-99B058221F8C} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Ruckus Player --> C:\PROGRA~1\RUCKUS~1\UNWISE.EXE C:\PROGRA~1\RUCKUS~1\INSTALL.LOG SFR --> MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B} SHASTA --> MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237} SKIN0001 --> MsiExec.exe /I{FDF9943A-3D5C-46B3-9679-586BD237DDEE} SKINXSDK --> MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F} SmartSound Quicktracks Plugin --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E} SoftK56 Data Fax --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_202F161F\HXFSETUP.EXE -U -Iem202f5.inf Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe" Studio 10 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3CB05291-F546-458E-A796-B5BCF5A3CDC4}\Setup2.exe" -l0x9 UNINSTALL Studio 10 Bonus DVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6A012D9C-2E2E-405A-B87C-E909F5297C3F}\Setup.exe" -l0x9 UNINSTALL Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Viewpoint Manager (Remove Only) --> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe /u /k Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u VPRINTOL --> MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WIRELESS --> MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F} -- Application Event Log ------------------------------------------------------- Event Record #/Type6343 / Error Event Submitted/Written: 10/15/2007 08:52:59 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application ashdisp.exe, version 4.7.936.0, faulting module mfc71.dll, version 7.10.6030.0, fault address 0x00066878. Processing media-specific event for [ashdisp.exe!ws!] Event Record #/Type6339 / Error Event Submitted/Written: 10/15/2007 04:08:10 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application TeaTimer.exe, version 1.5.0.9, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type6334 / Error Event Submitted/Written: 10/14/2007 08:47:23 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application SpybotSD.exe, version 1.5.1.15, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type6333 / Error Event Submitted/Written: 10/14/2007 08:15:35 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application sdupdate.exe, version 1.0.6.4, faulting module , version 0.0.0.0, fault address 0x00000000. Processing media-specific event for [sdupdate.exe!ws!] Event Record #/Type6327 / Warning Event Submitted/Written: 10/13/2007 11:03:03 AM Event ID/Source: 32068 / Microsoft Fax Event Description: The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly. Country/region code: '*' Area code: '*' -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type31827 / Warning Event Submitted/Written: 10/15/2007 04:14:53 PM Event ID/Source: 4226 / Tcpip Event Description: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. Event Record #/Type31731 / Error Event Submitted/Written: 10/13/2007 10:47:50 PM Event ID/Source: 10010 / DCOM Event Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout. Event Record #/Type31728 / Warning Event Submitted/Written: 10/13/2007 11:05:34 AM Event ID/Source: 256 / PlugPlayManager Event Description: Timed out sending notification of device interface change to window of "ModemDeviceChange" Event Record #/Type31697 / Error Event Submitted/Written: 10/13/2007 10:56:33 AM Event ID/Source: 11 / PlugPlayManager Event Description: The device Root\LEGACY_STREAMDISPATCHER\0000 disappeared from the system without first being prepared for removal. Event Record #/Type31694 / Warning Event Submitted/Written: 10/13/2007 10:53:51 AM / 10/13/2007 10:53:52 AM Event ID/Source: 256 / PlugPlayManager Event Description: Timed out sending notification of device interface change to window of "ModemDeviceChange" -- End of Deckard's System Scanner: finished at 2007-10-15 21:09:39 ------------ |
|
|
|
|
10-16-2007, 03:43 PM
|
#6 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
i am also getting these two icons on my desktop for online security guide and live safety center which keep coming back after i delete them. i think they are part of the spyware because i get pop ups from them too i believe.
|
|
|
|
|
10-16-2007, 09:45 PM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
Can anyone check my logs out and let me know how to fix it? My computer is at the point where i cannot leave it online because the pop-ups just keep coming. thank you for your time.
|
|
|
|
|
10-16-2007, 11:00 PM
|
#8 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,948
OS: Windows 7 Ultimate
|
Re: help removing trojan and adware
Hi and welcome to TSF.
Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription. -------------------------------------------------------------- Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. -------------------------------------------------------------- Download combofix from here **Save it directly to your desktop**
Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
 Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
10-17-2007, 10:10 AM
|
#9 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
I did these steps as you listed them and went to run pasted and the program started running. i left it go and went to class i came back and the screen was still on. i started it around 8am and came back now at 12noon. the screen was still on and it was just repeating the same thing it would say "completed Stage_15" and then right under it would say "completed Stage_15A" and this just kept on repeating over and over again. i closed out the box. Was this running correctly? or should it have been taking 4 hours?
