|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-27-2007, 06:47 PM
|
#1 (permalink) |
|
Registered User
|
MALWARE causes random windows
After downloading something from theserialcom (out of curiosity), my computer became infected with some type of malware.
SYMPTOMS flashing icon near clock (bottom right corner of screen) when I right or lift click on icon, it disappears and then reappears randow IE windows faking Windows Security Center upon closing these windows, explorer.exe may end and restart in 1 min. random notification windows telling me to get antispyware (fake) closing notification windows causes random IE windows to pop out IE windows dont appear is I unplug ethernet cable but the icon appears I notices these files w/ random names in system32 and programs files. Deleting them wouldnt work because it was in use. I saw some of these files in SECURITY TASK MANAGER. I removed them, but they reappeared after rebooting Here is my first Deckard log. Deckard's System Scanner v20071014.68 Run by Owner on 2007-11-27 15:41:47 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- -- Last 5 Restore Point(s) -- 103: 2007-11-27 23:21:55 UTC - RP135 - Deckard's System Scanner Restore Point 102: 2007-11-26 23:01:34 UTC - RP134 - Uninstall "BitCometBHO" 101: 2007-11-26 20:27:25 UTC - RP133 - Move file to quarantine: DDC 100: 2007-11-26 20:27:02 UTC - RP132 - Move file to quarantine: akxaxxqg.dll 99: 2007-11-26 20:26:41 UTC - RP131 - Move file to quarantine: lkvakqtf.dll -- First Restore Point -- 1: 2007-11-20 17:16:07 UTC - RP33 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 247 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-11-27 15:44:21 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Digital Media Reader\shwiconEM.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\alg.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Owner\Desktop\dss.exe C:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: 216.39.69.102 view.atdmt.com O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7370EB59-8ADA-4AA7-8DF3-95B2512110F2} - C:\WINDOWS\system32\pmnlj.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: {c5d21931-dee2-08ba-e8f4-6a366c04e12a} - {a21e40c6-63a6-4f8e-ab80-2eed13912d5c} - C:\WINDOWS\system32\xyxufmbo.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [a41b5492] rundll32.exe "C:\WINDOWS\system32\jvkyfcof.dll",b O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCfox000!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O9 - Extra button: (no name) - CmdMapping - (file missing) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1112139997984 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124595952156 O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} () - http://dm.screensavers.com/dm/instal...sinstaller.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} () - http://download.yahoo.com/dl/installs/yab_af.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/...chsettings.cab O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: lkvakqtf - C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\trhwswxe.exe /service!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- End of file - 9198 bytes -- HijackThis Fixed Entries (C:\Documents and Settings\Owner\Desktop\backups\) - backup-20070704-185504-547 O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7> R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys R2 HOSTNT - c:\windows\system32\drivers\hostnt.sys R2 MHDRV - c:\windows\system32\drivers\mhdrv.sys <Not Verified; Rainbow China Co,.Ltd; RC-UMH3.1> R2 RCMHDOG - c:\windows\system32\drivers\rcmhdog.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> R3 SunkFilt39 (Alcor Micro Corp - 3239) - c:\windows\system32\drivers\sunkfilt39.sys <Not Verified; Alcor Micro Corp.; SunkFilt39> S2 nvmini (NVIDIA Compatible Windows Miniport Driver) - c:\windows\system32\drivers\nvmini.sys (file missing) S3 arp8023 - c:\windows\system32\drivers\arp8023.sys (file missing) S3 NAL (Nal Service ) - c:\windows\system32\drivers\iqvw32.sys <Not Verified; Intel Corporation; Intel(R) iQVW32.SYS> S3 SQTECH905C (DualCamera) - c:\windows\system32\drivers\capt905c.sys <Not Verified; Service & Quality Technology.; SQ905c> S3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt92> S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing) S3 SymIM (Symantec Network Security Intermediate Filter Service) - c:\windows\system32\drivers\symim.sys (file missing) S3 SymIMMP - c:\windows\system32\drivers\symim.sys (file missing) S3 TIEHDUSB - c:\windows\system32\drivers\tiehdusb.sys <Not Verified; Texas Instruments Incorporated; Texas Instruments Incorporated Educational Handheld Device> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 DomainService - c:\windows\system32\trhwswxe.exe /service (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2004-11-28 20:15:34 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 3.job -- Files created between 2007-10-27 and 2007-11-27 ----------------------------- 2007-11-27 15:10:28 80960 --a------ C:\WINDOWS\system32\xyxufmbo.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-27 15:07:28 85056 --a------ C:\WINDOWS\system32\jvkyfcof.