Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Help, my computer has been hijacked!
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
Page 2 of 2 1 2
 
LinkBack Thread Tools
Old 12-02-2007, 09:11 PM   #21 (permalink)
Registered User
 
Join Date: Sep 2007
Location: Colorado
Posts: 34
OS: XP Pro


Re: Help, my computer has been hijacked!
Hello Iain,

The computer is running much better!


ComboFix 07-11-19.4C - Dan the Man 2007-12-02 20:12:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.231 [GMT -7:00]
Running from: C:\Documents and Settings\Dan the Man\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dan the Man\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\tbexaqcu.exe
C:\WINDOWS\system32\txrlemhk.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\bags amen plan amok
C:\Documents and Settings\All Users\Application Data\Viewrealcdromtons
C:\WINDOWS\system32\tbexaqcu.exe
C:\WINDOWS\system32\txrlemhk.exe
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Dan the Man\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\Favorites\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\x.dat
C:\Documents and Settings\Dan the Man\z.dat
C:\n.bat
C:\Program Files\Common Files\kffz\kffza.exe
C:\Program Files\Common Files\kffz\kffza.lck
C:\Program Files\Common Files\kffz\kffzd\class-barrel
C:\Program Files\Common Files\kffz\kffzd\kffzc.dll
C:\Program Files\Common Files\kffz\kffzd\vocabulary
C:\Program Files\Common Files\kffz\kffzl.exe
C:\Program Files\Common Files\kffz\kffzl.lck
C:\Program Files\Common Files\kffz\kffzm.exe
C:\Program Files\Common Files\kffz\kffzm.lck
C:\Program Files\Common Files\kffz\kffzp.exe
C:\Program Files\inetget2
C:\Program Files\myglobalsearch
C:\Program Files\Words
C:\Program Files\Words\list.txt
C:\Program Files\Words\UnInstall.exe
C:\Program Files\Words\Words.exe
C:\windows\b143.exe
C:\windows\cookies.ini
C:\windows\Fonts\a.zip
C:\windows\kffz
C:\windows\kffz\kffz.dat
C:\windows\kffz\wu
C:\windows\mrofinu1188.exe
C:\windows\system32\blvnuywu.exe
C:\windows\system32\bqirdjtw.exe
C:\windows\system32\c40b8941
C:\windows\system32\enbeexia.exe
C:\windows\system32\fvqetudd.dll
C:\windows\system32\Help.ico
C:\windows\system32\hiotoytu.dll
C:\windows\system32\hmelblbl.ini
C:\windows\system32\ixemyies.exe
C:\windows\system32\jgbuqvrt.dll
C:\windows\system32\jxocxnbi.exe
C:\windows\system32\krfswwxw.dll
C:\windows\system32\kxmrvxbo.ini
C:\windows\system32\lcbscxor.dll
C:\windows\system32\olveadem.ini
C:\windows\system32\pavas.ico
C:\windows\system32\pwllkroe.ini
C:\windows\system32\qcmobqkx.ini
C:\windows\system32\SET3C.tmp
C:\windows\system32\SET3D.tmp
C:\windows\system32\tsuninst.exe
C:\WINDOWS\system32\wxyay.bak1
C:\WINDOWS\system32\wxyay.bak2
C:\WINDOWS\system32\wxyay.ini
C:\WINDOWS\system32\wxyay.ini2
C:\WINDOWS\system32\wxyay.tmp
C:\windows\system32\yayxw.dll
C:\x.dat
C:\z.dat
I:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService






((((((((((((((((((((((((( Files Created from 2007-11-03 to 2007-12-03 )))))))))))))))))))))))))))))))
.

