|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-28-2007, 05:34 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Infected computer - Baidu.dll
Hi there, thanks in advance for your help.
I believe I may have run into problems when using Chinese P2P software for watching soccer games for free over the internet. Although the problem may have been going on longer than that. Since downloading these programmes, a mysterious toolbar arrived in my IE browser with Chinese text, and my computer began running very slowly and my pop up blocker was blocking an alarming number of pop ups. My anti virus software soon flagged up a "PUP" and so after panicking and attempting to remove all the P2P software and failing with one folder entitled "Baidu" I tried running a full Mcafee scan. Every time McAfee attempted to remove it my computer would crash or freeze. After posting in the McAfee technical forum I was directed here, and after running the scan as directed, it found a ridiculous number of spyware and viruses, which was quite worrying. That's as much information as I've got really. Below is my main.txt log and attached is the extra.txt file as instructed. I hope to hear from you guys soon, thanks again for your help. "Deckard's System Scanner v20071014.68 Run by User on 2007-11-29 00:14:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 97: 2007-11-29 00:14:30 UTC - RP727 - Deckard's System Scanner Restore Point 96: 2007-11-27 20:50:14 UTC - RP726 - System Checkpoint 95: 2007-11-25 19:13:16 UTC - RP725 - Installed AVG 7.5 94: 2007-11-25 19:12:09 UTC - RP724 - Removed AVG 7.5 93: 2007-11-25 18:51:13 UTC - RP723 - Configured PRODUCT_NAME -- First Restore Point -- 1: 2007-09-03 16:43:58 UTC - RP631 - System Checkpoint Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 77% (more than 75%). Total Physical Memory: 480 MiB (512 MiB recommended). System Drive C: has 5.16 GiB (less than 15%) free. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-11-29 00:19:09 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\explorer.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\Keyhook.exe C:\WINDOWS\soundman.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Napster\napster.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\Program Files\Softwin\BitDefender9\bdnagent.exe C:\Program Files\Softwin\BitDefender9\bdswitch.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Sony\SonicStage\SSAAD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\WINDOWS\system32\sistray.exe C:\Program Files\Real\RealPlayer\realplay.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe C:\Program Files\McAfee\VirusScan\Mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\McAfee\MSK\msksrver.exe C:\Program Files\SiteAdvisor\6172\SAService.exe C:\WINDOWS\system32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\McAfee\VirusScan\mcsysmon.exe C:\Program Files\McAfee\VirusScan\mcvsshld.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Documents and Settings\User\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://bar.baidu.com/sobar/defaultsearch.html O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\Program Files\baidu\bar\BaiduBar.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O3 - Toolbar: °ΩΆΘ³¬ΌΆΛΡ°Τ - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Program Files\baidu\bar\BaiduBar.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...sh/swflash.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O20 - AppInit_DLLs: sockspy.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\system32\PAStiSvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 14279 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 BdGuard - c:\windows\system32\drivers\bdguard.sys <Not Verified; ; BDGUARD Dynamic Link Library> R1 StarOpen - c:\windows\system32\drivers\staropen.sys R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S2 FILESpy - c:\program files\softwin\bitdefender9\filespy.sys (file missing) S2 REGSpy - c:\program files\softwin\bitdefender9\regspy.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: Description: Multimedia Audio Controller Device ID: PCI\VEN_1412&DEV_1724&SUBSYS_45534930&REV_01\3&61AAA01&0&40 Manufacturer: Name: Multimedia Audio Controller PNP Device ID: PCI\VEN_1412&DEV_1724&SUBSYS_45534930&REV_01\3&61AAA01&0&40 Service: Class GUID: Description: Network Controller Device ID: PCI\VEN_1317&DEV_8201&SUBSYS_32011113&REV_11\3&61AAA01&0&48 Manufacturer: Name: Network Controller PNP Device ID: PCI\VEN_1317&DEV_8201&SUBSYS_32011113&REV_11\3&61AAA01&0&48 Service: -- Scheduled Tasks ------------------------------------------------------------- 2007-11-29 00:20:00 366 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job 2007-11-26 09:20:59 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-11-25 19:21:56 338 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2007-11-25 19:21:54 330 --a------ C:\WINDOWS\Tasks\McQcTask.job -- Files created between 2007-10-29 and 2007-11-29 ----------------------------- 2007-11-28 23:39:35 0 d-------- C:\ie-spyad_zo 2007-11-28 23:34:55 0 d-------- C:\Program Files\SpywareBlaster 2007-11-28 20:33:57 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-28 20:33:52 0 d-------- C:\WINDOWS\LastGood 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24:28 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2007-11-25 19:21:36 0 d-------- C:\Program Files\McAfee.com 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:21:07 0 d-------- C:\Program Files\McAfee 2007-11-25 19:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04:37 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 18:36:05 28672 --a------ C:\WINDOWS\system32\drivers\BDGuard.SYS <Not Verified; ; BDGUARD Dynamic Link Library> 2007-11-24 18:36:05 7904 --a------ C:\WINDOWS\system32\BDGuardS.DAT 2007-11-24 18:36:05 1464 --a------ C:\WINDOWS\system32\BDGuard.DAT 2007-11-24 15:52:05 0 d-------- C:\Program Files\baidu 2007-11-24 15:51:46 0 d-------- C:\Program Files\Common Files\Synacast -- Find3M Report --------------------------------------------------------------- 2007-11-29 00:18:24 81984 --a------ C:\WINDOWS\system32\bdod.bin 2007-11-28 23:57:34 14 --a------ C:\WINDOWS\system32\getfile.dat 2007-11-28 23:08:52 0 d-------- C:\Program Files\Napster 2007-11-28 23:05:49 0 d-------- C:\Program Files\Messenger 2007-11-28 23:02:34 0 d-------- C:\Program Files\iTunes 2007-11-28 23:01:33 0 d-------- C:\Program Files\Google 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files 2007-11-25 18:49:02 0 d-------- C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30:20 0 d-------- C:\Program Files\Creative 2007-11-10 19:14:38 0 d-------- C:\Program Files\iPod 2007-11-10 19:12:44 0 d-------- C:\Program Files\QuickTime 2007-10-31 20:26:17 26184 --a------ C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51:24 0 d-------- C:\Program Files\Windows Media Connect 2 2007-10-28 16:40:37 0 d-------- C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10:42 0 d-------- C:\Program Files\Finale NotePad 2007 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 19/09/2007 06:15 329032 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}] 07/11/2007 14:40 1355907 --a------ C:\PROGRA~1\baidu\bar\baidubar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [31/10/2003 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [12/05/2004 15:22] "SoundMan"="SOUNDMAN.EXE" [17/08/2005 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [13/09/2005 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [29/06/2006 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [11/03/2005 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [09/06/2005 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [06/04/2005 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [12/10/2006 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [15/07/2005 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/11/2007 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [03/08/2007 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [24/08/2007 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [22/07/2007 20:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [08/05/2006 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [21/05/2007 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [26/07/2007 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [16/08/2005 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2007-11-29 00:20:59 ------------" |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-30-2007, 04:51 PM
|
#2 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
Hi...