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-27 15:02:22 71232 --a------ C:\WINDOWS\system32\keaprmlm.exe <Not Verified; ; DDC> 2007-11-26 20:10:56 0 d-------- C:\Program Files\SpywareBlaster 2007-11-26 18:07:11 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-26 18:07:05 0 d-------- C:\WINDOWS\LastGood 2007-11-26 12:27:25 80960 --a------ C:\WINDOWS\system32\cikmxuhl.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-26 12:20:27 145984 --a------ C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-26 12:20:01 145984 --a------ C:\WINDOWS\system32\nvyuapsy.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-25 16:07:10 0 d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2007-11-25 16  45 0 d-------- C:\Documents and Settings\Owner\Application Data\Logitech2007-11-25 16:03:53 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-11-25 16:03:17 69632 --a------ C:\WINDOWS\system32\KemXML.dll <Not Verified; Logitech Inc.; Logitech SetPoint> 2007-11-25 16:03:17 163840 --a------ C:\WINDOWS\system32\kemutb.dll <Not Verified; Logitech Inc.; Logitech SetPoint> 2007-11-25 16:03:16 110592 --a------ C:\WINDOWS\system32\KemWnd.dll <Not Verified; Logitech Inc.; Logitech SetPoint> 2007-11-25 16:03:16 135168 --a------ C:\WINDOWS\system32\KemUtil.dll <Not Verified; Logitech Inc.; Logitech SetPoint> 2007-11-25 16:03:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2007-11-25 16:02:58 0 d-------- C:\Program Files\Logitech 2007-11-25 16:02:53 0 d-------- C:\Program Files\Common Files\Logitech 2007-11-25 16:02:42 0 d-------- C:\Documents and Settings\Owner\Application Data\InstallShield 2007-11-20 15:18:37 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-11-20 15:18:15 0 d-------- C:\Program Files\SUPERAntiSpyware 2007-11-20 15:18:15 0 d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com 2007-11-20 14:55:04 0 d--h----- C:\WINDOWS\PIF 2007-11-20 11:19:41 0 d-------- C:\!KillBox 2007-11-20 09:15:55 445458 --ahs---- C:\WINDOWS\system32\jlnmp.ini2 2007-11-20 09:15:41 319072 -----n--- C:\WINDOWS\system32\pmnlj.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-19 21:26:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion???????????????????? 2007-11-19 21:26:47 0 d-------- C:\WINDOWS\system32\qfovkrbl!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-19 21:26:40 40183 ---hs---- C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe??????????????????????????????? 2007-11-19 21:26:38 37376 --a------ C:\WINDOWS\system32\tuvvvst.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 2007-11-19 10:17:30 0 d-------- C:\Program Files\DAEMON Tools 2007-11-18 17:33:07 0 d-------- C:\Program Files\HyCam2 2007-11-18 17:18:39 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-17 20:59:49 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-11-17 12:10:51 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-15 19:19:25 0 d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan 2007-11-15 19:19:19 0 d-------- C:\Program Files\Security Task Manager 2007-11-05 16:34:30 0 d-------- C:\WINDOWS\pss -- Find3M Report --------------------------------------------------------------- 2007-11-26 19:08:35 0 d-------- C:\Program Files\Digital Media Reader 2007-11-26 18:24:32 0 d-------- C:\Program Files\Opera 2007-11-26 16:08:52 0 d-------- C:\Program Files\Common Files 2007-11-26 15:02:48 0 d-------- C:\Program Files\BitComet 2007-11-25 21:31:00 0 d-------- C:\Documents and Settings\Owner\Application Data\U3 2007-11-25 16:02:58 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-11-20 15:17:22 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-20 14:52:41 0 d-------- C:\Documents and Settings\Owner\Application Data\AVG7 2007-11-19 21:26:50 0 d-------- C:\Documents and Settings\Owner\Application Data\Yahoo! 2007-11-19 17:46:53 0 d-------- C:\Program Files\Adware Away 2007-11-17 21:10:03 0 d-------- C:\Program Files\Yahoo! 2007-11-15 19:33:46 0 d-------- C:\Program Files\SBC Self Support Tool 2007-11-15 19:33:06 0 d-------- C:\Program Files\Common Files\Motive 2007-11-02 16:29:35 0 d-------- C:\Program Files\Java 2007-10-09 19:30:07 0 d-------- C:\Program Files\GameSpy Arcade 2007-10-09 19:27:58 0 d-------- C:\Program Files\Microsoft Games 2007-09-11 03:02:40 81920 --a------ C:\WINDOWS\system32\frapsvid.dll <Not Verified; Beepa P/L; FRAPS> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7370EB59-8ADA-4AA7-8DF3-95B2512110F2}] 11/20/2007 09:15 AM 319072 --------- C:\WINDOWS\system32\pmnlj.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a21e40c6-63a6-4f8e-ab80-2eed13912d5c}] 11/27/2007 03:10 PM 80960 --a------ C:\WINDOWS\system32\xyxufmbo.