|
|
|
|
|
10-17-2007, 09:01 PM
|
#10 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,948
OS: Windows 7 Ultimate
|
Re: help removing trojan and adware
Hi import1,
Please delete your current copy of ComboFix.exe and download an updated version at: http://download.bleepingcomputer.com...a/ComboFix.exe Again save it to your desktop and follow my previous instructions
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
10-17-2007, 09:39 PM
|
#11 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
hi, first off thanks for helping out. second i deleted the old combofix and saved the new one, i attemped to run it but i got a comspec error "the comspec environment variable was found to be corrupt. combofix has attempted repairs & will need to restart" i click ok and then it just closes the program down.
|
|
|
|
|
10-17-2007, 10:27 PM
|
#12 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
ok i restarted my computer and ran again and it worked fine here is the log:
ComboFix 07-10-17.8 - Administrator 2007-10-17 12:04:42.1 - NTFSx86 Script execution time was exceeded on script "C:\ComboFix\osid.vbs". Script execution was terminated. Running from: C:\Documents and Settings\Administrator\desktop\combofix.exe Command switches used :: /killall . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data.\salesmonitor C:\Program Files\Hammer.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\xOe C:\Temp\xOe\tOasF.log C:\WINDOWS\cookies.ini C:\WINDOWS\system32\awttqpn.dll C:\WINDOWS\system32\b1 C:\WINDOWS\system32\beywttfg.ini C:\WINDOWS\system32\gfttwyeb.dll C:\WINDOWS\system32\iwxnlqdk.exe C:\WINDOWS\system32\jkkjk.dll C:\WINDOWS\system32\jkkjk.dll C:\WINDOWS\system32\kcojfrtn.dll C:\WINDOWS\system32\kjkkj.bak1 C:\WINDOWS\system32\kjkkj.bak1 C:\WINDOWS\system32\kjkkj.bak1 C:\WINDOWS\system32\kjkkj.bak2 C:\WINDOWS\system32\kjkkj.bak2 C:\WINDOWS\system32\kjkkj.bak2 C:\WINDOWS\system32\kjkkj.ini C:\WINDOWS\system32\kjkkj.ini C:\WINDOWS\system32\kjkkj.ini C:\WINDOWS\system32\kjkkj.ini2 C:\WINDOWS\system32\kjkkj.ini2 C:\WINDOWS\system32\kjkkj.ini2 C:\WINDOWS\system32\kjkkj.tmp C:\WINDOWS\system32\kjkkj.tmp C:\WINDOWS\system32\kjkkj.tmp C:\WINDOWS\system32\qoipktsy.exe C:\WINDOWS\system32\sldrwfde.dll C:\WINDOWS\winshow.exe . ((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 ))))))))))))))))))))))))))))))) . 2007-10-17 03:04 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-10-15 21:03 <DIR> d-------- C:\Deckard 2007-10-14 20:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-14 18:50 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-14 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-10-13 23:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-13 22:59 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-10-13 11:21 <DIR> d-------- C:\Docum 2007-10-13 10:52 <DIR> d-------- C:\Program Files\CONEXANT 2007-10-12 11:49 <DIR> d-------- C:\Program Files\Webroot 2007-09-28 10:19 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2007-09-27 17:28 <DIR> d-------- C:\Program Files\QuickTime 2007-09-27 17:21 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-27 17:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-12 14:22 --------- d-----w C:\Program Files\Google 2007-10-08 15:38 --------- d-----w C:\Program Files\Java 2007-08-18 19:38 --------- d-----w C:\Program Files\Common Files\SupportSoft 2007-08-18 19:38 --------- d-----w C:\Program Files\Common Files\Scanner 2007-08-18 19:38 --------- d-----w C:\Program Files\ComcastToolbar 2007-08-18 19:38 --------- d-----w C:\Program Files\Comcast 2007-08-18 19:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2007-08-18 19:34 --------- d-----w C:\Program Files\support.com . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32262E1A-2E89-4935-82FF-6F87C309D6C8}] C:\Program Files\Messenger\horevofC:\WINDOWS\system32\rv1\gccb83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D1302DF-EA46-4C1F-B15B-C62CF4D328B6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] 2007-10-17 12:06 339968 --a------ C:\WINDOWS\system32\vlyagipz.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8297037-BC94-41E7-B7A2-808DB5209D69}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\vlyagipz.dll [2007-10-17 12:06 339968] [HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\vlyagipz.dll [2007-10-17 12:06 339968] [HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-03-26 20:20] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-03-26 20:20] "SunKist"="C:\Program Files\Digital Media Reader\shwicon2k.exe" [2004-05-26 20:57] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 22:42] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 13:28] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-01 22:20] "PCLEUSBTip"="C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [] "PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [2003-11-10 16:06] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 11:44] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "SpybotDeletingA8719"=command /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" "SpybotDeletingC4589"=cmd /c del "C:\WINDOWS\system32\ezfvarxk.dllbox" "SpybotDeletingA5106"=command /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" "SpybotDeletingC7988"=cmd /c del "C:\WINDOWS\system32\ezfvarxk.dll_old" "SpybotDeletingA466"=command /c del "C:\WINDOWS\system32\ezfvarxk.dll" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vlyagipz] vlyagipz.dll 2007-10-17 12:06 339968 C:\WINDOWS\system32\vlyagipz.