Please download The Avenger to your Desktop and unzip it. Copy all the text contained in the code box below ( including the words "folders to delete" ) by highlighting it and right clicking and selecting "Copy" Quote:
The Avenger will restart your computer. (if the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.) When you have rebooted, a black command window briefly opens on your desktop, this is normal. A logfile will be created that records all actions that The Avenger performed. This log file is saved to C:\avenger.txt. The deleted files will be backed up and saved to C:\avenger\backup.zip. Once your computer has rebooted, please post back the contents of C:\avenger.txt and a new Hijack This log.
__________________
Eddy |
|
|
|
|
|
12-01-2007, 04:44 AM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Re: Infected computer - Baidu.dll
Hi! Thanks very much for your help. One thing I forgot to mention in my first post was my D and E drives aren't working either. Not sure if that would be related...?
Anyway here is the bit from Avenger, followed by a new HijackThis log. "Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ymdbxmrs ******************* Script file located at: \??\C:\WINDOWS\kgcldupi.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Folder C:\Program Files\baidu deleted successfully. Completed script processing. ******************* Finished! Terminate." "Deckard's System Scanner v20071014.68 Run by User on 2007-12-01 11:41:09 Computer is in Normal Mode. -------------------------------------------------------------------------------- Percentage of Memory in Use: 83% (more than 75%). Total Physical Memory: 480 MiB (512 MiB recommended). System Drive C: has 5.15 GiB (less than 15%) free. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-12-01 11:41:39 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\Keyhook.exe C:\WINDOWS\soundman.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Napster\napster.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\Program Files\Softwin\BitDefender9\bdnagent.exe C:\Program Files\Softwin\BitDefender9\bdswitch.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Sony\SonicStage\SSAAD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\WINDOWS\system32\sistray.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe C:\Program Files\McAfee\VirusScan\Mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\McAfee\MSK\msksrver.exe C:\Program Files\SiteAdvisor\6172\SAService.exe C:\WINDOWS\system32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\McAfee\VirusScan\mcsysmon.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Documents and Settings\User\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://bar.baidu.com/sobar/defaultsearch.html O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing) O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O3 - Toolbar: °ΩΆΘ³¬ΌΆΛΡ°Τ - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing) O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...sh/swflash.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O20 - AppInit_DLLs: sockspy.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\system32\PAStiSvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 14319 bytes -- Files created between 2007-11-01 and 2007-12-01 ----------------------------- 2007-11-28 23:39:35 0 d-------- C:\ie-spyad_zo 2007-11-28 23:34:55 0 d-------- C:\Program Files\SpywareBlaster 2007-11-28 20:33:57 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24:28 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2007-11-25 19:21:36 0 d-------- C:\Program Files\McAfee.com 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:21:07 0 d-------- C:\Program Files\McAfee 2007-11-25 19:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04:37 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 18:36:05 28672 --a------ C:\WINDOWS\system32\drivers\BDGuard.SYS <Not Verified; ; BDGUARD Dynamic Link Library> 2007-11-24 18:36:05 7904 --a------ C:\WINDOWS\system32\BDGuardS.DAT 2007-11-24 18:36:05 1464 --a------ C:\WINDOWS\system32\BDGuard.DAT 2007-11-24 15:51:46 0 d-------- C:\Program Files\Common Files\Synacast -- Find3M Report --------------------------------------------------------------- 2007-12-01 11:40:35 81984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-01 11:09:24 14 --a------ C:\WINDOWS\system32\getfile.dat 2007-11-28 23:08:52 0 d-------- C:\Program Files\Napster 2007-11-28 23:05:49 0 d-------- C:\Program Files\Messenger 2007-11-28 23:02:34 0 d-------- C:\Program Files\iTunes 2007-11-28 23:01:33 0 d-------- C:\Program Files\Google 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files 2007-11-25 18:49:02 0 d-------- C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30:20 0 d-------- C:\Program Files\Creative 2007-11-10 19:14:38 0 d-------- C:\Program Files\iPod 2007-11-10 19:12:44 0 d-------- C:\Program Files\QuickTime 2007-10-31 20:26:17 26184 --a------ C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51:24 0 d-------- C:\Program Files\Windows Media Connect 2 2007-10-28 16:40:37 0 d-------- C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10:42 0 d-------- C:\Program Files\Finale NotePad 2007 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 19/09/2007 06:15 329032 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}] C:\PROGRA~1\baidu\bar\baidubar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [31/10/2003 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [12/05/2004 15:22] "SoundMan"="SOUNDMAN.EXE" [17/08/2005 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [13/09/2005 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [29/06/2006 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [11/03/2005 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [09/06/2005 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [06/04/2005 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [12/10/2006 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [15/07/2005 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/11/2007 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [03/08/2007 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [24/08/2007 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [22/07/2007 20:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [08/05/2006 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [21/05/2007 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [26/07/2007 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [16/08/2005 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2007-12-01 11:42:51 ------------" |
|
|
|
|
12-01-2007, 02:18 PM
|
#4 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing) O3 - Toolbar: °ΩΆΘ³¬ΌΆΛΡ°Τ - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing) ====================== Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Open *notepad* and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe Restart your computer. When finished, it shall produce a log for you at C:\ComboFix.txt Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please. *Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall*
__________________
Eddy |
|
|
|
|
|
12-02-2007, 02:19 PM
|
#5 (permalink) | |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Re: Infected computer - Baidu.dll
Quote:
Thanks. |
|
|
|
|
|
12-03-2007, 03:13 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Re: Infected computer - Baidu.dll
Thanks, here's the latest stage!