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] 11/26/2007 12:20 PM 145984 --a------ C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\lkvakqtf.dll [11/26/2007 12:20 PM 145984]!!!!!!!!!!!!!!!!!!!!!!!!!! [-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [03/11/2004 02:18 PM] "@"="" [] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [01/29/2004 06:13 PM] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [08/03/2004 09:31 PM] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [03/31/2003 04:00 AM] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [03/31/2003 04:00 AM] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [03/31/2003 04:00 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM] "mhaau"="C:\WINDOWS\System32\mhaau.exe" [] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/12/2006 08:51 PM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [04/11/2007 03:32 PM C:\WINDOWS\KHALMNPR.Exe] "a41b5492"="C:\WINDOWS\system32\jvkyfcof.dll" [11/27/2007 03:07 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/03/2004 11:56 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [1/29/2006 10:53:29 PM] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [11/25/2007 4:03:15 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 7:05:56 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"=1 (0x1) "AllowUnhashedWebView"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] "mhaau"=C:\WINDOWS\System32\mhaau.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 01:55 PM 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 01:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lkvakqtf] lkvakqtf.dll 11/26/2007 12:20 PM 145984 C:\WINDOWS\system32\lkvakqtf.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnlj.dll!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] rundll32.exe C:\WINDOWS\system32\drvzon.dll,startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\herylqhk] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\herylqhk.dll" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility] LOGI_MWX.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mrspktyd]!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rundll32.exe "C:\Program Files\mrspktyd\wvsrabut.dll",Init [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2] C:\Program Files\SecCenter\scprot4.exe!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys] C:\WINDOWS\IGW.exe!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSysM] C:\WINDOWS\IGM.exe!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] 1!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "Avg7UpdSvc"=2 (0x2) "Avg7Alrt"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44207e38-e482-11da-a25c-001111398ad8}] explore\Command- E:\boot.exe open\Command- E:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2351141-6655-11dc-a317-001111398ad8}] explore\Command- M:\boot.exe open\Command- M:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7091c27-ef87-11da-a25d-001111398ad8}] explore\Command- E:\boot.exe open\Command- E:\boot.exe *Newly Created Service* - DOMAINSERVICE -- Hosts ----------------------------------------------------------------------- 216.39.69.102 view.atdmt.com -- End of Deckard's System Scanner: finished at 2007-11-27 15:46:42 ------------ Last edited by Ried; 11-28-2007 at 06:56 AM. Reason: removed live link to malware site |
|
     |
| Sponsored Links |
|
11-28-2007, 03:37 PM
|
#3 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
MORE INFO
the website the IE popup takes me to is from www dot savethisinformation dot com when i boot with the eternet cabe unpluged, the flashing icon disappears completely  when i plug the eternet cable back in after booting unpluged, the flashing icon still is not there.  btw thanks for removing the "theserial" site link on my original post. I didn't notice it. Also, the smilie in my 1st post is actually :06 Last edited by brokencomputer; 11-28-2007 at 03:59 PM. |
|
|
|
|
11-29-2007, 11:23 AM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. |
|
|
|
|
11-29-2007, 04:12 PM
|
#5 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
Great... I did everything BUT pull the internet cable (I forgot). I just noticed when I finished the scans. But here are my logs:
first combofix ComboFix 07-11-30.3 - Owner 2007-11-29 15:42:30.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.62 [GMT -8:00] Running from: C:\Documents and Settings\Owner\desktop\combofix.exe Command switches used :: /killall * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\H752B6NR\www.broadcaster.com C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\Owner\Favorites\Online Security Guide.lnk C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe C:\WINDOWS\setup.exe C:\WINDOWS\system32\bfvhqxye.dll C:\WINDOWS\system32\Cache C:\WINDOWS\system32\cikmxuhl.dll C:\WINDOWS\system32\eyxqhvfb.ini C:\WINDOWS\system32\focfykvj.ini C:\WINDOWS\system32\jlnmp.ini C:\WINDOWS\system32\jlnmp.ini2 C:\WINDOWS\system32\jvkyfcof.dll C:\WINDOWS\system32\keaprmlm.exe C:\WINDOWS\system32\lhpihdrl.exe C:\WINDOWS\system32\lkvakqtf.dllbox C:\WINDOWS\system32\nvllprwc.dll C:\WINDOWS\system32\osrcoidq.ini C:\WINDOWS\system32\pmnlj.dll C:\WINDOWS\system32\qdiocrso.dll C:\WINDOWS\system32\qfovkrbl C:\WINDOWS\system32\qfovkrbl\bg1.gif C:\WINDOWS\system32\qfovkrbl\bgtop.gif C:\WINDOWS\system32\qfovkrbl\bottom1.gif C:\WINDOWS\system32\qfovkrbl\essentials.gif C:\WINDOWS\system32\qfovkrbl\icon1.ico C:\WINDOWS\system32\qfovkrbl\install1.gif C:\WINDOWS\system32\qfovkrbl\left1.gif C:\WINDOWS\system32\qfovkrbl\li.gif C:\WINDOWS\system32\qfovkrbl\logo.gif C:\WINDOWS\system32\qfovkrbl\main.htm C:\WINDOWS\system32\qfovkrbl\mainframe.htm C:\WINDOWS\system32\qfovkrbl\qfovkrbl1.exe C:\WINDOWS\system32\qfovkrbl\qfovkrbl2.exe