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xfktctqa] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares lite] "C:\Program Files\ARES\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\areslite] "C:\Program Files\Ares Lite Edition\AresLite.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] %WINDIR%\SMINST\RECGUARD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] %WINDIR%\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow] "C:\WINDOWS\winshow.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "PrismXL"=2 (0x2) "Bonjour Service"=2 (0x2) "sprtsvc_ddoctorv2"=2 (0x2) R1 papycpu2;papycpu2;C:\WINDOWS\system32\DRIVERS\papycpu2.sys R1 papyjoy;papyjoy;C:\WINDOWS\system32\DRIVERS\papyjoy.sys R2 StreamDispatcher;StreamDispatcher;C:\WINDOWS\system32\DRIVERS\strmdisp.sys S3 DC21x4;DC21x4 Based Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\dc21x4.sys S3 EMCFILT;Alcor Micro Corp for Emachine- 9361;\??\C:\WINDOWS\System32\Drivers\EMcFilt.sys S3 WISTechVIDCAP;Dazzle DVC170;C:\WINDOWS\system32\drivers\wisgostrm.sys S4 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2);"C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 . Contents of the 'Scheduled Tasks' folder "2007-10-11 19:33:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" "2005-08-05 08:05:53 C:\WINDOWS\Tasks\ISP signup reminder 1.job" - C:\WINDOWS\system32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-17 12:18:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-17 12:21:58 - machine was rebooted . --- E O F --- |
|
|
|
|
10-18-2007, 09:17 PM
|
#13 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,948
OS: Windows 7 Ultimate
|
Re: help removing trojan and adware
Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. -------------------------------------------------------------- Disable S& D Spybot's Tea Timer While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
Download http://www.techsupportforum.com/sect...etTeaTimer.zip Double click ResetTeaTimer.bat to remove all entries set by TeaTimer. Disable AVG Anti-Spyware
Download combofix from here **Save it directly to your desktop** Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall -------------------------------------------------------------- Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan -------------------------------------------------------------- Please download HijackThis. This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Install" button. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. -------------------------------------------------------------- Please reply back with the following logs: C:\ComboFix.txt Panda Online Scan Results HiJackThis log
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
|
10-19-2007, 01:25 PM
|
#14 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
I am having trouble running the combofix with the CFScript, i was able to disabled tea timer and turned off AVG. when i drag the CFScript into combofix it runs as it should but then when it gets to competed stage 5 it just stays there and there is no progress made. I tried restarting my computer and running but that did not work, i have also deleted both combofix and the CFScript and tried to reload and then do it but it still does the same thing. any idea why this is?
|
|
|
|
|
10-19-2007, 09:38 PM
|
#15 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,948
OS: Windows 7 Ultimate
|
Re: help removing trojan and adware
Hi import1,
Please use the following CFScript: Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFScript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
|
10-20-2007, 04:26 PM
|
#17 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,948
OS: Windows 7 Ultimate
|
Re: help removing trojan and adware
Hi import1,
When running CFScript and it gets stuck do you see the following files running in Task Manager? To open Task Manager, right click on the taskbar at the very bottom and select "Task Manager". Then click on the "processes" tab Under the "Image Name" do you see the following files periodically show up? grep.cfexe sed.cfexe Now the first few stages normally take abit longer to complete. It could take up to 10mins for the CFScript to run completely. It may seem like it is stuck, but in the background it is actually doing something. How long have you been giving CFScript to run before closing the window?
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
10-20-2007, 06:21 PM
|
#18 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
I have let the CFScript run all night (about 8 hours) woke up and it was still on the same step. I just ran the CFScript again, let it go for 45mins and it was stopped at Stage_5 i then opened task manager and i did not see either process that you have listed. the only process i see for combofix is nircmd.cfexe, this periodically shows up.
|
|
|
|
|
10-20-2007, 06:46 PM
|
#19 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,494
OS: N/A
|
Re: help removing trojan and adware
Is ComboFix still running? If at anytime that ComboFix takes more than a minute on each Stage_, that means it has hunged.
Let me know if it's still running. Don't kill it just yet
__________________
Question - what have you done for the community today? |
|
|
|
|
10-20-2007, 07:38 PM
|
#20 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 16
OS: xp
|
Re: help removing trojan and adware
its not running anymore i closed it out after it was one stage_5 for 45mins. Last night i let it run all night and it was still on the same thing in the morning when i woke back up.
|
|
|
|
| Thread Tools | |
|
|
-> Run -> paste in the following single line command & click OK
located at the bottom of the page.
then click 
