|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-26-2007, 10:55 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Home Edition
|
Trojan Viruses, Spyware and Malware - HELP!!
So, I hope this helps. I think this is what I may have?
blackdoor Trojan metworm-i.virus@fp psw.x-virtrojan spyware.cyberlog-x trojan-spy.win32@mx My Activescan log Incident Status Location Adware:Adware/Amera Not disinfected c:\program files\qdrpack\qdrpack9.exe Virus:Generic Malware Disinfected Operating system Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\kanyd.dll Potentially unwanted tool:application/funweb Not disinfected c:\program files\FunWebProducts Potentially unwanted tool:application/mywebsearch Not disinfected c:\program files\MyWebSearch Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\18\202e8ed2-5be43d09[Matrix.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\18\202e8ed2-5be43d09[Dummy.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\25\9180419-6c3e81f3[BnnnnBaa.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\25\9180419-6c3e81f3[VaannnaaBaa.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\25\9180419-6c3e81f3[Bnnnnn.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\61\6274277d-4ab79a3f[A.class] Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-673a3d9c-65837ba8.zip[A.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-c023e5d-16a41e5b.zip[BnnnnBaa.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-c023e5d-16a41e5b.zip[VaannnaaBaa.class] Virus:Trj/ClassLoader.AH Disinfected C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-c023e5d-16a41e5b.zip[Bnnnnn.class] Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Maemae\Cookies\maemae@adserver.easyad[1].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Maemae\Cookies\maemae@apmebf[1].txt Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Maemae\Cookies\maemae@findwhat[1].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Maemae\Desktop\SmitfraudFix\Process.exe Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\Maemae\Desktop\SmitfraudFix\Reboot.exe Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Maemae\Desktop\SmitfraudFix\restart.exe Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Maemae\Local Settings\Temp\Cookies\maemae@ad.yieldmanager[1].txt Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Maemae\Local Settings\Temp\Cookies\maemae@yadro[1].txt Potentially unwanted tool:Application/AVSystemCare Not disinfected C:\Documents and Settings\Maemae\Local Settings\Temp\qrjatydi.exe Virus:Generic Trojan Disinfected C:\Documents and Settings\Maemae\Local Settings\Temporary Internet Files\Content.IE5\1BZP7XJS\718f466754402ac597de014577627f96[1].zip[b104.exe] Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Maemae\Local Settings\Temporary Internet Files\Content.IE5\T6VHFMKO\!update-4395[1].0000 Adware:Adware/CWS Not disinfected C:\Documents and Settings\Maemae\Local Settings\Temporary Internet Files\Content.IE5\WV8BYL3H\acdt-pid70[1].exe Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Incomplete\T-372505-_cracked_ i want you back scott storch 58.wma Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\(full version) 2001cc rider elvis presly 52.wma Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\i want you back scott storch 01.wma Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\[LiveStream] akoy sayo ikay akin 04.wma Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\[New Version] akoy sayo ikay akin 21.wma Virus:Trj/WmaDownloader.F Disinfected C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\[New Version] cant let you go samantha jade 56.wma Virus:Generic Malware Disinfected C:\Program Files\Common Files\?dobe\r?gsvr32.exe Virus:Trj/Agent.GXF Disinfected C:\WINDOWS\b111.exe Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe My Deckerds scan log Deckard's System Scanner v20071014.68 Run by Maemae on 2007-11-26 21:21:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-11-27 05:22:00 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 82% (more than 75%). Total Physical Memory: 511 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-11-26 21:25:13 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Yahoo!\browser\ybrwicon.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Yahoo!\browser\ycommon.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\QdrModule\QdrModule9.exe C:\Program Files\Common Files\?dobe\r?gsvr32.exe C:\Program Files\QdrPack\QdrPack9.exe C:\Program Files\Insider\Insider.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Belkin\F1U201.401\usbshare.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\alg.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVSCAN.EXE C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Maemae\Local Settings\Temporary Internet Files\Content.IE5\WV8BYL3H\dss[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: {934301ed-b391-698a-1ea4-a0e85160ab30} - {03ba0615-8e0a-4ae1-a896-193bde103439} - C:\WINDOWS\system32\vwgevxhi.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\heacxggu.dll (file missing) O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\hgggggf.dll (file missing) O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL O2 - BHO: (no name) - {CFA9F943-17F8-0124-D82D-38E6738E58E0} - C:\WINDOWS\system32\kanyd.