C:\WINDOWS\system32\qfovkrbl\qfovkrbl3.exe C:\WINDOWS\system32\qfovkrbl\reinstall1.gif C:\WINDOWS\system32\qfovkrbl\right1.gif C:\WINDOWS\system32\qfovkrbl\s1.htm C:\WINDOWS\system32\qfovkrbl\s2.htm C:\WINDOWS\system32\qfovkrbl\s3.htm C:\WINDOWS\system32\qfovkrbl\SMTop1.gif C:\WINDOWS\system32\qfovkrbl\SMTop2.gif C:\WINDOWS\system32\qfovkrbl\SMTop3.gif C:\WINDOWS\system32\qfovkrbl\SMTop4.gif C:\WINDOWS\system32\qfovkrbl\soft1_off.gif C:\WINDOWS\system32\qfovkrbl\soft1_off_ext.gif C:\WINDOWS\system32\qfovkrbl\soft1_on.gif C:\WINDOWS\system32\qfovkrbl\soft1_on_ext.gif C:\WINDOWS\system32\qfovkrbl\soft2_off.gif C:\WINDOWS\system32\qfovkrbl\soft2_off_ext.gif C:\WINDOWS\system32\qfovkrbl\soft2_on.gif C:\WINDOWS\system32\qfovkrbl\soft2_on_ext.gif C:\WINDOWS\system32\qfovkrbl\soft3_off.gif C:\WINDOWS\system32\qfovkrbl\soft3_off_ext.gif C:\WINDOWS\system32\qfovkrbl\soft3_on.gif C:\WINDOWS\system32\qfovkrbl\soft3_on_ext.gif C:\WINDOWS\system32\qfovkrbl\softbottom_off.gif C:\WINDOWS\system32\qfovkrbl\softbottom_on.gif C:\WINDOWS\system32\qfovkrbl\softleft_off.gif C:\WINDOWS\system32\qfovkrbl\softleft_on.gif C:\WINDOWS\system32\qfovkrbl\top1.gif C:\WINDOWS\system32\qfovkrbl\top2.gif C:\WINDOWS\system32\qfovkrbl\turnoff1.gif C:\WINDOWS\system32\qfovkrbl\turnon1.gif C:\WINDOWS\system32\rlfsewmo.dll C:\WINDOWS\system32\rljowofx.exe C:\WINDOWS\system32\rvbvrfhn.dll C:\WINDOWS\system32\tuvvvst.dll C:\WINDOWS\system32\xyxufmbo.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_NPF -------\DomainService -------\nm ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))) . 2007-11-30 15:45 . 2007-11-30 15:45 71,232 --a------ C:\WINDOWS\system32\oknpctip.exe 2007-11-27 15:21 . 2007-11-27 15:21 <DIR> d-------- C:\Deckard 2007-11-26 20:10 . 2007-11-26 20:10 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-11-26 18:07 . 2007-11-26 18:07 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2007-11-26 18:07 . 2007-11-26 18:07 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-11-26 12:24 . 2007-11-26 12:24 780,275 --ahs---- C:\WINDOWS\system32\gqxxaxka.ini 2007-11-26 12:20 . 2007-11-26 12:20 145,984 --a------ C:\WINDOWS\system32\nvyuapsy.dll 2007-11-25 16:07 . 2007-11-25 16:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2007-11-25 16:06 . 2007-11-25 16:06 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Logitech 2007-11-25 16:05 . 2007-11-25 16:05 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2007-11-25 16:05 . 2007-11-25 16:05 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2007-11-25 16:04 . 2007-04-11 15:32 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe 2007-11-25 16:04 . 2007-04-11 15:32 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys 2007-11-25 16:04 . 2007-04-11 15:32 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys 2007-11-25 16:04 . 2007-04-11 15:32 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys 2007-11-25 16:03 . 2007-11-25 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2007-11-25 16:03 . 2007-04-23 04:00 163,840 --a------ C:\WINDOWS\system32\kemutb.dll 2007-11-25 16:03 . 2007-04-23 04:00 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll 2007-11-25 16:03 . 2007-04-23 04:00 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll 2007-11-25 16:03 . 2007-04-23 04:00 69,632 --a------ C:\WINDOWS\system32\KemXML.dll 2007-11-25 16:02 . 2007-11-25 16:02 <DIR> d-------- C:\Program Files\Logitech 2007-11-25 16:02 . 2007-11-25 16:03 <DIR> d-------- C:\Program Files\Common Files\Logitech 2007-11-25 16:02 . 2007-11-25 16:02 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\InstallShield 2007-11-25 15:05 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-11-20 15:18 . 2007-11-26 19:32 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-11-20 15:18 . 2007-11-20 15:18 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com 2007-11-20 15:18 . 2007-11-20 15:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-11-20 14:55 . 2007-11-20 14:55 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-19 21:26 . 2007-11-19 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-11-19 12:57 . 2006-04-20 03:51 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.ORIGINAL 2007-11-19 10:17 . 2007-11-19 10:17 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-11-18 17:33 . 2007-11-18 17:33 <DIR> d-------- C:\Program Files\HyCam2 2007-11-18 17:18 . 2007-11-18 17:31 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-17 20:59 . 2007-11-17 21:50 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-11-17 12:10 . 2007-11-17 12:10 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-15 19:19 . 2007-11-15 19:41 <DIR> d-------- C:\Program Files\Security Task Manager 2007-11-15 19:19 . 2007-11-28 15:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan 2007-11-02 16:29 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-10-24 15:16 . 2007-11-20 14:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7 2007-10-24 15:16 . 2007-10-24 15:16 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-10-24 15:14 . 2007-10-24 15:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-24 15:14 . 2007-11-26 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-10-24 15:02 . 