Plz Plz Help Me

erica316 · 12-28-2007, 10:01 PM

I also have malware crush problem and follow exactly ur advise in ur post but i cant get any log after i scanned with dss.there is nothing happend after the scanned is complete.wat should i do

tetonbob · 12-28-2007, 10:10 PM

Please explain.

Did DSS stop running? Did it give an error message?

Let's try again...delete your existing copy, and follow these steps exactly.

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Note:

DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts

If the following message from DSS appears, please click on "Yes" to allow it to download HijackThis, if you don't already have it.

Allow DSS through your firewall to download HijackThis by clicking "OK"

DSS has installed HijackThis, and placed a shortcut on your desktop. Click "OK" to allow the scan to continue.

.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.
Please attach extra.txt to your post.

To attach a file to a new post, simply

Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
copy and paste the following into the "Upload File from your Computer" box:
C:\Deckard\System Scanner\extra.txt
Click Upload.

What DSS will do:

create a new System Restore point in Windows XP and Vista.
clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

erica316 · 12-28-2007, 10:25 PM

i do exactly as u ask but the text still wont appear

erica316 · 12-28-2007, 10:26 PM

do i have to disabled my windows firewall??

tetonbob · 12-28-2007, 10:37 PM

Is your antivirus having a script blocker, or perhaps your firewall? Those will disallow DSS from creating it's logs.

erica316 · 12-28-2007, 10:48 PM

how am i suppose to disabled that

tetonbob · 12-28-2007, 10:51 PM

Well, since I know nothing about your system right now, due to a lack of logs, I can't tell you exactly.

Try this instead

Please download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

---------------------------------------------------------------------------------------------

erica316 · 12-28-2007, 11:16 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:55 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wupeng.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5607 bytes

tetonbob · 12-28-2007, 11:21 PM

Please bear with me.

Quote:

O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe"

System Mechanic is the likely culprit interfering with DSS logs.

Disable it. There should be a way to disable it via the system tray icon (right click and choose Exit, or Quit or similar), then run DSS again.

If it still fails, don't fret.

erica316 · 12-29-2007, 12:01 AM

It still fail..it stop at examining event log.I have another question..Is there any way to remove malware crush without using dss?Thz for ur every help..

tetonbob · 12-29-2007, 12:05 AM

Quote:

It still fail..it stop at examining event log.

This is the critical information I was asking you for in PM and earlier in this thread. We can now get it to run.

Quote:

Did DSS stop running? Did it give an error message?

--------------------

Yes, we only use DSS to examine the machine, but it's very thorough.

Please run Deckard's System Scanner once again, this time using these instructions(this assumes dss.exe is on your desktop!)

Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK

"%userprofile%\desktop\dss.exe" /config

On the Right side, under Extra Log,

Uncheck Event Logs

Click Scan!

When finished, it shall produce a log for you. Post that log in your next reply.

erica316 · 12-29-2007, 12:23 AM

Deckard's System Scanner v20071014.68
Run by Nor Azimah on 2007-12-29 15:17:27
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

-- Last 5 Restore Point(s) --
6: 2007-12-29 03

22 UTC - RP6 - Deckard's System Scanner Restore Point
5: 2007-12-28 17:50:36 UTC - RP5 - Installed Pro Evolution Soccer 6
4: 2007-12-28 14:22:21 UTC - RP4 - Deckard's System Scanner Restore Point
3: 2007-12-28 14:07:44 UTC - RP3 - Removed Google Toolbar for Internet Explorer
2: 2007-12-28 13:40:30 UTC - RP2 - Deckard's System Scanner Restore Point

-- First Restore Point --
1: 2007-12-28 13:32:22 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 384 MiB (512 MiB recommended).