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O2 - BHO: (no name) - {F5A225C4-12A4-412F-AB09-A659D7A91FF8} - C:\WINDOWS\system32\ddcyx.dll (file missing) O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\heacxggu.dll (file missing) O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe" O4 - HKCU\..\Run: [QdrPack9] "C:\Program Files\QdrPack\QdrPack9.exe" O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: F1U201.401.lnk = C:\Program Files\Belkin\F1U201.401\usbshare.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NkbMonitor.exe.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} () - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://maegirl.slide.com/uploader/ImageUploader3.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O20 - Winlogon Notify: heacxggu - C:\WINDOWS\system32\heacxggu.dll (file missing) O20 - Winlogon Notify: hgggggf - C:\WINDOWS\system32\hgggggf.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPWDSVC.EXE O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVSCAN.EXE O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- End of file - 14390 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7> R1 OMCI - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> S3 SbcpHid - c:\windows\system32\drivers\sbcphid.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: PCI Modem Device ID: PCI\VEN_8086&DEV_1080&SUBSYS_10001028&REV_04\4&10416D21&0&08F0 Manufacturer: Name: PCI Modem PNP Device ID: PCI\VEN_8086&DEV_1080&SUBSYS_10001028&REV_04\4&10416D21&0&08F0 Service: Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Multimedia Audio Controller Device ID: PCI\VEN_8086&DEV_266E&SUBSYS_01771028&REV_03\3&172E68DD&0&F2 Manufacturer: Name: Multimedia Audio Controller PNP Device ID: PCI\VEN_8086&DEV_266E&SUBSYS_01771028&REV_03\3&172E68DD&0&F2 Service: -- Scheduled Tasks ------------------------------------------------------------- 2007-11-09 21:01:26 550 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job 2007-08-27 19:53:48 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-10-26 and 2007-11-26 ----------------------------- 2007-11-26 21:17:06 0 d-------- C:\ie-spyad_zo 2007-11-26 21:14:09 0 d-------- C:\Program Files\SpywareBlaster 2007-11-26 19:56:26 105 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys 2007-11-26 19:56:23 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware> 2007-11-26 19:46:31 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-26 19:46:29 0 d-------- C:\WINDOWS\LastGood 2007-11-24 18:22:32 0 dr-h----- C:\$VAULT$.AVG 2007-11-24 17:08:57 0 d-------- C:\Documents and Settings\Maemae\Application Data\AVG7 2007-11-24 17:08:20 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-11-24 17:07:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-24 17:07:36 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-11-21 16:48:49 443142 --ahs---- C:\WINDOWS\system32\xycdd.ini2 2007-11-20 19:23:39 0 d-------- C:\Program Files\Spyware Doctor 2007-11-20 19:23:39 0 d-------- C:\Documents and Settings\Maemae\Application Data\PC Tools 2007-11-20 18:56:25 4096 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-20 18:55:51 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-20 18:55:51 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2007-11-20 18:55:51 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-11-20 18:55:51 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-11-20 18:55:51 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-20 18:47:32 0 d--hs---- C:\WINDOWS\VGVhbVhjZWVk 2007-11-20 18:32:14 0 d-------- C:\Program Files\Insider 2007-11-19 19:53:20 0 d-------- C:\Program Files\W?nSxS 2007-11-19 19:53:19 60928 --a------ C:\WINDOWS\system32\kanyd.dll 2007-11-19 18:38:13 0 d-------- C:\Program Files\MyWebSearch 2007-11-19 18:38:13 0 d-------- C:\Program Files\FunWebProducts 2007-11-19 18:38:13 0 d-------- C:\Documents and Settings\Maemae\Application Data\FunWebProducts 2007-11-19 18:38:12 0 d-------- C:\Program Files\QdrPack 2007-11-19 18:38:12 0 d-------- C:\Program Files\QdrModule 2007-11-19 18:38:12 0 d-------- C:\Program Files\QdrDrive 2007-11-19 18:28:01 0 d-------- C:\Program Files\Outerinfo(2) 2007-11-18 12:16:05 445532 --ahs---- C:\WINDOWS\system32\wycdd.ini2 2007-11-18 00:08:54 2 --a------ C:\WINDOWS\system32\wintisu32.exe 2007-11-18 00:08:51 0 d-------- C:\Program Files\Common Files\?dobe 2007-11-18 00:08:38 0 d-------- C:\Documents and Settings\Maemae\Application Data\?ymbols -- Find3M Report --------------------------------------------------------------- 2007-11-26 20:50:01 0 d-------- C:\Program Files\Winamp 2007-11-26 20:40:51 0 d-------- C:\Program Files\Norton Internet Security 2007-11-26 20:39:54 0 d-------- C:\Program Files\Microsoft IntelliPoint 2007-11-26 20:35:44 0 d-------- C:\Program Files\iTunes 2007-11-26 20:34:11 0 d-------- C:\Program Files\FinePixViewer 2007-11-26 20:32:40 0 d-------- C:\Program Files\Common Files\?dobe 2007-11-26 20:32:28 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-11-26 20:28:52 0 d-------- C:\Program Files\AIM6 2007-11-26 19:44:17 0 d-------- C:\Program Files\Common Files 2007-11-24 19:41:41 0 d-------- C:\Program Files\Google 2007-11-21 16:55:09 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat 2007-11-21 16:55:09 288 --a------ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat 2007-11-20 20:21:09 0 d-------- C:\Documents and Settings\Maemae\Application Data\?ymbols 2007-11-20 19:19:14 0 d-------- C:\Program Files\Windows NT 2007-11-19 19:53:20 0 d-------- C:\Program Files\W?nSxS 2007-10-19 22:29:18 0 d-------- C:\Program Files\Java 2007-10-13 08:22:24 0 d-------- C:\Documents and Settings\Maemae\Application Data\Yahoo! -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03ba0615-8e0a-4ae1-a896-193bde103439}] C:\WINDOWS\system32\vwgevxhi.