2007-10-24 15:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2007-10-12 17:50 . 2007-11-19 16:48 <DIR> d-------- C:\Downloads . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 03:08 --------- d-----w C:\Program Files\Digital Media Reader 2007-11-27 02:24 --------- d-----w C:\Program Files\Opera 2007-11-26 23:02 --------- d-----w C:\Program Files\BitComet 2007-11-26 05:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\U3 2007-11-26 00:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-20 23:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-11-20 05:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo! 2007-11-20 01:46 --------- d-----w C:\Program Files\Adware Away 2007-11-18 05:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-11-18 05:10 --------- d-----w C:\Program Files\Yahoo! 2007-11-16 03:33 --------- d-----w C:\Program Files\SBC Self Support Tool 2007-11-16 03:33 --------- d-----w C:\Program Files\Common Files\Motive 2007-11-03 00:29 --------- d-----w C:\Program Files\Java 2007-10-24 00:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-10 03:30 --------- d-----w C:\Program Files\GameSpy Arcade 2007-10-10 03:27 --------- d-----w C:\Program Files\Microsoft Games 2005-05-09 01:05 1,198 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2006-04-19 18:26 9,767 --sha-w C:\WINDOWS\system32\ospcont.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 23:56] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-03-11 14:18] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-01-29 18:13] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:31] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 04:00] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 04:00] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 04:00] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "mhaau"="C:\WINDOWS\System32\mhaau.exe" [] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-12 20:51] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" [] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 15:20] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-29 22:53:29] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-25 16:03:15] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lkvakqtf] lkvakqtf.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnlj.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] rundll32.exe C:\WINDOWS\system32\drvzon.dll,startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\herylqhk] regsvr32 /u C:\Documents and Settings\All Users\Application Data\herylqhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility] LOGI_MWX.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] C:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mrspktyd] rundll32.exe C:\Program Files\mrspktyd\wvsrabut.dll,Init [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2] C:\Program Files\SecCenter\scprot4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys] C:\WINDOWS\IGW.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSysM] C:\WINDOWS\IGM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "Avg7UpdSvc"=2 (0x2) "Avg7Alrt"=2 (0x2) R2 HOSTNT;Hostnt;\??\C:\WINDOWS\system32\drivers\hostnt.sys R2 MHDRV;Mhdrv;\??\C:\WINDOWS\system32\drivers\mhdrv.sys R2 RCMHDOG;RCMHDOG;\??\C:\WINDOWS\system32\drivers\rcmhdog.sys S2 nvmini;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys S3 arp8023;arp8023;C:\WINDOWS\system32\drivers\arp8023.sys S3 NAL;Nal Service ;\??\C:\WINDOWS\System32\Drivers\iqvw32.sys S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys S3 sense4v2;Senselock SenseIV v2.x Service;C:\WINDOWS\system32\Drivers\sense4v2.sys S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys S3 TIEHDUSB;TIEHDUSB;C:\WINDOWS\system32\drivers\tiehdusb.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44207e38-e482-11da-a25c-001111398ad8}] \shell\explore\Command - E:\boot.exe \shell\open\Command - E:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2351141-6655-11dc-a317-001111398ad8}] \shell\explore\Command - M:\boot.exe \shell\open\Command - M:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7091c27-ef87-11da-a25d-001111398ad8}] \shell\explore\Command - E:\boot.exe \shell\open\Command - E:\boot.exe . Contents of the 'Scheduled Tasks' folder "2004-11-29 04:15:34 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 15:59:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-11-30 16:02:16 - machine was rebooted . --- E O F --- HJT log Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 4:06:53 PM, on 11/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCfox000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1112139997984 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124595952156 O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/...chsettings.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: lkvakqtf - lkvakqtf.dll (file missing) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- End of file - 7036 bytes What should I do now??? Should I restore my computer and repeat your steps??? Last edited by brokencomputer; 11-29-2007 at 04:14 PM. |
|
|
|
|
11-29-2007, 04:15 PM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
No, do not restore.