-- HijackThis (run as Nor Azimah.exe) ------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:18:08 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wupeng.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Nor Azimah\desktop\dss.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Nor Azimah.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5544 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - shell\open\command - NOTEPAD.EXE %1
.reg - regfile - shell\open\command - NOTEPAD.EXE %1
.scr - scrfile - shell\open\command - NOTEPAD.EXE %1
.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 StyleXPHelper - c:\program files\tgtsoft\stylexp\stylexphelper.exe <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 StyleXPService - "c:\program files\tgtsoft\stylexp\stylexpservice.exe" <Not Verified; ; StyleXPService Module>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\WEC0515\4&12F3D326&0
Manufacturer:
Name:
PNP Device ID: ACPI\WEC0515\4&12F3D326&0
Service:

-- Files created between 2007-11-29 and 2007-12-29 -----------------------------

2007-12-29 15:18:01 0 d-------- C:\Program Files\Trend Micro
2007-12-28 23:18:15 8576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys <Not Verified; Panda Software International; RKPavProc Driver>
2007-12-28 12:22:12 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-12-28 12:21:42 0 d-------- C:\Program Files\Webroot
2007-12-28 12:21:42 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\Webroot
2007-12-28 12:21:42 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-12-28 05:19:16 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\Google
2007-12-28 05:13:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
2007-12-28 05:13:13 0 d-------- C:\Program Files\Google
2007-12-28 04:28:23 0 dr-h----- C:\$VAULT$.AVG
2007-12-28 04:08:47 12288 --a------ C:\WINDOWS\system32\wupeng.exe
2007-12-28 02:45:29 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\DivX
2007-12-27 22:39:28 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\AVG7
2007-12-27 22:39:10 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-27 22:38:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-27 22:00:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-27 18:57:07 0 d-------- C:\Documents and Settings\Nor Azimah\LimeWire Store Purchased
2007-12-27 14:07:22 0 d-------- C:\Program Files\DivX
2007-12-27 13:49:49 1622016 --a------ C:\WINDOWS\system32\rlvknlg.exe <Not Verified; RelevantKnowledge; RelevantKnowledge>
2007-12-27 12:38:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-27 12:32:56 0 d-------- C:\Documents and Settings\Nor Azimah\LimeWire Shared
2007-12-27 12:32:56 0 d-------- C:\Documents and Settings\Nor Azimah\LimeWire Saved
2007-12-27 12:32:35 0 d-------- C:\Documents and Settings\Nor Azimah\Incomplete
2007-12-27 12:32:24 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\LimeWire
2007-12-27 12:30:41 0 d-------- C:\Program Files\Java
2007-12-27 12:27:17 0 d-------- C:\Program Files\Common Files\Java
2007-12-27 12:26:40 0 d-------- C:\Program Files\LimeWire
2007-12-27 02:18:38 0 d--hs---- C:\WINDOWS\Installer
2007-12-27 02:18:37 0 d-------- C:\Program Files\Common Files\ODBC
2007-12-27 02:18:34 0 dr------- C:\Program Files
2007-12-27 02:18:34 0 d-------- C:\Program Files\Common Files
2007-12-27 02:18:34 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-12-27 02:18:03 0 d--h----- C:\Documents and Settings\Default User\Templates
2007-12-27 02:18:03 0 dr------- C:\Documents and Settings\Default User\Start Menu
2007-12-27 02:18:03 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2007-12-27 02:18:03 0 d--h----- C:\Documents and Settings\Default User\Recent
2007-12-27 02:18:03 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2007-12-27 02:18:03 0 d--h----- C:\Documents and Settings\Default User\NetHood
2007-12-27 02:18:03 0 d-------- C:\Documents and Settings\Default User\My Documents
2007-12-27 02:18:03 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2007-12-27 02:18:03 0 d-------- C:\Documents and Settings\Default User\Favorites
2007-12-27 02:18:03 0 d-------- C:\Documents and Settings\Default User\Desktop
2007-12-27 02:18:03 0 d---s---- C:\Documents and Settings\Default User\Cookies
2007-12-27 02:18:03 0 d--h----- C:\Documents and Settings\All Users\Templates
2007-12-27 02:18:03 0 dr------- C:\Documents and Settings\All Users\Start Menu
2007-12-27 02:18:03 0 d-------- C:\Documents and Settings\All Users\Favorites
2007-12-27 02:18:03 0 dr------- C:\Documents and Settings\All Users\Documents
2007-12-27 02:18:03 0 d-------- C:\Documents and Settings\All Users\Desktop
2007-12-27 02:16:16 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-12-27 02:16:16 0 d-------- C:\WINDOWS\system32\CatRoot
2007-12-27 02:16:10 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2007-12-27 02:16:10 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2007-12-27 02:16:10 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2007-12-27 02:16:10 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2007-12-27 02:15:46 0 d-------- C:\Documents and Settings