ComboFix 07-12-02.7 - User 2007-12-03 21:33:01.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.127 [GMT 0:00] Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\User\Desktop\Combofix\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\bdod.bin C:\WINDOWS\system32\getfile.dat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\bdod.bin C:\WINDOWS\system32\getfile.dat . ((((((((((((((((((((((((( Files Created from 2007-11-03 to 2007-12-03 ))))))))))))))))))))))))))))))) . 2007-12-02 21:12 . 2007-12-02 21:12 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-29 00:13 . 2007-11-29 00:13 <DIR> d-------- C:\Deckard 2007-11-28 23:39 . 2007-11-28 23:39 <DIR> d-------- C:\ie-spyad_zo 2007-11-28 23:34 . 2007-11-28 23:34 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-11-28 23:34 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2007-11-28 20:34 . 2007-11-28 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2007-11-28 20:34 . 2007-11-28 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-11-28 20:33 . 2007-11-28 23:24 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-11-25 19:26 . 2007-12-03 21:37 11,595 --a------ C:\WINDOWS\system32\Config.MPF 2007-11-25 19:25 . 2007-11-25 19:25 <DIR> d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25 . 2007-11-27 20:03 <DIR> d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25 . 2007-11-25 19:25 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25 . 2007-12-03 00:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2007-11-25 19:22 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2007-11-25 19:22 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2007-11-25 19:22 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2007-11-25 19:22 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2007-11-25 19:22 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2007-11-25 19:22 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2007-11-25 19:21 . 2007-11-25 19:21 <DIR> d-------- C:\Program Files\McAfee.com 2007-11-25 19:21 . 2007-12-03 05:56 <DIR> d-------- C:\Program Files\McAfee 2007-11-25 19:21 . 2007-11-25 19:22 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:13 . 2007-11-25 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04 . 2007-11-25 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 18:36 . 2007-03-20 11:26 227 --a------ C:\WINDOWS\sosuo.col 2007-11-24 15:51 . 2007-11-24 15:51 <DIR> d-------- C:\Program Files\Common Files\Synacast 2007-11-18 10:29 . 2007-12-03 21:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-18 10:29 . 2007-11-18 10:29 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 23:08 --------- d-----w C:\Program Files\Napster 2007-11-28 23:02 --------- d-----w C:\Program Files\iTunes 2007-11-28 23:01 --------- d-----w C:\Program Files\Google 2007-11-28 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-11-25 18:49 --------- d-----w C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30 --------- d-----w C:\Program Files\Creative 2007-11-10 19:14 --------- d-----w C:\Program Files\iPod 2007-11-10 19:12 --------- d-----w C:\Program Files\QuickTime 2007-10-31 20:26 26,184 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-28 16:40 --------- d-----w C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10 --------- d-----w C:\Program Files\Finale NotePad 2007 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-12 15:22] "SoundMan"="SOUNDMAN.EXE" [2005-08-17 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-09-13 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [2006-06-29 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [2005-04-06 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-07-22 20:29] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-07-26 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-08-16 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" S2 0120911196661417mcinstcleanup;McAfee Application Installer Cleanup (0120911196661417);C:\WINDOWS\TEMP\012091~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service S2 FILESpy;FILESpy;\??\C:\Program Files\Softwin\BitDefender9\filespy.sys S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys . Contents of the 'Scheduled Tasks' folder "2007-12-03 08:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-11-25 19:21:56 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2007-11-25 19:21:54 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2007-12-03 21:40:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-03 21:39:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-03 21:42:16 - machine was rebooted C:\ComboFix2.txt ... 2007-12-03 21:28 . --- E O F --- Deckard's System Scanner v20071014.68 Run by User on 2007-12-03 22:00:45 Computer is in Normal Mode. -------------------------------------------------------------------------------- Percentage of Memory in Use: 89% (more than 75%). Total Physical Memory: 480 MiB (512 MiB recommended). System Drive C: has 4.82 GiB (less than 15%) free. -- HijackThis (run as User.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:02:18, on 03/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Napster\napster.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\Program Files\Softwin\BitDefender9\bdnagent.exe C:\Program Files\Softwin\BitDefender9\bdswitch.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\WINDOWS\system32\sistray.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\SiteAdvisor\6172\SAService.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\User\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\User.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/ O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O23 - Service: McAfee Application Installer Cleanup (0120911196661417) (0120911196661417mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\012091~1.EXE (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 11873 bytes -- Files created between 2007-11-03 and 2007-12-03 ----------------------------- 2007-12-03 21:45:39 81984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-02 21:12:22 0 d-------- C:\Program Files\Trend Micro 2007-11-28 23:39:35 0 d-------- C:\ie-spyad_zo 2007-11-28 23:34:55 0 d-------- C:\Program Files\SpywareBlaster 2007-11-28 20:33:57 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24:28 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2007-11-25 19:21:36 0 d-------- C:\Program Files\McAfee.com 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:21:07 0 d-------- C:\Program Files\McAfee 2007-11-25 19:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04:37 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 15:51:46 0 d-------- C:\Program Files\Common Files\Synacast -- Find3M Report --------------------------------------------------------------- 2007-11-28 23:08:52 0 d-------- C:\Program Files\Napster 2007-11-28 23:05:49 0 d-------- C:\Program Files\Messenger 2007-11-28 23:02:34 0 d-------- C:\Program Files\iTunes 2007-11-28 23:01:33 0 d-------- C:\Program Files\Google 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files 2007-11-25 18:49:02 0 d-------- C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30:20 0 d-------- C:\Program Files\Creative 2007-11-10 19:14:38 0 d-------- C:\Program Files\iPod 2007-11-10 19:12:44 0 d-------- C:\Program Files\QuickTime 