2007-11-30 23:05 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-30 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-29 16:12 <DIR> d-------- C:\NoLopBackups
2007-11-29 16:10 530 --a------ C:\delete.bat
2007-11-26 22:01 <DIR> d-------- C:\VundoFix Backups
2007-11-25 14:11 <DIR> d-------- C:\Deckard
2007-11-25 14:08 776,192 --ahs---- C:\WINDOWS\system32\tatuuarn.ini
2007-11-24 13:45 79,936 --a------ C:\WINDOWS\system32\tvwpgfmh.dll
2007-11-22 21:54 <DIR> d-------- C:\Program Files\CCleaner
2007-11-16 18:06 474 --ahs---- C:\WINDOWS\system32\tibuawvv.ini
2007-11-16 18:05 79,936 --a------ C:\WINDOWS\system32\uuattdjf.dll
2007-11-15 16:16 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-11-15 16:15 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-11-08 20:07 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-08 20:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-29 23:22 --------- d-----w C:\Program Files\Google
2007-11-29 01:01 --------- d-----w C:\Program Files\Norton AntiVirus
2007-11-29 00:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-27 05:01 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\U3
2007-11-25 02:01 --------- d-----w C:\Program Files\QuickTime
2007-11-25 01:49 --------- d-----w C:\Program Files\iTunes
2007-11-25 01:48 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-24 02:15 22 ----a-w C:\WINDOWS\Fonts\zia03516
2007-11-15 04:33 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\LimeWire
2007-11-15 04:30 --------- d-----w C:\Program Files\LimeWire
2007-11-15 00:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 04:56 --------- d-----w C:\Program Files\InterActual
2007-11-02 04:28 --------- d-----w C:\Program Files\DIFX
2007-10-25 06:10 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\DivX
2007-10-25 06:06 --------- d-----w C:\Program Files\DivX
2007-10-20 03:20 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Manager
2007-10-20 03:19 --------- d-----w C:\Program Files\Wal-Mart
2007-10-20 03:19 --------- d-----w C:\Program Files\Common Files\HP
2007-10-20 03:18 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Viewer
2007-09-28 16:08 156,992 ----a-w C:\windows\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2007-09-28 16:07 200,704 ----a-w C:\windows\system32\ssldivx.dll
2007-09-28 16:07 129,784 ----a-w C:\windows\system32\pxafs.dll
2007-09-28 16:07 120,056 ----a-w C:\windows\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ----a-w C:\windows\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2007-09-28 16:05 823,296 ----a-w C:\windows\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 ----a-w C:\windows\system32\divx_xx07.dll
2007-09-28 16:05 81,920 ----a-w C:\windows\system32\dpl100.dll
2007-09-28 16:05 802,816 ----a-w C:\windows\system32\divx_xx11.dll
2007-09-28 16:05 739,840 ----a-w C:\windows\system32\DivX.dll
2007-09-28 16:05 593,920 ----a-w C:\windows\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 ----a-w C:\windows\system32\dpv11.dll
2007-09-28 16:05 53,248 ----a-w C:\windows\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 ----a-w C:\windows\system32\dpus11.dll
2007-09-28 16:05 294,912 ----a-w C:\windows\system32\dpu11.dll
2007-09-28 16:05 294,912 ----a-w C:\windows\system32\dpu10.dll
2007-09-28 16:05 196,608 ----a-w C:\windows\system32\dtu100.dll
2007-09-28 16:05 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-11-29_19.09.39.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 19:27:16 213,048 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 10:00]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 18:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"IgfxTray"="C:\windows\system32\igfxtray.exe" [2001-08-07 23:25]
"HotKeysCmds"="C:\windows\system32\hkcmd.exe" [2001-08-07 22:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 16:32]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-20 10:53]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-31 11:58:14]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" /pause

S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\windows\system32\DRIVERS\bcm42xx5.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-12-03 02:36:42 C:\windows\Tasks\Norton AntiVirus - Scan my computer - Dan the Man.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 20:15:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-02 20:17:05
.
--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:03 PM, on 12/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system32\igfxtray.exe
C:\windows\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\windows\system32\wuauclt.exe
C:\windows\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Dan the Man\Desktop\Downloads\Dan the Man.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://defendingyourfaith.org/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1146072999566
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} - http://simcity.ea.com/scape/teleport...ScapeTeleX.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 7792 bytes
Cookie Monster is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 12-03-2007, 03:30 PM   #22 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,359
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Help, my computer has been hijacked!
Testing
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 12-03-2007, 08:45 PM   #23 (permalink)
Registered User
 