2007-12-27 02:15:45 0 d--hs---- C:\System Volume Information
2007-12-27 02:07:56 0 d-------- C:\WINDOWS
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\WinSxS
2007-12-27 02:07:56 0 dr------- C:\WINDOWS\Web
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\twain_32
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\wins
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\wbem
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\usmt
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\spool
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\ShellExt
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\Setup
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\ras
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\oobe
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\npp
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\mui
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\inetsrv
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\IME
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\icsxml
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\ias
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\export
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\drivers
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-12-27 02:07:56 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\dhcp
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\config
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\3076
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\2052
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1054
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1042
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1041
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1037
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1033
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1031
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1028
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system32\1025
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\system
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\security
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Resources
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\repair
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Provisioning
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\PeerNet
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\pchealth
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\mui
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\msapps
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\msagent
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Media
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\java
2007-12-27 02:07:56 0 d--h----- C:\WINDOWS\inf
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\ime
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Help
2007-12-27 02:07:56 0 dr--s---- C:\WINDOWS\Fonts
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\ehome
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Driver Cache
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Debug
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Cursors
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Connection Wizard
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\Config
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\AppPatch
2007-12-27 02:07:56 0 d-------- C:\WINDOWS\addins
2007-12-27 01:53:35 0 d-------- C:\Documents and Settings\Nor Azimah\Contacts
2007-12-27 01:52:51 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-12-27 01:41:11 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-27 01:41:00 0 d-------- C:\Program Files\Windows Live
2007-12-27 01:40:55 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-27 01:36:52 0 d-------- C:\WINDOWS\system32\appmgmt
2007-12-27 01:08:21 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\Macromedia
2007-12-26 20:21:27 0 d-------- C:\WINDOWS\network diagnostic
2007-12-26 20:20:27 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-26 20:09:07 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2007-12-26 20:08:33 0 d-------- C:\Program Files\ATI Technologies
2007-12-26 20:08:27 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-26 20:07:51 0 d-------- C:\Program Files\Common Files\InstallShield
2007-12-26 19:46:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-12-26 19:27:42 0 d-------- C:\WINDOWS\system32\PreInstall
2007-12-26 19:27:41 0 d--h----- C:\WINDOWS\$hf_mig$
2007-12-26 19:23:07 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-12-26 19:22:13 176235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-12-26 19:21:58 0 d-------- C:\WINDOWS\PrimoPDF
2007-12-26 19:17:05 0 d--hs---- C:\Documents and Settings\Nor Azimah\UserData