2007-10-31 20:26:17 26184 --a------ C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51:24 0 d-------- C:\Program Files\Windows Media Connect 2 2007-10-28 16:40:37 0 d-------- C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10:42 0 d-------- C:\Program Files\Finale NotePad 2007 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 19/09/2007 06:15 329032 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [31/10/2003 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [12/05/2004 15:22] "SoundMan"="SOUNDMAN.EXE" [17/08/2005 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [13/09/2005 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [29/06/2006 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [11/03/2005 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [09/06/2005 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [06/04/2005 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [12/10/2006 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [15/07/2005 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/11/2007 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [03/08/2007 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [24/08/2007 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [22/07/2007 20:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [08/05/2006 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [21/05/2007 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [26/07/2007 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [16/08/2005 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2007-12-03 22:02:42 ------------ |
|
|
|
|
12-03-2007, 03:26 PM
|
#8 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
That all looks ok but lets finish off with a scan...
Go to http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
__________________
Eddy |
|
|
|
|
12-04-2007, 12:42 PM
|
#9 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Re: Infected computer - Baidu.dll
Hi Pancake, here's the report from the Kaspersky scan...to a layman, it looks as though some of these may have been carried over from my old hard drive - I shoulda done this years ago!!
 ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, December 04, 2007 7:38:59 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 4/12/2007 Kaspersky Anti-Virus database records: 471874 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 241116 Number of viruses found: 28 Number of infected objects: 40 Number of suspicious objects: 0 Duration of the scan process: 02:39:57 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\EasyNet\MHNData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{BBB42069-E903-424D-AC3A-F4416A80539B}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\MSKWMDB.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\settingsdb.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab/asm.exe Infected: not-a-virus:AdWare.Win32.Altnet.m skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab/asmps.dll Infected: not-a-virus:AdWare.Win32.Altnet.u skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab CAB: infected - 2 skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\__unin__.exe Infected: not-a-virus:AdWare.Win32.Altnet.b skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\49OFS18D\ysb_prompt[1].htm Infected: Trojan-Downloader.JS.IstBar.j skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\E3AVY5QV\ysb_prompt[1].htm Infected: Trojan-Downloader.JS.IstBar.j skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\a679af75[1].js Infected: Trojan-Downloader.JS.Agent.nt skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccC[1].dll Infected: not-a-virus:AdWare.Win32.WinAD.ag skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccess[1].exe Infected: not-a-virus:AdWare.Win32.WinAD.af skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccK[1].exe Infected: not-a-virus:AdWare.Win32.WinAD.ai skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\ysb_prompt[1].htm Infected: Exploit.HTML.CodeBaseExec skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\3.bin\F3EZSETP.DLL Infected: not-a-virus:Downloader.Win32.FunWeb skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccC.dll Infected: not-a-virus:AdWare.Win32.WinAD.ag skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccess.exe Infected: not-a-virus:AdWare.Win32.WinAD.af skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccK.exe Infected: not-a-virus:AdWare.Win32.WinAD.ai skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MY2NS.EXE Infected: not-a-virus:AdWare.Win32.MyWay.b skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MYBAR.DLL Infected: not-a-virus:AdWare.Win32.MyWay.m skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL Infected: not-a-virus:AdWare.Win32.MyWay.f skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ah skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\1.bin\MWSSRCAS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086845.dll Infected: not-a-virus:AdWare.Win32.Sahat.l skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086847.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086848.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086849.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086852.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093092.dll Infected: not-a-virus:AdWare.Win32.Sahat.ad skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093094.exe Infected: not-a-virus:AdWare.Win32.Sahat.aa skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093095.exe Infected: not-a-virus:AdWare.Win32.Sahat.f skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093096.exe Infected: not-a-virus:AdWare.Win32.Sahat.f skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\EDow.exe Infected: not-a-virus:AdWare.Win32.Wintol.ab skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\FLEOK\salm.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\salm.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\WINDOWS\Downloaded Program Files\MediaAccX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ah skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\User\Desktop\dss.exe Infected: Trojan-Downloader.Win32.Agent.fpg skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Temp\sqlite_fJzq0sPg3sInk1c Object is locked skipped C:\Documents and Settings\User\Local Settings\Temp\~DF64BE.tmp Object is locked skipped C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped C:\Program Files\Softwin\BitDefender9\asdict.dat Object is locked skipped C:\Program Files\Softwin\BitDefender9\aspdict.dat Object is locked skipped C:\qoobox\Quarantine\C\Documents and Settings\User\Application Data\errorsafenewreleaseinstall[1].exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP731\A0089776.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP732\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_oOuKzrze9DmIuME Object is locked skipped C:\WINDOWS\Temp\mcmsc_6phe7rdDVNcfGkN Object is locked skipped C:\WINDOWS\Temp\mcmsc_O3T9d68Suxrnh0A Object is locked skipped C:\WINDOWS\Temp\mcmsc_S9OKHojnyM3cIs7 Object is locked skipped C:\WINDOWS\Temp\sqlite_h7XVpQcvVgbudyu Object is locked skipped C:\WINDOWS\Temp\sqlite_mvbCYrc8GOWoa1Y Object is locked skipped C:\WINDOWS\Temp\sqlite_O0yS8puKGT7PdbE Object is locked skipped C:\WINDOWS\Temp\tmp00000dfb\tmp00000000 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