Join Date: Sep 2007
Location: Colorado
Posts: 34
OS: XP Pro


Re: Help, my computer has been hijacked!
ComboFix 07-11-19.4C - Dan the Man 2007-12-02 20:12:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.231 [GMT -7:00]
Running from: C:\Documents and Settings\Dan the Man\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dan the Man\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\tbexaqcu.exe
C:\WINDOWS\system32\txrlemhk.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\bags amen plan amok
C:\Documents and Settings\All Users\Application Data\Viewrealcdromtons
C:\WINDOWS\system32\tbexaqcu.exe
C:\WINDOWS\system32\txrlemhk.exe
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Dan the Man\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\Favorites\Online Security Guide.lnk
C:\Documents and Settings\Dan the Man\x.dat
C:\Documents and Settings\Dan the Man\z.dat
C:\n.bat
C:\Program Files\Common Files\kffz\kffza.exe
C:\Program Files\Common Files\kffz\kffza.lck
C:\Program Files\Common Files\kffz\kffzd\class-barrel
C:\Program Files\Common Files\kffz\kffzd\kffzc.dll
C:\Program Files\Common Files\kffz\kffzd\vocabulary
C:\Program Files\Common Files\kffz\kffzl.exe
C:\Program Files\Common Files\kffz\kffzl.lck
C:\Program Files\Common Files\kffz\kffzm.exe
C:\Program Files\Common Files\kffz\kffzm.lck
C:\Program Files\Common Files\kffz\kffzp.exe
C:\Program Files\inetget2
C:\Program Files\myglobalsearch
C:\Program Files\Words
C:\Program Files\Words\list.txt
C:\Program Files\Words\UnInstall.exe
C:\Program Files\Words\Words.exe
C:\windows\b143.exe
C:\windows\cookies.ini
C:\windows\Fonts\a.zip
C:\windows\kffz
C:\windows\kffz\kffz.dat
C:\windows\kffz\wu
C:\windows\mrofinu1188.exe
C:\windows\system32\blvnuywu.exe
C:\windows\system32\bqirdjtw.exe
C:\windows\system32\c40b8941
C:\windows\system32\enbeexia.exe
C:\windows\system32\fvqetudd.dll
C:\windows\system32\Help.ico
C:\windows\system32\hiotoytu.dll
C:\windows\system32\hmelblbl.ini
C:\windows\system32\ixemyies.exe
C:\windows\system32\jgbuqvrt.dll
C:\windows\system32\jxocxnbi.exe
C:\windows\system32\krfswwxw.dll
C:\windows\system32\kxmrvxbo.ini
C:\windows\system32\lcbscxor.dll
C:\windows\system32\olveadem.ini
C:\windows\system32\pavas.ico
C:\windows\system32\pwllkroe.ini
C:\windows\system32\qcmobqkx.ini
C:\windows\system32\SET3C.tmp
C:\windows\system32\SET3D.tmp
C:\windows\system32\tsuninst.exe
C:\WINDOWS\system32\wxyay.bak1
C:\WINDOWS\system32\wxyay.bak2
C:\WINDOWS\system32\wxyay.ini
C:\WINDOWS\system32\wxyay.ini2
C:\WINDOWS\system32\wxyay.tmp
C:\windows\system32\yayxw.dll
C:\x.dat
C:\z.dat
I:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService






((((((((((((((((((((((((( Files Created from 2007-11-03 to 2007-12-03 )))))))))))))))))))))))))))))))
.