2007-12-26 19:11:46 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\Adobe
2007-12-26 19:09:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-12-26 19:09:51 0 d-------- C:\Program Files\Common Files\Adobe
2007-12-26 18:58:17 0 d-------- C:\Documents and Settings\LocalService\Application Data\iolo
2007-12-26 18:58:08 25264 --a------ C:\WINDOWS\system32\smrgdf.exe
2007-12-26 18:58:08 41472 --a------ C:\WINDOWS\system32\iolobtdfg.exe
2007-12-26 18:58:00 0 d-------- C:\Program Files\iolo
2007-12-26 18:53:49 74703 --a------ C:\WINDOWS\system32\mfc45.dll
2007-12-26 18:53:29 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\iolo
2007-12-26 18:53:29 0 d-------- C:\Documents and Settings\All Users\Application Data\iolo
2007-12-26 18:47:30 0 d-------- C:\Program Files\TGTSoft
2007-12-26 18:37:33 0 d-------- C:\Documents and Settings\Nor Azimah\Application Data\Identities
2007-12-26 18:37:18 0 d--h----- C:\Documents and Settings\Nor Azimah\Templates
2007-12-26 18:37:18 0 dr------- C:\Documents and Settings\Nor Azimah\Start Menu
2007-12-26 18:37:18 0 dr-h----- C:\Documents and Settings\Nor Azimah\SendTo
2007-12-26 18:37:18 0 dr-h----- C:\Documents and Settings\Nor Azimah\Recent
2007-12-26 18:37:18 0 d--h----- C:\Documents and Settings\Nor Azimah\PrintHood
2007-12-26 18:37:18 2097152 --ah----- C:\Documents and Settings\Nor Azimah\NTUSER.DAT
2007-12-26 18:37:18 0 d--h----- C:\Documents and Settings\Nor Azimah\NetHood
2007-12-26 18:37:18 0 dr------- C:\Documents and Settings\Nor Azimah\My Documents
2007-12-26 18:37:18 0 d--h----- C:\Documents and Settings\Nor Azimah\Local Settings
2007-12-26 18:37:18 0 dr------- C:\Documents and Settings\Nor Azimah\Favorites
2007-12-26 18:37:18 0 d-------- C:\Documents and Settings\Nor Azimah\Desktop
2007-12-26 18:37:18 0 d--hs---- C:\Documents and Settings\Nor Azimah\Cookies
2007-12-26 18:37:18 0 d--h----- C:\Documents and Settings\Nor Azimah\Application Data
2007-12-26 18:36:11 0 d-------- C:\WINDOWS\SoftwareDistribution
2007-12-26 18:36:02 0 d---s---- C:\WINDOWS\system32\Microsoft
2007-12-26 18:36:02 0 d-------- C:\WINDOWS\Prefetch
2007-12-26 18:36:01 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2007-12-26 18:36:01 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2007-12-26 18:36:01 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
2007-12-26 18:36:01 0 d-------- C:\Documents and Settings\LocalService\Application Data
2007-12-26 18:36:01 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2007-12-26 18:35:42 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2007-12-26 18:35:42 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies
2007-12-26 18:35:42 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2007-12-26 18:35:42 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2007-12-26 18:35:41 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2007-12-26 18:31:25 0 d-------- C:\WINDOWS\system32\xircom
2007-12-26 18:31:25 0 d-------- C:\Program Files\microsoft frontpage
2007-12-26 18:31:07 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2007-12-26 18:30:56 0 -rahs---- C:\MSDOS.SYS
2007-12-26 18:30:56 0 -rahs---- C:\IO.SYS
2007-12-26 18:30:56 0 --a------ C:\CONFIG.SYS
2007-12-26 18:30:56 0 --a------ C:\AUTOEXEC.BAT
2007-12-26 18:29:18 0 d--hs---- C:\Documents and Settings\All Users\DRM
2007-12-26 18:29:04 0 dr------- C:\WINDOWS\Offline Web Pages
2007-12-26 18:29:04 0 d---s---- C:\WINDOWS\Downloaded Program Files
2007-12-26 18:28:49 0 d--h----- C:\Program Files\WindowsUpdate
2007-12-26 18:28:29 0 d-------- C:\WINDOWS\system32\DirectX
2007-12-26 18:28:00 0 d---s---- C:\WINDOWS\Tasks
2007-12-26 18:27:59 0 d-------- C:\Program Files\Common Files\MSSoap
2007-12-26 18:27:56 0 d-------- C:\WINDOWS\system32\Macromed
2007-12-26 18:27:56 0 d-------- C:\WINDOWS\srchasst
2007-12-26 18:27:49 0 d-------- C:\Program Files\Movie Maker
2007-12-26 18:27:42 0 d-------- C:\WINDOWS\system32\Restore
2007-12-26 18:26:49 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-12-26 18:26:32 0 d-------- C:\WINDOWS\Registration
2007-12-26 18:26:27 0 d-------- C:\Program Files\Online Services
2007-12-26 18:26:21 0 d-------- C:\Program Files\Messenger
2007-12-26 18:26:18 0 d-------- C:\Program Files\MSN Gaming Zone
2007-12-26 18:25:43 0 d-------- C:\Program Files\Windows NT
2007-12-26 18:25:41 0 d-------- C:\WINDOWS\system32\MsDtc
2007-12-26 18:25:39 0 d-------- C:\WINDOWS\system32\Com
2007-12-04 09:33:18 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2007-12-04 09:33:18 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-04 09:33:18 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2007-12-04 09:33:16 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2007-11-30 06:30:28 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-11-30 06:28:24 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2007-11-30 06:28:24 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2007-11-29 05:52:32 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll

-- Find3M Report ---------------------------------------------------------------

2007-12-27 02:18:03 62 --ahs---- C:\Documents and Settings\Nor Azimah\Application Data\desktop.ini

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [10/03/2007 09:05 AM]
"SystemGuardAlerter"="D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" [10/03/2007 09:05 AM]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 12:35 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/27/2007 10:38 PM]
"Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [12/28/2007 04:15 AM]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [12/10/2007 08:08 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [05/25/2006 02:31 AM]
"System Mechanic Popup Blocker"="D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" [10/03/2007 09:05 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 PM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8de7b6da-b39e-11dc-b565-0000e267c523}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
Explore\command- Flash.10.Setup.exe
Open\command- Flash.10.Setup.exe
Scan for Viruses\command- Scanner.exe

-- End of Deckard's System Scanner: finished at 2007-12-29 15:20:50 ------------

tetonbob · 12-29-2007, 12:30 AM

Good job.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe

* IMPORTANT !!! Place combofix.exe on your Desktop
Disconnect from the internet....pull the plug!
Insert your pen drive
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
Go to -> Run -> paste in the following single line command & click OK

"%userprofile%\desktop\combofix.exe" /killall
Follow the prompts. Type "1" and press Enter to begin the scan.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
Re-establish an internet connection.
Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

erica316 · 12-29-2007, 12:57 AM

ComboFix 07-12-29.5 - Nor Azimah 2007-12-29 15:44:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.158 [GMT 8:00]
Running from: C:\Documents and Settings\Nor Azimah\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point
.
The following files were disabled during the run:
C:\Program Files\iolo\Common\Lib\sguard.dll