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}] 10/27/2007 11:37 AM 192512 --a------ C:\Program Files\QdrDrive\QdrDrive8.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] C:\WINDOWS\system32\heacxggu.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}] C:\WINDOWS\system32\hgggggf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CFA9F943-17F8-0124-D82D-38E6738E58E0}] 11/01/2007 05:44 AM 60928 --a------ C:\WINDOWS\system32\kanyd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F5A225C4-12A4-412F-AB09-A659D7A91FF8}] C:\WINDOWS\system32\ddcyx.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\heacxggu.dll [ ] [-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [05/25/2004 09:35 PM] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [10/29/2002 08:18 AM] "CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [09/30/2002 12:00 AM] "CTHelper"="CTHELPER.EXE" [02/20/2003 02:45 PM C:\WINDOWS\system32\CTHELPER.EXE] "AsioReg"="REGSVR32.exe" [08/03/2004 11:56 PM C:\WINDOWS\system32\regsvr32.exe] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [05/11/2000 12:00 AM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [02/28/2005 04:46 PM] "URLLSTCK.exe"="C:\Program Files\Norton Internet Security\UrlLstCk.exe" [12/11/2003 06:35 PM] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [09/22/2005 07:47 PM] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [03/15/2004 12:04 AM] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 12:01 AM] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [02/04/2002 09:32 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 12:11 AM] "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [12/09/2003 01:02 PM] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [09/26/2006 06:49 AM] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [03/23/2005 03:26 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [06/29/2007 05:24 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [08/15/2007 07:15 PM] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [11/02/2007 05:24 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [11/24/2007 05:07 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" [08/15/2005 02:24 PM] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [05/29/2007 05:34 PM] "Aim6"="C:\Program Files\AIM6\aim6.exe" [11/07/2006 07:29 AM] "QdrModule9"="C:\Program Files\QdrModule\QdrModule9.exe" [11/01/2007 11:51 AM] "QdrPack9"="C:\Program Files\QdrPack\QdrPack9.exe" [10/31/2007 10:29 AM] "Insider"="C:\Program Files\Insider\Insider.exe" [11/20/2007 06:32 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Documents and Settings\Maemae\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 7:16:50 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [10/24/2005 9:04:20 PM] Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [9/23/2005 6:04:11 PM] F1U201.401.lnk - C:\Program Files\Belkin\F1U201.401\usbshare.exe [10/29/2005 4:33:25 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 12:01:04 AM] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [5/18/2007 5:51:49 PM] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [8/28/2006 8:51:08 AM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}"= C:\WINDOWS\system32\hgggggf.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\heacxggu] heacxggu.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgggggf] hgggggf.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddcyx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2007-11-26 21:29:18 ------------ Please help!! Thank you so much in advance!! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-28-2007, 10:27 PM
|
#2 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Download SDFix and save it to your
desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. In Safe Mode, right click the SDFix.zip folder and choose Extract All, Open the extracted folder and double click RunThis.bat to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste the contents of the Report.txt back on the forum. ========================================= This will help to identify any malware on your system. Please download Combofix from HERE or HERE Save ComboFix to the desktop. 1. Double click on combo.exe & follow the prompts. 2. When finished, it will produce a logfile located at C:\ComboFix.txt. 3. Copy and Paste the contents of that log in your next reply with a new hijackthis log. Do not use Code or html unless asked for. Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
__________________
Eddy |
|
|
|
|
12-02-2007, 03:17 PM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Home Edition
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
First of all, thanks again for your help.