2007-11-30 23:05 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-30 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-29 16:12 <DIR> d-------- C:\NoLopBackups
2007-11-29 16:10 530 --a------ C:\delete.bat
2007-11-26 22:01 <DIR> d-------- C:\VundoFix Backups
2007-11-25 14:11 <DIR> d-------- C:\Deckard
2007-11-25 14:08 776,192 --ahs---- C:\WINDOWS\system32\tatuuarn.ini
2007-11-24 13:45 79,936 --a------ C:\WINDOWS\system32\tvwpgfmh.dll
2007-11-22 21:54 <DIR> d-------- C:\Program Files\CCleaner
2007-11-16 18:06 474 --ahs---- C:\WINDOWS\system32\tibuawvv.ini
2007-11-16 18:05 79,936 --a------ C:\WINDOWS\system32\uuattdjf.dll
2007-11-15 16:16 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-11-15 16:15 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-11-08 20:07 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-08 20:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-29 23:22 --------- d-----w C:\Program Files\Google
2007-11-29 01:01 --------- d-----w C:\Program Files\Norton AntiVirus
2007-11-29 00:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-27 05:01 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\U3
2007-11-25 02:01 --------- d-----w C:\Program Files\QuickTime
2007-11-25 01:49 --------- d-----w C:\Program Files\iTunes
2007-11-25 01:48 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-24 02:15 22 ----a-w C:\WINDOWS\Fonts\zia03516
2007-11-15 04:33 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\LimeWire
2007-11-15 04:30 --------- d-----w C:\Program Files\LimeWire
2007-11-15 00:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 04:56 --------- d-----w C:\Program Files\InterActual
2007-11-02 04:28 --------- d-----w C:\Program Files\DIFX
2007-10-25 06:10 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\DivX
2007-10-25 06:06 --------- d-----w C:\Program Files\DivX
2007-10-20 03:20 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Manager
2007-10-20 03:19 --------- d-----w C:\Program Files\Wal-Mart
2007-10-20 03:19 --------- d-----w C:\Program Files\Common Files\HP
2007-10-20 03:18 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Viewer
2007-09-28 16:08 156,992 ----a-w C:\windows\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2007-09-28 16:07 200,704 ----a-w C:\windows\system32\ssldivx.dll
2007-09-28 16:07 129,784 ----a-w C:\windows\system32\pxafs.dll
2007-09-28 16:07 120,056 ----a-w C:\windows\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ----a-w C:\windows\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2007-09-28 16:05 823,296 ----a-w C:\windows\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 ----a-w C:\windows\system32\divx_xx07.dll
2007-09-28 16:05 81,920 ----a-w C:\windows\system32\dpl100.dll
2007-09-28 16:05 802,816 ----a-w C:\windows\system32\divx_xx11.dll
2007-09-28 16:05 739,840 ----a-w C:\windows\system32\DivX.dll
2007-09-28 16:05 593,920 ----a-w C:\windows\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 ----a-w C:\windows\system32\dpv11.dll
2007-09-28 16:05 53,248 ----a-w C:\windows\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 ----a-w C:\windows\system32\dpus11.dll
2007-09-28 16:05 294,912 ----a-w C:\windows\system32\dpu11.dll
2007-09-28 16:05 294,912 ----a-w C:\windows\system32\dpu10.dll
2007-09-28 16:05 196,608 ----a-w C:\windows\system32\dtu100.dll
2007-09-28 16:05 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-11-29_19.09.39.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 19:27:16 213,048 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 10:00]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 18:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"IgfxTray"="C:\windows\system32\igfxtray.exe" [2001-08-07 23:25]
"HotKeysCmds"="C:\windows\system32\hkcmd.exe" [2001-08-07 22:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 16:32]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-20 10:53]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-31 11:58:14]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" /pause

S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\windows\system32\DRIVERS\bcm42xx5.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-12-03 02:36:42 C:\windows\Tasks\Norton AntiVirus - Scan my computer - Dan the Man.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 20:15:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-02 20:17:05
.
--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:03 PM, on 12/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system32\igfxtray.exe
C:\windows\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\windows\system32\wuauclt.exe
C:\windows\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Dan the Man\Desktop\Downloads\Dan the Man.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://defendingyourfaith.org/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1146072999566
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} - http://simcity.ea.com/scape/teleport...ScapeTeleX.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 7792 bytes
Cookie Monster is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 12-04-2007, 02:59 PM   #24 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,359
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Help, my computer has been hijacked!
Hi again

Please tell me how your system is running – I’m good but I’m not psychic!


Combofix
  • Close any open browsers.
  • Open notepad and copy/paste the text in the box below into it:

Code:
File::
C:\WINDOWS\system32\tatuuarn.ini
C:\WINDOWS\system32\tvwpgfmh.dll
C:\WINDOWS\system32\tibuawvv.ini
C:\WINDOWS\system32\uuattdjf.dll

Folder::
C:\WINDOWS\Fonts\zia03516
Looking at the image below as an example

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at "C:\ComboFix.txt"

Do not mouseclick combofix's window whilst it's running. This may cause it to stall.