12-04-2007, 03:17 PM
|
#10 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
Download and scan with CCleaner
1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free Basic or Slim versions instead of the Standard Build. 2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours" 3. Then select the items you wish to clean up. In the Windows Tab: Clean all entries in the "Internet Explorer" section except Cookies. Clean all the entries in the "Windows Explorer" section. Clean all entries in the "System" section. Clean all entries in the "Advanced" section. Clean any others that you choose. In the Applications Tab: Clean all except cookies in the Firefox/Mozilla section if you use it. Clean all in the Opera section if you use it. Clean Sun Java in the Internet Section. Clean any others that you choose. 4. Click the "Run Cleaner" button. 5. A pop up box will appear advising this process will permanently delete files from your system. 6. Click "OK" and it will scan and clean your system. 7. Click "exit" when done. =========================== Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Open *notepad* and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFScript.txt into ComboFix.exe Restart your computer. When finished, it shall produce a log for you at C:\ComboFix.txt Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please. *Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall* ======================= Please reboot and run another Kaspersky scan and post the log.
__________________
Eddy |
|
|
|
|
|
12-05-2007, 01:49 AM
|
#11 (permalink) |
|
Registered User
Join Date: Nov 2007
Posts: 7
OS: Windows XP Service Pack 2
|
Re: Infected computer - Baidu.dll
Right, I ran Ccleaner, then Combofix, then HijackThis, then Kaspersky. The three logs in that order are below...
ComboFix 07-12-02.7 - User 2007-12-05 0:10:37.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.179 [GMT 0:00] Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\User\Desktop\Combofix\CFScript.txt * Created a new restore point FILE C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\salm.exe C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\WINDOWS\Downloaded Program Files\MediaAccX.dll C:\WINDOWS\Downloaded Program Files\popcaploader.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\3.bin\F3EZSETP.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\003C7461 C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\003C90E2 C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\003C92E5 C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\003C943D C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\003C95B4 C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\Cache\files.ini C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\PopSwatr\History\allowed C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\PopSwatr\History\notallow C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\231677843 C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.htmlx C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\Info.txt C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccC.dll C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccess.exe C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccK.exe C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MY2NS.EXE C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MYBAR.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER.BMP C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER2.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER3.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER4.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER5.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\PARTNER6.DAT C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\UNINSTALL.INF C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\0007689B.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\00076D8C.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\00076E96.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\000B9E6D C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\1004506B.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\100451F2.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\100453C6.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Cache\files.ini C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\History\search C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\Settings\prevcfg.htm C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\UNINSTALL.INF C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\000B9E5D C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046C484.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046C649.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046C82D.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046CC83.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046CDAB.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046CF61.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0046D107.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\03D9BA50.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\03D9BDCA.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\03D9C04B.bmp C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D3266.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D345A.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D366D.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D3B4F.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D3CF5.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D3E4D.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\040D4022.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0EF0D394.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0EF0DF4C.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\0EF0E249.bin C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Cache\files.ini C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\History\search C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\Settings\prevcfg.htm C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\1.bin\MWSSRCAS.DLL C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\1.bin\UNINSTAL.INF C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\Cache\000B9E4D C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\Cache\files.ini C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\salm.exe C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\WINDOWS\Downloaded Program Files\MediaAccX.dll C:\WINDOWS\Downloaded Program Files\popcaploader.dll . ((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 ))))))))))))))))))))))))))))))) . 2007-12-04 23:46 . 2007-12-04 23:47 <DIR> d-------- C:\Program Files\CCleaner 2007-12-04 09:15 . 2007-12-04 23:48 14 --a------ C:\WINDOWS\system32\getfile.dat 2007-12-04 09:13 . 2007-12-04 09:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-12-04 09:13 . 2007-12-04 09:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-03 21:45 . 2007-12-05 00:15 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-02 21:12 . 2007-12-02 21:12 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-29 00:13 . 2007-11-29 00:13 <DIR> d-------- C:\Deckard 2007-11-28 23:39 . 