So I was able to download both programs and I'm not sure if they were both running well though. SDFix- I would run it but then after a couple minutes it would disappear and the screen would not come back up? ComboFix- Would run then say "Access Denied." Basically, I did not get any logs to post on here. I'm sure there's something wrong? |
|
|
|
|
12-02-2007, 04:53 PM
|
#6 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Go to Start > Control Panel > Add/Remove Programs and uninstall the following programs if listed:
PuritySCAN By OIN, OIN, OuterInfo or similar. Reboot and delete this folder if found: C:\Program Files\PurityScan ======================= Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT. O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\heacxggu.dll (file missing) O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\hgggggf.dll (file missing) O2 - BHO: (no name) - {CFA9F943-17F8-0124-D82D-38E6738E58E0} - C:\WINDOWS\system32\kanyd.dll O2 - BHO: (no name) - {F5A225C4-12A4-412F-AB09-A659D7A91FF8} - C:\WINDOWS\system32\ddcyx.dll (file missing) O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\heacxggu.dll (file missing) O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe" O4 - HKCU\..\Run: [QdrPack9] "C:\Program Files\QdrPack\QdrPack9.exe" O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe O20 - Winlogon Notify: heacxggu - C:\WINDOWS\system32\heacxggu.dll (file missing) O20 - Winlogon Notify: hgggggf - C:\WINDOWS\system32\hgggggf.dll (file missing) ======================= Please download The Avenger to your Desktop and unzip it. Copy all the text contained in the code box below ( including the words "files/folders to delete" ) by highlighting it and right clicking and selecting "Copy" Quote:
The Avenger will restart your computer. (if the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.) When you have rebooted, a black command window briefly opens on your desktop, this is normal. A logfile will be created that records all actions that The Avenger performed. This log file is saved to C:\avenger.txt. The deleted files will be backed up and saved to C:\avenger\backup.zip. Once your computer has rebooted, please post back the contents of C:\avenger.txt, a new Hijack This log.
__________________
Eddy Last edited by Pancake; 12-02-2007 at 04:58 PM. |
|
|
|
|
|
12-02-2007, 10:16 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Home Edition
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Logfile of The Avenger version 1, by Swandog46
Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\o^lfjxhw ******************* Script file located at: \??\C:\rchopoaw.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Folder C:\Program Files\QdrModule deleted successfully. Folder C:\Program Files\QdrPack deleted successfully. Folder C:\Program Files\Insider deleted successfully. Folder C:\Program Files\QdrDrive deleted successfully. Folder C:\Program Files\Outerinfo(2) deleted successfully. Could not open folder C:\Program Files\W?nSxS for deletion Deletion of folder C:\Program Files\W?nSxS failed! Could not process line: C:\Program Files\W?nSxS Status: 0xc0000033 Folder C:\Program Files\MyWebSearch deleted successfully. Folder C:\Program Files\FunWebProducts deleted successfully. Folder C:\Documents and Settings\Maemae\Application Data\FunWebProducts deleted successfully. Could not open folder C:\Program Files\Common Files\?dobe for deletion Deletion of folder C:\Program Files\Common Files\?dobe failed! Could not process line: C:\Program Files\Common Files\?dobe Status: 0xc0000033 Could not open folder C:\Documents and Settings\Maemae\Application Data\?ymbols for deletion Deletion of folder C:\Documents and Settings\Maemae\Application Data\?ymbols failed! Could not process line: C:\Documents and Settings\Maemae\Application Data\?ymbols Status: 0xc0000033 Folder C:\WINDOWS\VGVhbVhjZWVk deleted successfully. Completed script processing. ******************* Finished! Terminate. |
|
|
|
|
12-02-2007, 10:18 PM
|
#8 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Home Edition
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
P.S.
I could not find "O4 - HKCU\..\Run: [QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe". I only found QdrModule10, however, I did not have it fixed and/or deleted through HJT. Let me know if I was supposed to. Thanx. |
|
|
|
|
12-02-2007, 10:22 PM
|
#9 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Yes remove QdrModule10 and then post a new HJT log please.Also.....