Don't worry about it...it's fine. I'll be back with instructions shortly.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-29-2007, 04:16 PM
|
#7 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
While I'm reviewing these logs, please do this:
Create an uninstall list:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-29-2007, 05:44 PM
|
#8 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
Here is my new HJT log:
Ad-Aware SE Personal Adobe Photoshop 5.5 Adobe Reader 8.1.1 Adobe® Photoshop® Album Starter Edition 3.2 Adware Away v3.1.3 AVG 7.5 Canon i550 CDDRV_Installer chm2web 2.6.167 DeepBurner Pro v1.8.0.225 Digital Media Reader Express Burn Uninstall GameSpy Arcade Google Earth HijackThis 2.0.0 Hotfix for Windows XP (KB915865) HyperCam 2 Intel(R) Extreme Graphics Driver Intel(R) PRO Network Adapters and Drivers Intel(R) PROSet J2SE Development Kit 5.0 Update 2 J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 Java 2 Runtime Environment, SE v1.4.2 Java 2 Runtime Environment, SE v1.4.2_07 Java 2 SDK, SE v1.4.2_07 Java(TM) 6 Update 3 KhalInstallWrapper Lexmark Photo Center Lexmark Z700-P700 Series Logitech SetPoint Macromedia Shockwave Player Microsoft .NET Framework 1.1 Microsoft Halo Microsoft Halo Trial Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office 2000 Disc 2 Microsoft Office 2000 Professional Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable Microsoft Works Mozilla Firefox (2.0.0.9) MPlay64 MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 Parser and SDK MyDSC2 NJStar Chinese WP Opera 9.24 Panasonic VS3_VS2_MX6_SA6 USB-???? Panda ActiveScan QuickTime RealPlayer RegAlyzer Security Task Manager 1.7e Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB943460) SoftV92 Data Fax Modem with SmartCP Spybot - Search & Destroy 1.4 SpywareBlaster v3.5.1 SUPERAntiSpyware Free Edition Symantec Visual Cafe TI Connect 1.6 Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Visual IP InSight(SBC) Windows Backup Utility Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885626 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinRAR archiver WinZip Yahoo! Install Manager Yahoo! Toolbar |
|
|
|
|
11-29-2007, 06:28 PM
|
#9 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCfox000 Close HijackThis now. --------------------------------------------------------------------------------------------- Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 Java 2 Runtime Environment, SE v1.4.2 Java 2 Runtime Environment, SE v1.4.2_07 Java 2 SDK, SE v1.4.2_07 These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall previous version when you update, nor tell you that you should. Leave Java(TM) 6 Update 3 alone, as it is the most recent. --------------------------------------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
|
11-30-2007, 04:01 PM
|
#10 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
uhm while J2SE Runtime Environment 5.0 Update 2 was uninstalling, I changed to another window to continue to read your post. When I went back to ADD/REMOVE programs, the window was white and busy. After waiting a long time, I exited ADD/REMOVE. I went to ADD/REMOVE again and found that J2SE Runtime Environment 5.0 Update 2 wasn't there. I didn't seem to have finish unstalling J2SE Runtime Environment 5.0 Update 2 either. Is this an incomplete uninstallation or was it that Java gave me no warning when the uninstallation was finished?!?!?!?!?!?