CAUTION! Anyone else thinking of using the above script does so at their own risk - you may end up re-installing Windows!


Please post the log C:\ComboFix.txt along with a fresh HijackThis Log for further review.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 12-05-2007, 04:05 PM   #25 (permalink)
Registered User
 
Join Date: Sep 2007
Location: Colorado
Posts: 34
OS: XP Pro


Re: Help, my computer has been hijacked!
Iain,
Sorry about that. My 94 year old grandmother passed away and I had to go out of town for a few days. I had my kid send you those logs when I was away. Anyway the computer is running much, much better! Thanks.
I'm wondering if these 7 adware/viruses that Norton AV detects but leaves on my system are anything to worry about? Here they are followed by the posts you requested.

The file C:\qoobox\Quarantine\C\WINDOWS\system32\blvnuywu.exe.vir is a Adware threat.

The file C:\qoobox\Quarantine\C\WINDOWS\system32\bqirdjtw.exe.vir is a Adware threat.

The file C:\RECYCLER\S-1-5-21-329068152-484763869-1957994488-1003\Dc129.exe is a Adware threat.

The file C:\RECYCLER\S-1-5-21-329068152-484763869-1957994488-1003\Dc130.exe is a Adware threat.

The file C:\RECYCLER\S-1-5-21-329068152-484763869-1957994488-1003\Dc131.exe is a Adware threat.

The file C:\qoobox\Quarantine\C\WINDOWS\system32\enbeexia.exe.vir is a Adware threat.

The file C:\qoobox\Quarantine\C\WINDOWS\system32\ixemyies.exe.vir is a Adware threat.

The file C:\qoobox\Quarantine\C\WINDOWS\system32\jxocxnbi.exe.vir is a Adware threat.

The file C:\WINDOWS\system32\tbexaqcu.exe is a Adware threat.

The file C:\WINDOWS\system32\txrlemhk.exe is a Adware threat.