Go to http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
__________________
Eddy |
|
|
|
|
12-08-2007, 04:48 PM
|
#10 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Home Edition
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:48:54 PM, on 12/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\AIM6\aim6.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Belkin\F1U201.401\usbshare.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.baby-gaga.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: {934301ed-b391-698a-1ea4-a0e85160ab30} - {03ba0615-8e0a-4ae1-a896-193bde103439} - C:\WINDOWS\system32\vwgevxhi.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing) O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: F1U201.401.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://maegirl.slide.com/uploader/ImageUploader3.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- End of file - 10663 bytes ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, December 08, 2007 3:46:17 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/12/2007 Kaspersky Anti-Virus database records: 477460 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 110948 Number of viruses found: 18 Number of infected objects: 36 Number of suspicious objects: 0 Duration of the scan process: 01  07Infected Object Name / Virus Name / Last Action C:\avenger\backup.zip/avenger/Insider/Insider.exe Infected: not-a-virus:AdWare.Win32.Insider.a skipped C:\avenger\backup.zip/avenger/QdrDrive/QdrDrive8.dll Infected: not-a-virus:AdWare.Win32.AdBand.e skipped C:\avenger\backup.zip/avenger/QdrModule/QdrModule9.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\avenger\backup.zip/avenger/QdrPack/QdrPack9.exe Infected: not-a-virus:AdWare.Win32.Agent.vu skipped C:\avenger\backup.zip ZIP: infected - 4 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/WINDOWS/system32/hgggggf.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.apn skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/WINDOWS/system32/heacxggu.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/WINDOWS/system32/pwcexjhu.exe Infected: Trojan.Win32.Obfuscated.kp skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/Program Files/QdrDrive/QdrDrive8.dll Infected: not-a-virus:AdWare.Win32.AdBand.e skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/WINDOWS/system32/kanyd.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282/C:/WINDOWS/system32/rqrganeb.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\AAWTMP\TMP\996282 ZIP: infected - 6 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Maemae\LOCALS~1\Temp\qrjatydi.exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skipped C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\18\202e8ed2-5be43d09/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\18\202e8ed2-5be43d09 ZIP: infected - 1 skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\61\6274277d-4ab79a3f/A.class Infected: Exploit.Java.ByteVerify skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\6.0\61\6274277d-4ab79a3f ZIP: infected - 1 skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-673a3d9c-65837ba8.zip/A.class Infected: Exploit.Java.ByteVerify skipped C:\Documents and Settings\Maemae\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-673a3d9c-65837ba8.zip ZIP: infected - 1 skipped C:\Documents and Settings\Maemae\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Maemae\Desktop\VIRUS & SPYWARE PROGRAMS\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Maemae\Desktop\VIRUS & SPYWARE PROGRAMS\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Maemae\Desktop\VIRUS & SPYWARE PROGRAMS\SmitfraudFix.exe RarSFX: infected - 2 skipped C:\Documents and Settings\Maemae\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\Application Data\AOL OCP\AIM\Storage\data\01\localStorage\common.cls Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\History\History.IE5\MSHist012007120820071209\index.dat Object is locked skipped C:\Documents and Settings\Maemae\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\Eighties classic.wma Infected: Trojan-Downloader.WMA.Wimad.k skipped C:\Documents and Settings\Maemae\ntuser.dat Object is locked skipped C:\Documents and Settings\Maemae\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\Antispam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BC50B71.htm Infected: Exploit.HTML.Mht skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C586CD0.htm Infected: Exploit.HTML.Mht skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0DA16B73 Infected: Trojan.Java.ClassLoader.h skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0DA4156F Infected: Trojan.Java.ClassLoader.d skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\10A213BF Infected: Trojan-Downloader.Win32.Pacer.e skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\165F07D3.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7F8A0D14 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-210504-484.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP3\A0005211.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP3\A0005221.exe Infected: not-a-virus:AdWare.Win32.Insider.a skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP3\A0005223.dll Infected: not-a-virus:AdWare.Win32.AdBand.e skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP3\A0005225.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP3\A0005227.exe Infected: not-a-virus:AdWare.Win32.Agent.vu skipped C:\System Volume Information\_restore{8F134460-509C-4694-9157-DF84091DE702}\RP7\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{2ECE7827-FA7B-49C2-A01C-60FAD89F4740}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\{00000004-00000000-00000002-00001102-00000004-10031102}.CDF Object is locked skipped Scan process completed. |
|
|
|
|
12-08-2007, 05:17 PM
|
#11 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Trojan Viruses, Spyware and Malware - HELP!!
Ok.Just these to tidy up and we are done...
Please download the OTMoveIt by OldTimer Save it to your desktop. Please double-click OTMoveIt.exe to run it Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\Documents and Settings\Maemae\My Documents\My Music\iTunes\Limewire\Eighties classic.wma Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste. Click the red Moveit! button. Close OTMoveIt If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. ================================================ Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT. O2 - BHO: {934301ed-b391-698a-1ea4-a0e85160ab30} - {03ba0615-8e0a-4ae1-a896-193bde103439} - C:\WINDOWS\system32\vwgevxhi.dll (file missing)
__________________
Eddy |
|
|
|
| Thread Tools | |
|
|