2007-11-28 23:39 <DIR> d-------- C:\ie-spyad_zo 2007-11-28 23:34 . 2007-11-28 23:34 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-11-28 23:34 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2007-11-28 20:34 . 2007-11-28 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2007-11-28 20:34 . 2007-11-28 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-11-28 20:33 . 2007-11-28 23:24 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-11-25 19:26 . 2007-12-05 00:15 11,595 --a------ C:\WINDOWS\system32\Config.MPF 2007-11-25 19:25 . 2007-11-25 19:25 <DIR> d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25 . 2007-11-27 20:03 <DIR> d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25 . 2007-11-25 19:25 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25 . 2007-12-05 00:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2007-11-25 19:22 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2007-11-25 19:22 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2007-11-25 19:22 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2007-11-25 19:22 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2007-11-25 19:22 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2007-11-25 19:22 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2007-11-25 19:21 . 2007-11-25 19:21 <DIR> d-------- C:\Program Files\McAfee.com 2007-11-25 19:21 . 2007-12-04 19:46 <DIR> d-------- C:\Program Files\McAfee 2007-11-25 19:21 . 2007-11-25 19:22 <DIR> d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:13 . 2007-11-25 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04 . 2007-11-25 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 18:36 . 2007-03-20 11:26 227 --a------ C:\WINDOWS\sosuo.col 2007-11-24 15:51 . 2007-11-24 15:51 <DIR> d-------- C:\Program Files\Common Files\Synacast 2007-11-18 10:29 . 2007-12-05 00:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-18 10:29 . 2007-11-18 10:29 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 23:08 --------- d-----w C:\Program Files\Napster 2007-11-28 23:02 --------- d-----w C:\Program Files\iTunes 2007-11-28 23:01 --------- d-----w C:\Program Files\Google 2007-11-28 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-11-25 18:49 --------- d-----w C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30 --------- d-----w C:\Program Files\Creative 2007-11-10 19:14 --------- d-----w C:\Program Files\iPod 2007-11-10 19:12 --------- d-----w C:\Program Files\QuickTime 2007-10-31 20:26 26,184 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-28 16:40 --------- d-----w C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10 --------- d-----w C:\Program Files\Finale NotePad 2007 . ((((((((((((((((((((((((((((( snapshot@2007-12-03_21.26.37.78 ))))))))))))))))))))))))))))))))))))))))) . - 2007-12-03 21:02:31 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-04 23:43:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-12-03 21:02:31 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-12-04 23:43:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-12-04 23:43:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2005-05-24 12:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 15:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 15:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-12 15:22] "SoundMan"="SOUNDMAN.EXE" [2005-08-17 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-09-13 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [2006-06-29 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [2005-04-06 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-07-22 20:29] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-07-26 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2005-08-16 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" S2 FILESpy;FILESpy;\??\C:\Program Files\Softwin\BitDefender9\filespy.sys S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys . Contents of the 'Scheduled Tasks' folder "2007-12-03 08:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-11-25 19:21:56 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2007-11-25 19:21:54 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2007-12-05 00:15:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-05 00:17:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-05 0:21:09 - machine was rebooted C:\ComboFix2.txt ... 2007-12-03 21:42 C:\ComboFix3.txt ... 2007-12-03 21:28 . --- E O F --- Deckard's System Scanner v20071014.68 Run by User on 2007-12-05 00:22:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- Percentage of Memory in Use: 81% (more than 75%). Total Physical Memory: 480 MiB (512 MiB recommended). System Drive C: has 4.85 GiB (less than 15%) free. -- HijackThis (run as User.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:23:34, on 05/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Napster\napster.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\Program Files\Softwin\BitDefender9\bdnagent.exe C:\Program Files\Softwin\BitDefender9\bdswitch.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\WINDOWS\system32\sistray.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\SiteAdvisor\6172\SAService.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\User\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\User.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/ O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 11792 bytes -- Files created between 2007-11-05 and 2007-12-05 ----------------------------- 2007-12-04 23:53:13 0 dr-h----- C:\Documents and Settings\User\Recent 2007-12-04 23:46:54 0 d-------- C:\Program Files\CCleaner 2007-12-04 09:15:56 14 --a------ C:\WINDOWS\system32\getfile.dat 2007-12-04 09:13:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-04 09:13:26 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-12-03 21:45:39 81984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-02 21:12:22 0 d-------- C:\Program Files\Trend Micro 2007-11-28 23:39:35 0 d-------- C:\ie-spyad_zo 2007-11-28 23:34:55 0 d-------- C:\Program Files\SpywareBlaster 2007-11-28 20:33:57 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-11-25 19:25:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Program Files\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\User\Application Data\SiteAdvisor 2007-11-25 19:25:35 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2007-11-25 19:24:28 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2007-11-25 19:21:36 0 d-------- C:\Program Files\McAfee.com 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files\McAfee 2007-11-25 19:21:07 0 d-------- C:\Program Files\McAfee 2007-11-25 19:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-11-25 19:04:37 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2007-11-24 15:51:46 0 d-------- C:\Program Files\Common Files\Synacast -- Find3M Report --------------------------------------------------------------- 2007-11-28 23:08:52 0 d-------- C:\Program Files\Napster 2007-11-28 23:05:49 0 d-------- C:\Program Files\Messenger 2007-11-28 23:02:34 0 d-------- C:\Program Files\iTunes 2007-11-28 23:01:33 0 d-------- C:\Program Files\Google 2007-11-25 19:21:24 0 d-------- C:\Program Files\Common Files 2007-11-25 18:49:02 0 d-------- C:\Documents and Settings\User\Application Data\ppstream 2007-11-25 17:30:20 0 d-------- C:\Program Files\Creative 2007-11-10 19:14:38 0 d-------- C:\Program Files\iPod 2007-11-10 19:12:44 0 d-------- C:\Program Files\QuickTime 2007-10-31 20:26:17 26184 --a------ C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 16:51:24 0 d-------- C:\Program Files\Windows Media Connect 2 2007-10-28 16:40:37 0 d-------- C:\Documents and Settings\User\Application Data\TVU Networks 2007-10-20 13:10:42 0 d-------- C:\Program Files\Finale NotePad 2007 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 19/09/2007 06:15 329032 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 10:50] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [31/10/2003 18:42] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [12/05/2004 15:22] "SoundMan"="SOUNDMAN.EXE" [17/08/2005 17:39 C:\WINDOWS\soundman.