ComboFix 07-11-19.4C - Dan the Man 2007-12-04 20:17:38.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.156 [GMT -7:00]
Running from: C:\Documents and Settings\Dan the Man\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dan the Man\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\tatuuarn.ini
C:\WINDOWS\system32\tibuawvv.ini
C:\WINDOWS\system32\tvwpgfmh.dll
C:\WINDOWS\system32\uuattdjf.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Fonts\zia03516\
C:\WINDOWS\system32\tatuuarn.ini
C:\WINDOWS\system32\tibuawvv.ini
C:\WINDOWS\system32\tvwpgfmh.dll
C:\WINDOWS\system32\uuattdjf.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-02 21:14 <DIR> d-------- C:\WINDOWS\OPTIONS
2007-12-02 21:14 <DIR> d-------- C:\Program Files\TRENDnet
2007-12-02 21:14 270,720 --a------ C:\WINDOWS\system32\drivers\RTL8187B.sys
2007-12-02 21:14 21,035 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2007-11-30 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-29 16:12 <DIR> d-------- C:\NoLopBackups
2007-11-29 16:10 530 --a------ C:\delete.bat
2007-11-26 22:01 <DIR> d-------- C:\VundoFix Backups
2007-11-25 14:11 <DIR> d-------- C:\Deckard
2007-11-22 21:54 <DIR> d-------- C:\Program Files\CCleaner
2007-11-08 20:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 02:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-04 17:30 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\LimeWire
2007-12-03 04:56 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\U3
2007-12-03 04:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-29 23:22 --------- d-----w C:\Program Files\Google
2007-11-29 01:01 --------- d-----w C:\Program Files\Norton AntiVirus
2007-11-25 02:01 --------- d-----w C:\Program Files\QuickTime
2007-11-25 01:49 --------- d-----w C:\Program Files\iTunes
2007-11-25 01:48 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-24 02:15 22 ----a-w C:\WINDOWS\Fonts\zia03516
2007-11-15 04:30 --------- d-----w C:\Program Files\LimeWire
2007-11-15 00:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 04:56 --------- d-----w C:\Program Files\InterActual
2007-11-02 04:28 --------- d-----w C:\Program Files\DIFX
2007-10-25 06:10 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\DivX
2007-10-25 06:06 --------- d-----w C:\Program Files\DivX
2007-10-20 03:20 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Manager
2007-10-20 03:19 --------- d-----w C:\Program Files\Wal-Mart
2007-10-20 03:19 --------- d-----w C:\Program Files\Common Files\HP
2007-10-20 03:18 --------- d-----w C:\Documents and Settings\Dan the Man\Application Data\Wal-Mart Digital Photo Viewer
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-11-29_19.09.39.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-03 04:14:26 32,038 ----a-r C:\windows\Installer\{C43421C0-0DCB-4F26-8A3B-BF16155F9879}\ARPPRODUCTICON.exe
+ 2007-05-05 03:40:22 215,040 ----a-w C:\windows\OPTIONS\CABS\rtl8187B.sys
+ 2004-12-29 06:31:00 102,400 ----a-w C:\windows\OPTIONS\CABS\RTWUWZC.exe
+ 2007-02-08 23:04:44 32,768 ----a-w C:\windows\OPTIONS\CABS\SetDrv.exe
+ 2006-11-30 23:56:30 77,312 ----a-w C:\windows\OPTIONS\CABS\SetDrv64.exe
+ 2002-10-02 16:57:12 13,532 ----a-w C:\windows\system32\drivers\SjyPkt.sys
+ 2005-05-24 19:27:16 213,048 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 ----a-w C:\windows\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-05-05 03:40:22 215,040 ----a-w C:\windows\system32\ReinstallBackups\0002\DriverFiles\RTL8187B.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 10:00]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 18:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"IgfxTray"="C:\windows\system32\igfxtray.exe" [2001-08-07 23:25]
"HotKeysCmds"="C:\windows\system32\hkcmd.exe" [2001-08-07 22:36]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 16:32]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-20 10:53]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-31 11:58:14]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]
Wireless Configuration Utility HW.14.lnk - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe [2007-07-09 15:43:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" /pause

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\windows\system32\DRIVERS\RTL8187B.sys
R3 SjyPkt;SjyPkt;\??\C:\windows\System32\Drivers\SjyPkt.sys
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\windows\system32\DRIVERS\bcm42xx5.sys

*Newly Created Service* - SJYPKT
.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 03:15:47 C:\windows\Tasks\Norton AntiVirus - Scan my computer - Dan the Man.job"
- C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-04 22:04:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-04 2242 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-02 20:17
.
--- E O F ---









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:44 PM, on 12/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\windows\Explorer.EXE
C:\windows\system32\wuauclt.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system32\igfxtray.exe
C:\windows\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Documents and Settings\Dan the Man\Desktop\Downloads\Dan the Man.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://defendingyourfaith.org/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1146072999566
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} - http://simcity.ea.com/scape/teleport...ScapeTeleX.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 8165 bytes
Cookie Monster is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 12-06-2007, 02:42 PM   #26 (permalink)
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,359
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: Help, my computer has been hijacked!
Hi again Pete

I’m very sorry to hear about your grandmother – may I offer my condolences.

Those files you listed are safe in Combofix’s quarantine or System Restore points and we’ll clear both shortly.

All your logs are clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure.


Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.



The following procedure will clear out the tools we've used as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bold text into the Run box and click OK:


ComboFix /u



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon


Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Comodo Personal Firewall
Sygate Personal Firewall
ZoneAlarm


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are three very good free Antivirus products which are available:
BitDefender Free
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

PC Safety & Security - What Do I Need?.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 12-07-2007, 01:34 PM   #27 (permalink)
Registered User
 
Join Date: Sep 2007
Location: Colorado
Posts: 34
OS: XP Pro


Re: Help, my computer has been hijacked!
Iain,

Thank you for your condolences, and thank you, thank you, thank you for your willingness to help me with this. You're the best, God bless!

Pete
Cookie Monster is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 
Page 2 of 2 1 2

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 03:28 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85