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000110_.tmp.dll
C:\WINDOWS\system32\rlvknlg.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 15:18 . 2007-12-29 15:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-29 15:17 . 2007-12-29 15:17 <DIR> d-------- C:\Deckard
2007-12-28 23:18 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys
2007-12-28 23:01 . 2007-12-28 23:01 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-28 23:01 . 2007-12-28 23:01 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-28 12:22 . 2007-12-28 12:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-12-28 12:22 . 2007-12-10 19:47 163,640 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2007-12-28 12:22 . 2007-12-10 19:47 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2007-12-28 12:22 . 2007-12-10 19:47 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2007-12-28 12:22 . 2007-12-10 19:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Program Files\Webroot
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\Webroot
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-12-28 12:21 . 2007-12-10 20:08 1,526,584 --a------ C:\WINDOWS\WRSetup.dll
2007-12-28 05:13 . 2007-12-28 23:35 <DIR> d-------- C:\Program Files\Google
2007-12-28 04:08 . 2007-12-28 04:15 12,288 --a------ C:\WINDOWS\system32\wupeng.exe
2007-12-28 02:45 . 2007-12-28 03:17 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\DivX
2007-12-27 22:40 . 2004-08-04 20:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-27 22:39 . 2007-12-29 04:05 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\AVG7
2007-12-27 22:39 . 2007-12-27 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-27 22:38 . 2007-12-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-27 22:00 . 2007-12-28 04:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-27 18:57 . 2007-12-27 18:57 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Store Purchased
2007-12-27 18:31 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-12-27 18:31 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-12-27 18:31 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-12-27 14:09 . 2003-04-23 18:57 592,017 --a------ C:\WINDOWS\BestWallpaperS.net.tc Series 1.jpg
2007-12-27 14:07 . 2007-12-27 14:07 <DIR> d-------- C:\Program Files\DivX
2007-12-27 12:38 . 2007-12-27 12:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-27 12:32 . 2007-12-27 12:32 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Shared
2007-12-27 12:32 . 2007-12-28 12:26 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Saved
2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Incomplete
2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\LimeWire
2007-12-27 12:31 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-27 12:30 . 2007-12-27 12:31 <DIR> d-------- C:\Program Files\Java
2007-12-27 12:27 . 2007-12-27 12:27 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-27 12:26 . 2007-12-27 12:32 <DIR> d-------- C:\Program Files\LimeWire
2007-12-27 01:53 . 2007-12-29 04:09 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Contacts
2007-12-27 01:52 . 2007-12-27 01:52 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-27 01:41 . 2007-12-27 02:23 <DIR> d-------- C:\Program Files\Windows Live
2007-12-27 01:41 . 2007-12-27 01:51 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-27 01:40 . 2007-12-27 01:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-26 21:57 . 2007-12-26 21:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-12-26 21:57 . 2007-12-26 21:57 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-12-26 20:20 . 2007-12-26 20:20 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-26 20:09 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-12-26 20:08 . 2007-12-26 20:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-26 20:08 . 2007-12-26 20:11 <DIR> d-------- C:\Program Files\ATI Technologies
2007-12-26 20:07 . 2007-12-26 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-12-26 19:27 . 2007-12-27 02:39 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-26 19:27 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-26 19:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-26 19:23 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-26 19:23 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 19:22 . 2006-12-12 05:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-12-26 19:21 . 2007-12-26 19:21 <DIR> d-------- C:\WINDOWS\PrimoPDF
2007-12-26 19:17 . 2007-12-26 19:17 <DIR> d--hs---- C:\Documents and Settings\Nor Azimah\UserData
2007-12-26 19:09 . 2007-12-26 19:10 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a--c--- C:\WINDOWS\system32\dllcache\ati2mtag.sys
2007-12-05 11:05 . 2007-12-05 11:05 368,640 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a--c--- C:\WINDOWS\system32\dllcache\ati2dvag.dll
2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 10:56 . 2007-12-05 10:56 147,456 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 43,520 --a------ C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 10:54 . 2007-12-05 10:54 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 10:53 . 2007-12-05 10:53 495,616 --a------ C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 10:53 . 2007-12-05 10:53 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 10:48 . 2007-12-05 10:48 9,535,488 --a------ C:\WINDOWS\system32\atioglx2.dll
2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat
2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a--c--- C:\WINDOWS\system32\dllcache\ativvaxx.dll
2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 10:33 . 2007-12-05 10:33 887,724 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-12-05 10:19 . 2007-12-05 10:19 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-12-05 10:19 . 2007-12-05 10:19 385,024 --a------ C:\WINDOWS\system32\atikvmag.dll
2007-12-05 10:17 . 2007-12-05 10:17 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-12-05 10:16 . 2007-12-05 10:16 49,152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 10:14 . 2007-12-05 10:14 180,224 --a------ C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a--c--- C:\WINDOWS\system32\dllcache\ati2cqag.dll
2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 09:33 . 2007-12-04 09:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 09:33 . 2007-12-04 09:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2007-12-04 09:33 . 2007-12-04 09:33 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2007-11-30 06:30 . 2007-11-30 06:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-11-30 06:30 . 2007-11-30 06:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-11-30 06:30 . 2007-11-30 06:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-11-30 06:30 . 2007-11-30 06:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-11-30 06:30 . 2007-11-30 06:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-11-30 06:28 . 2007-11-30 06:28 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-11-30 06:28 . 2007-11-30 06:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 06:04 --------- d-----w C:\Documents and Settings\Nor Azimah\Application Data\iolo
2007-12-26 11:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo
2007-12-26 10:58 --------- d-----w C:\Program Files\iolo
2007-12-26 10:58 --------- d-----w C:\Documents and Settings\LocalService\Application Data\iolo
2007-12-26 10:47 --------- d-----w C:\Program Files\TGTSoft
2007-12-26 10:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-29 22:30 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-29 22:30 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-11-29 22:30 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-25 02:31]
"System Mechanic Popup Blocker"="D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" [2007-10-03 09:05]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 09:05]
"SystemGuardAlerter"="D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" [2007-10-03 09:05]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-27 22:38]
"Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [2007-12-28 04:15]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-12-10 20:08]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-27 22:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8de7b6da-b39e-11dc-b565-0000e267c523}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
\Shell\Explore\command - Flash.10.Setup.exe
\Shell\Open\command - Flash.10.Setup.exe
\Shell\Scan for Viruses\command - Scanner.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 15:49:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\Program Files\iolo\Common\Lib\sguard.dll
.
Completion time: 2007-12-29 15:52:27 - machine was rebooted
.
2007-12-26 18:40:38 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:56:42 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wupeng.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5564 bytes

tetonbob · 12-29-2007, 01:07 AM

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Killall::

File::
C:\WINDOWS\system32\wupeng.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winupdate Engine"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8de7b6da-b39e-11dc-b565-0000e267c523}]

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

erica316 · 12-29-2007, 01:17 AM

do i have to pulled the internet plug and shutdown anti virus and spyware

tetonbob · 12-29-2007, 01:49 AM

Yes, that's fine, thanks....please do.