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [13/09/2005 18:58] "NapsterShell"="C:\Program Files\Napster\napster.exe" [29/06/2006 13:17] "BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [11/03/2005 17:53] "BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [09/06/2005 10:28] "BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [06/04/2005 13:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [12/10/2006 03:10] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [15/07/2005 21:48] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/11/2007 18:36] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [03/08/2007 22:33] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [24/08/2007 21:57] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [22/07/2007 20:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13/10/2004 16:24] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [08/05/2006 04:17] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [21/05/2007 16:47] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [26/07/2007 13:28:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 00:01:04] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [16/08/2005 13:22:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=sockspy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2007-12-05 00:23:56 ------------ ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Wednesday, December 05, 2007 8:47:07 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 5/12/2007 Kaspersky Anti-Virus database records: 472690 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 239470 Number of viruses found: 27 Number of infected objects: 52 Number of suspicious objects: 0 Duration of the scan process: 03:46:09 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\EasyNet\MHNData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{BBB42069-E903-424D-AC3A-F4416A80539B}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\MSKWMDB.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\settingsdb.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab/asm.exe Infected: not-a-virus:AdWare.Win32.Altnet.m skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab/asmps.dll Infected: not-a-virus:AdWare.Win32.Altnet.u skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\asmfiles.cab CAB: infected - 2 skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temp\__unin__.exe Infected: not-a-virus:AdWare.Win32.Altnet.b skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\49OFS18D\ysb_prompt[1].htm Infected: Trojan-Downloader.JS.IstBar.j skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\E3AVY5QV\ysb_prompt[1].htm Infected: Trojan-Downloader.JS.IstBar.j skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\a679af75[1].js Infected: Trojan-Downloader.JS.Agent.nt skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccC[1].dll Infected: not-a-virus:AdWare.Win32.WinAD.ag skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccess[1].exe Infected: not-a-virus:AdWare.Win32.WinAD.af skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\MediaAccK[1].exe Infected: not-a-virus:AdWare.Win32.WinAD.ai skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Documents and Settings\Claire Strong\Local Settings\Temporary Internet Files\Content.IE5\WHGF4ZGR\ysb_prompt[1].htm Infected: Exploit.HTML.CodeBaseExec skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086845.dll Infected: not-a-virus:AdWare.Win32.Sahat.l skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086847.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086848.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086849.exe Infected: not-a-virus:AdWare.Win32.Sahat.o skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP437\A0086852.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093092.dll Infected: not-a-virus:AdWare.Win32.Sahat.ad skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093094.exe Infected: not-a-virus:AdWare.Win32.Sahat.aa skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093095.exe Infected: not-a-virus:AdWare.Win32.Sahat.f skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\System Volume Information\_restore{1B3BD5E1-FD53-4AE5-BE34-B5CD3B722BE0}\RP453\A0093096.exe Infected: not-a-virus:AdWare.Win32.Sahat.f skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\EDow.exe Infected: not-a-virus:AdWare.Win32.Wintol.ab skipped C:\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\FLEOK\salm.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Temp\sqlite_aoZJEHvKFJeNb7V Object is locked skipped C:\Documents and Settings\User\Local Settings\Temp\~DFC935.tmp Object is locked skipped C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped C:\Program Files\Softwin\BitDefender9\asdict.dat Object is locked skipped C:\Program Files\Softwin\BitDefender9\aspdict.dat Object is locked skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\FunWebProducts\Installr\3.bin\F3EZSETP.DLL.vir Infected: not-a-virus:Downloader.Win32.FunWeb skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccC.dll.vir Infected: not-a-virus:AdWare.Win32.WinAD.ag skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccess.exe.vir Infected: not-a-virus:AdWare.Win32.WinAD.af skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\Media Access\MediaAccK.exe.vir Infected: not-a-virus:AdWare.Win32.WinAD.ai skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MY2NS.EXE.vir Infected: not-a-virus:AdWare.Win32.MyWay.b skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\MYBAR.DLL.vir Infected: not-a-virus:AdWare.Win32.MyWay.m skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL.vir Infected: not-a-virus:AdWare.Win32.MyWay.f skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.ah skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\Program Files\MyWebSearch\SearchAt\1.bin\MWSSRCAS.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\temp\salm.exe.vir Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\qoobox\Quarantine\C\Documents and Settings\All Users\Desktop\Erica\[NTFS]\WINDOWS\Downloaded Program Files\MediaAccX.dll.vir Infected: not-a-virus:AdWare.Win32.WinAD.ah skipped C:\qoobox\Quarantine\C\Documents and Settings\User\Application Data\errorsafenewreleaseinstall[1].exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\popcaploader.dll.vir Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP731\A0089776.