Last edited by brokencomputer; 11-30-2007 at 04:03 PM. |
|
|
|
|
11-30-2007, 04:41 PM
|
#11 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
Heres combofix log:
ComboFix 07-11-30.3 - Owner 2007-12-01 16:12:18.2 - NTFSx86 Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\gqxxaxka.ini C:\WINDOWS\system32\nvyuapsy.dll C:\WINDOWS\system32\oknpctip.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\gqxxaxka.ini C:\WINDOWS\system32\nvyuapsy.dll C:\WINDOWS\system32\oknpctip.exe . ((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))) . 2007-11-27 15:21 . 2007-11-27 15:21 <DIR> d-------- C:\Deckard 2007-11-26 20:10 . 2007-11-26 20:10 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-11-26 18:07 . 2007-11-26 18:07 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-11-25 16:07 . 2007-11-25 16:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2007-11-25 16:06 . 2007-11-25 16:06 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Logitech 2007-11-25 16:05 . 2007-11-25 16:05 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2007-11-25 16:05 . 2007-11-25 16:05 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2007-11-25 16:04 . 2007-04-11 15:32 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe 2007-11-25 16:04 . 2007-04-11 15:32 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys 2007-11-25 16:04 . 2007-04-11 15:32 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys 2007-11-25 16:04 . 2007-04-11 15:32 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys 2007-11-25 16:03 . 2007-11-25 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2007-11-25 16:03 . 2007-04-23 04:00 163,840 --a------ C:\WINDOWS\system32\kemutb.dll 2007-11-25 16:03 . 2007-04-23 04:00 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll 2007-11-25 16:03 . 2007-04-23 04:00 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll 2007-11-25 16:02 . 2007-11-25 16:02 <DIR> d-------- C:\Program Files\Logitech 2007-11-25 16:02 . 2007-11-25 16:03 <DIR> d-------- C:\Program Files\Common Files\Logitech 2007-11-25 16:02 . 2007-11-25 16:02 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\InstallShield 2007-11-25 15:05 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-11-25 15:05 . 2004-08-03 22:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-11-20 15:18 . 2007-11-26 19:32 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-11-20 15:18 . 2007-11-20 15:18 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com 2007-11-20 15:18 . 2007-11-20 15:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-11-20 14:55 . 2007-11-20 14:55 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-19 21:26 . 2007-11-19 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-11-19 12:57 . 2006-04-20 03:51 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.ORIGINAL 2007-11-19 12:57 . 2006-04-20 03:51 359,808 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys.ORIGINAL 2007-11-19 10:17 . 2007-11-19 10:17 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-11-18 17:18 . 2007-11-18 17:31 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-17 20:59 . 2007-11-17 21:50 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-11-17 12:10 . 2007-11-17 12:10 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-15 19:19 . 2007-11-15 19:41 <DIR> d-------- C:\Program Files\Security Task Manager 2007-11-15 19:19 . 2007-11-28 15:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan 2007-11-02 16:29 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-02 00:07 --------- d-----w C:\Program Files\Java 2007-11-27 03:08 --------- d-----w C:\Program Files\Digital Media Reader 2007-11-27 02:24 --------- d-----w C:\Program Files\Opera 2007-11-26 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-11-26 23:02 --------- d-----w C:\Program Files\BitComet 2007-11-26 05:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\U3 2007-11-26 00:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-20 23:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-11-20 22:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7 2007-11-20 05:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Yahoo! 2007-11-20 01:46 --------- d-----w C:\Program Files\Adware Away 2007-11-18 05:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-11-18 05:10 --------- d-----w C:\Program Files\Yahoo! 2007-11-16 03:33 --------- d-----w C:\Program Files\SBC Self Support Tool 2007-11-16 03:33 --------- d-----w C:\Program Files\Common Files\Motive 2007-10-24 23:16 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2007-10-24 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-24 23:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prevx 2007-10-24 00:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-10 03:30 --------- d-----w C:\Program Files\GameSpy Arcade 2007-10-10 03:27 --------- d-----w C:\Program Files\Microsoft Games 2005-05-09 01:05 1,198 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat 2006-04-19 18:26 9,767 --sha-w C:\WINDOWS\system32\ospcont.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 23:56] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-03-11 14:18] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-01-29 18:13] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:31] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 04:00] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 04:00] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2003-03-31 04:00] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-12 20:51] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" [] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 15:20] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-29 22:53:29] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-25 16:03:15] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] rundll32.exe C:\WINDOWS\system32\drvzon.dll,startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\herylqhk] regsvr32 /u C:\Documents and Settings\All Users\Application Data\herylqhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility] LOGI_MWX.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] C:\Program Files\Microsoft Money\System\mnyexpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mrspktyd] rundll32.exe C:\Program Files\mrspktyd\wvsrabut.dll,Init [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2] C:\Program Files\SecCenter\scprot4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys] C:\WINDOWS\IGW.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSysM] C:\WINDOWS\IGM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "Avg7UpdSvc"=2 (0x2) "Avg7Alrt"=2 (0x2) R2 HOSTNT;Hostnt;\??\C:\WINDOWS\system32\drivers\hostnt.sys R2 MHDRV;Mhdrv;\??\C:\WINDOWS\system32\drivers\mhdrv.sys R2 RCMHDOG;RCMHDOG;\??\C:\WINDOWS\system32\drivers\rcmhdog.sys S2 nvmini;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys S3 arp8023;arp8023;C:\WINDOWS\system32\drivers\arp8023.sys S3 NAL;Nal Service ;\??\C:\WINDOWS\System32\Drivers\iqvw32.sys S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys S3 sense4v2;Senselock SenseIV v2.x Service;C:\WINDOWS\system32\Drivers\sense4v2.sys S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys S3 TIEHDUSB;TIEHDUSB;C:\WINDOWS\system32\drivers\tiehdusb.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44207e38-e482-11da-a25c-001111398ad8}] \shell\explore\Command - E:\boot.exe \shell\open\Command - E:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2351141-6655-11dc-a317-001111398ad8}] \shell\explore\Command - M:\boot.exe \shell\open\Command - M:\boot.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7091c27-ef87-11da-a25d-001111398ad8}] \shell\explore\Command - E:\boot.exe \shell\open\Command - E:\boot.exe . Contents of the 'Scheduled Tasks' folder "2004-11-29 04:15:34 C:\WINDOWS\Tasks\ISP signup reminder 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-01 16:33:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-01 16:35:24 - machine was rebooted C:\ComboFix2.txt ... 2007-11-30 16:02 . --- E O F --- now HJT log: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 4:40:11 PM, on 12/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\WINDOWS\system32\notepad.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1112139997984 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124595952156 O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/...chsettings.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- End of file - 6809 bytes |
|
|
|
|
11-30-2007, 05:12 PM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Hi, regarding Java... without seeing a new uninstall list, I can't say. If it's not in Add/Remove, I'd venture to say that it was a Windows hiccup, or that it finished while you were looking elsewhere.