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091587.DLL Infected: not-a-virus:Downloader.Win32.FunWeb skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091589.dll Infected: not-a-virus:AdWare.Win32.WinAD.ag skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091590.exe Infected: not-a-virus:AdWare.Win32.WinAD.af skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091591.exe Infected: not-a-virus:AdWare.Win32.WinAD.ai skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091592.EXE Infected: not-a-virus:AdWare.Win32.MyWay.b skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091593.DLL Infected: not-a-virus:AdWare.Win32.MyWay.m skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091594.DLL Infected: not-a-virus:AdWare.Win32.MyWay.f skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091599.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ah skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091600.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091601.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091604.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091607.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\A0091608.dll Infected: not-a-virus:AdWare.Win32.WinAD.ah skipped C:\System Volume Information\_restore{86492929-996E-4364-AFA3-57917E8D23CE}\RP734\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{DBD744A7-3B73-4E7F-BE3C-A2E4478A31F6}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_mGiCCbUhn8JaErU Object is locked skipped C:\WINDOWS\Temp\mcmsc_9penPGbEjOEOcVq Object is locked skipped C:\WINDOWS\Temp\mcmsc_L1BdnmjJqfCsaht Object is locked skipped C:\WINDOWS\Temp\sqlite_Fo18EBQTI6jUwup Object is locked skipped C:\WINDOWS\Temp\sqlite_Z2Xjri9cltM7yEr Object is locked skipped C:\WINDOWS\Temp\tmp000047a7\tmp00000000 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
12-05-2007, 03:08 AM
|
#12 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
Ok.This should be the last and then its finished...
This will clear away any of the files and folders that were created by ComboFix. Go to : Start > Run then copy and paste the following highlighted text below and click OK. Quote:
Download and scan with CCleaner 1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free Basic or Slim versions instead of the Standard Build. 2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours" 3. Then select the items you wish to clean up. In the Windows Tab: Clean all entries in the "Internet Explorer" section except Cookies. Clean all the entries in the "Windows Explorer" section. Clean all entries in the "System" section. Clean all entries in the "Advanced" section. Clean any others that you choose. In the Applications Tab: Clean all except cookies in the Firefox/Mozilla section if you use it. Clean all in the Opera section if you use it. Clean Sun Java in the Internet Section. Clean any others that you choose. 4. Click the "Run Cleaner" button. 5. A pop up box will appear advising this process will permanently delete files from your system. 6. Click "OK" and it will scan and clean your system. 7. Click "exit" when done.
__________________
Eddy |
|
|
|
|
|
12-05-2007, 04:12 PM
|
#14 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Infected computer - Baidu.dll
Yes all done....
Now that you are clean,and If you wish to do so, here are a few things that you can do that will help keep your computer a bit more clean and secure..they can be done at your leisure. ========================================= Is your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version if required. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6u3 (http://java.sun.com/javase/downloads/index.jsp). Scroll down to where it says The J2SE Runtime Environment (JRE) allows end-users to run Java applications. Click the Download button to the right. Check the box that says: Accept License Agreement. The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version. UPDATING WINDOWS AND INTERNET EXPLORER IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates. If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update. Make your Internet Explorer more secure This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. ======================================================== The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item. Download SpywareBlaster Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes kill bits in the registry, so that certain activex controls can't install. If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html) You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.ph...7615f4682b4cef) SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html) Download iespyad It puts many bad webpages on your restricted zones list. This means that you can still view the bad webpages, but the webpages cannot do certain things (such as use javascripts and cookies). Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe) Hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!! Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html) If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps: Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok Keep Anti Virus Software updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. See here (http://www.snapfiles.com/Freeware/security/fwvirus.html) to choose one. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this (http://www.bleepingcomputer.com/forums/tutorial60.html) webpage out. Here (http://www.snapfiles.com/Freeware/se...wfirewall.html) are some Vista compatible firewalls also. Know What You're Installing Check the source. To avoid malware, make sure your software comes from a reputable source. Be particularly suspicious of sponsored software (software that relies on advertising) or software that claims to speed up your Internet connection. Use Custom Install. If you feel comfortable with software installation, you can choose Custom Install (as opposed to Typical Install). Custom Install allows you to select only the software components you wish to install, and leave out others (such as potential spyware). Modify Security Settings (Internet Explorer 6) To reduce the risk of installing malware, you can set Internet Explorer to high security mode. To do so: Open Internet Explorer. Go to Tools > Internet Options…. On the Internet Options screen, select the Security tab, then select the Internet icon (if it is not already selected). Under Security level for this zone, click Default Level. Set the slider to High. Note: You may have to lower the security level to view certain Web sites. Next, select the Trusted Sites icon. Under Security level for this zone, click Default Level. Set the slider to Medium. Click Apply, then OK to save the changes. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List. It will save you a lot of grief, as well as money if you are thinking of purchasing. Here is the link: http://www.spywarewarrior.com/rogue_anti-spyware.htm If you want to know just how effective your anti-spyware program is, or how well any of the "rogue" programs listed at the above link work, check this for an independent comparison of several anti-spyware programs: http://www.spywarewarrior.com/asw-test-guide.htm Let us know if we have not resolved your problem. Otherwise, you are good to go. Happy and Safe Surfing!
__________________
Eddy |
|
|
|
| Thread Tools | |
|
|