Can you tell me why AVG 7.5 is installed, but no longer active? All it's services are disabled through msconfig. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "Avg7UpdSvc"=2 (0x2) "Avg7Alrt"=2 (0x2) Please re-enable these, reboot the machine, and then do this: You are using an outdated version of HijackThis. Please uninstall from Add or Remove Programs, and then delete your current version. Next, download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Please post a new log with the updated version.. Do not fix anything in HijackThis since they may be harmless. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-30-2007, 06:07 PM
|
#13 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
When I tried to update AVG, there was an error so I disabled AVG to prevent future problems. However, I keep forgetting to install AVG again (which I plan to do so soon)
HJT log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:02:04 PM, on 12/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Digital Media Reader\shwiconem.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [mhaau] C:\WINDOWS\System32\mhaau.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1112139997984 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124595952156 O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/...chsettings.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- End of file - 7089 bytes |
|
|
|
|
11-30-2007, 06:25 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Java O9 entries look like they've reverted to an older version.
Please produce another Uninstall List.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-30-2007, 06:32 PM
|
#15 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
Ad-Aware SE Personal
Adobe Photoshop 5.5 Adobe Reader 8.1.1 Adobe® Photoshop® Album Starter Edition 3.2 Adware Away v3.1.3 AVG 7.5 Canon i550 CDDRV_Installer chm2web 2.6.167 DeepBurner Pro v1.8.0.225 Digital Media Reader Express Burn Uninstall GameSpy Arcade Google Earth HijackThis 2.0.2 Hotfix for Windows XP (KB915865) Intel(R) Extreme Graphics Driver Intel(R) PRO Network Adapters and Drivers Intel(R) PROSet J2SE Development Kit 5.0 Update 2 Java(TM) 6 Update 3 KhalInstallWrapper Lexmark Photo Center Lexmark Z700-P700 Series Logitech SetPoint Macromedia Shockwave Player Microsoft .NET Framework 1.1 Microsoft Halo Microsoft Halo Trial Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office 2000 Disc 2 Microsoft Office 2000 Professional Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable Microsoft Works Mozilla Firefox (2.0.0.9) MPlay64 MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 Parser and SDK MyDSC2 NJStar Chinese WP Opera 9.24 Panasonic VS3_VS2_MX6_SA6 USB-???? Panda ActiveScan QuickTime RealPlayer RegAlyzer Security Task Manager 1.7e Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB943460) SoftV92 Data Fax Modem with SmartCP Spybot - Search & Destroy 1.4 SpywareBlaster v3.5.1 SUPERAntiSpyware Free Edition Symantec Visual Cafe TI Connect 1.6 Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Visual IP InSight(SBC) Windows Backup Utility Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885626 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinRAR archiver WinZip Yahoo! Install Manager Yahoo! Toolbar Also, why is it that the time of posting is one hour ahead of normal time when I first see the post??? The second time I see the post, the time normal. The time of posting changed from 7:25 to 6:25 for your last post!!! Is this a bug in the website? Last edited by brokencomputer; 11-30-2007 at 06:34 PM. |
|
|
|
|
11-30-2007, 06:36 PM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Do you use this, are you a developer, or was it installed mistakenly at one time?
J2SE Development Kit 5.0 Update 2 I've done the same thing myself in the past, is why I ask. If you don't use it, uninstall it also.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
12-01-2007, 10:17 AM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
Ok, that's fine then.
Regarding your question about the posting times, I'm not sure. Mine seem to be OK. Check in your user control panel, and see if your local settings are correct. As far as malware removal goes, please do this: Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
12-01-2007, 10:49 AM
|
#19 (permalink) |
|
Registered User
|
Re: MALWARE causes random windows
??? a random window popped up saying
update process FAILED. No further antivirus actions can be performed. It also says something about 21 new virus updates. I am trying again right now Last edited by brokencomputer; 12-01-2007 at 11:06 AM. |
|
|
|
|
12-01-2007, 12:22 PM
|
#20 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: MALWARE causes random windows
kaspersky online scanner seems to be having some issues the past day.
If still no joy, try this one instead: Go here to run an online scannner from ESET.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
| Thread Tools | |
|
|
-> Run -> paste in the following single line command & click OK