erica316 · 12-29-2007, 01:56 AM

ComboFix 07-12-29.5 - Nor Azimah 2007-12-29 16:44:10.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.119 [GMT 8:00]
Running from: C:\Documents and Settings\Nor Azimah\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nor Azimah\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\wupeng.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\wupeng.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 15:18 . 2007-12-29 15:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-28 23:18 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys
2007-12-28 23:01 . 2007-12-28 23:01 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-28 23:01 . 2007-12-28 23:01 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-28 12:22 . 2007-12-28 12:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-12-28 12:22 . 2007-12-10 19:47 163,640 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2007-12-28 12:22 . 2007-12-10 19:47 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2007-12-28 12:22 . 2007-12-10 19:47 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2007-12-28 12:22 . 2007-12-10 19:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Program Files\Webroot
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\Webroot
2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-12-28 12:21 . 2007-12-10 20:08 1,526,584 --a------ C:\WINDOWS\WRSetup.dll
2007-12-28 05:13 . 2007-12-28 23:35 <DIR> d-------- C:\Program Files\Google
2007-12-28 02:45 . 2007-12-28 03:17 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\DivX
2007-12-27 22:40 . 2004-08-04 20:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-27 22:39 . 2007-12-29 04:05 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\AVG7
2007-12-27 22:39 . 2007-12-27 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-27 22:38 . 2007-12-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-27 22:00 . 2007-12-28 04:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-27 18:57 . 2007-12-27 18:57 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Store Purchased
2007-12-27 18:31 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-12-27 18:31 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-12-27 18:31 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-12-27 14:09 . 2003-04-23 18:57 592,017 --a------ C:\WINDOWS\BestWallpaperS.net.tc Series 1.jpg
2007-12-27 14:07 . 2007-12-27 14:07 <DIR> d-------- C:\Program Files\DivX
2007-12-27 12:38 . 2007-12-27 12:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-27 12:32 . 2007-12-27 12:32 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Shared
2007-12-27 12:32 . 2007-12-28 12:26 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Saved
2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Incomplete
2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\LimeWire
2007-12-27 12:31 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-27 12:30 . 2007-12-27 12:31 <DIR> d-------- C:\Program Files\Java
2007-12-27 12:27 . 2007-12-27 12:27 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-27 12:26 . 2007-12-27 12:32 <DIR> d-------- C:\Program Files\LimeWire
2007-12-27 01:53 . 2007-12-29 04:09 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Contacts
2007-12-27 01:52 . 2007-12-27 01:52 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-27 01:41 . 2007-12-27 02:23 <DIR> d-------- C:\Program Files\Windows Live
2007-12-27 01:41 . 2007-12-27 01:51 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-27 01:40 . 2007-12-27 01:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-26 21:57 . 2007-12-26 21:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-12-26 21:57 . 2007-12-26 21:57 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-12-26 20:20 . 2007-12-26 20:20 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-26 20:09 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-12-26 20:08 . 2007-12-26 20:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-26 20:08 . 2007-12-26 20:11 <DIR> d-------- C:\Program Files\ATI Technologies
2007-12-26 20:07 . 2007-12-26 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-12-26 19:27 . 2007-12-27 02:39 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-26 19:27 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-26 19:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-26 19:23 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-26 19:23 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 19:22 . 2006-12-12 05:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-12-26 19:21 . 2007-12-26 19:21 <DIR> d-------- C:\WINDOWS\PrimoPDF
2007-12-26 19:17 . 2007-12-26 19:17 <DIR> d--hs---- C:\Documents and Settings\Nor Azimah\UserData
2007-12-26 19:09 . 2007-12-26 19:10 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a--c--- C:\WINDOWS\system32\dllcache\ati2mtag.sys
2007-12-05 11:05 . 2007-12-05 11:05 368,640 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a--c--- C:\WINDOWS\system32\dllcache\ati2dvag.dll
2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 10:56 . 2007-12-05 10:56 147,456 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 43,520 --a------ C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 10:55 . 2007-12-05 10:55 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 10:54 . 2007-12-05 10:54 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 10:53 . 2007-12-05 10:53 495,616 --a------ C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 10:53 . 2007-12-05 10:53 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 10:48 . 2007-12-05 10:48 9,535,488 --a------ C:\WINDOWS\system32\atioglx2.dll
2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat
2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a--c--- C:\WINDOWS\system32\dllcache\ativvaxx.dll
2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 10:33 . 2007-12-05 10:33 887,724 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-12-05 10:19 . 2007-12-05 10:19 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-12-05 10:19 . 2007-12-05 10:19 385,024 --a------ C:\WINDOWS\system32\atikvmag.dll
2007-12-05 10:17 . 2007-12-05 10:17 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-12-05 10:16 . 2007-12-05 10:16 49,152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 10:14 . 2007-12-05 10:14 180,224 --a------ C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a--c--- C:\WINDOWS\system32\dllcache\ati2cqag.dll
2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 09:33 . 2007-12-04 09:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 09:33 . 2007-12-04 09:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2007-12-04 09:33 . 2007-12-04 09:33 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2007-11-30 06:30 . 2007-11-30 06:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-11-30 06:30 . 2007-11-30 06:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-11-30 06:30 . 2007-11-30 06:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-11-30 06:30 . 2007-11-30 06:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-11-30 06:30 . 2007-11-30 06:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-11-30 06:28 . 2007-11-30 06:28 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-11-30 06:28 . 2007-11-30 06:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2007-11-30 06:28 . 2007-11-30 06:28 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest
2007-11-30 06:28 . 2007-11-30 06:28 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 06:04 --------- d-----w C:\Documents and Settings\Nor Azimah\Application Data\iolo
2007-12-26 11:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo
2007-12-26 10:58 --------- d-----w C:\Program Files\iolo
2007-12-26 10:58 --------- d-----w C:\Documents and Settings\LocalService\Application Data\iolo
2007-12-26 10:53 74,703 ----a-w C:\WINDOWS\system32\mfc45.dll
2007-12-26 10:47 --------- d-----w C:\Program Files\TGTSoft
2007-12-26 10:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-29 22:30 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-29 22:30 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-11-29 22:30 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-29 22:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-11-29 22:30 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-29 22:30 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 09:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-18 03:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-10-03 01:05 378,216 ----a-w C:\WINDOWS\system32\Incinerator.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-25 02:31]
"System Mechanic Popup Blocker"="D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" [2007-10-03 09:05]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 09:05]
"SystemGuardAlerter"="D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" [2007-10-03 09:05]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-27 22:38]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-12-10 20:08]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-27 22:38]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 16:48:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\iolo\Common\Lib\sguard.dll

PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\Program Files\iolo\Common\Lib\sguard.dll
.
Completion time: 2007-12-29 16:53:43 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-29 15:52
.
2007-12-26 18:40:38 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:56:12 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5465 bytes

tetonbob · 12-29-2007, 02:00 AM

That should be the end of the popup alerts.

P2P - I see you have P2P software ( Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 u3 and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u3-windowsi586-p.exe to install the newest version.

After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

See this thread for a pictorial guide:

Online Scanner

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

erica316 · 12-29-2007, 02:18 AM

I cant remove java via add/remove program.Can i remove manually via my computer

12-28-2007, 10:01 PM	#1 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Plz Plz Help Me I also have malware crush problem and follow exactly ur advise in ur post but i cant get any log after i scanned with dss.there is nothing happend after the scanned is complete.wat should i do

12-28-2007, 10:10 PM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me Please explain. Did DSS stop running? Did it give an error message? Let's try again...delete your existing copy, and follow these steps exactly. Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges. Note: DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed. Close all applications and windows. Double-click on dss.exe to run it, and follow the prompts If the following message from DSS appears, please click on "Yes" to allow it to download HijackThis, if you don't already have it. Allow DSS through your firewall to download HijackThis by clicking "OK" DSS has installed HijackThis, and placed a shortcut on your desktop. Click "OK" to allow the scan to continue. . When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here. Please attach extra.txt to your post. To attach a file to a new post, simply Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and copy and paste the following into the "Upload File from your Computer" box: C:\Deckard\System Scanner\extra.txt Click Upload. What DSS will do: create a new System Restore point in Windows XP and Vista. clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives. check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-28-2007, 10:25 PM	#3 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me i do exactly as u ask but the text still wont appear

12-28-2007, 10:26 PM	#4 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me do i have to disabled my windows firewall??

12-28-2007, 10:37 PM	#5 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me Is your antivirus having a script blocker, or perhaps your firewall? Those will disallow DSS from creating it's logs. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-28-2007, 10:48 PM	#6 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me how am i suppose to disabled that

12-28-2007, 10:51 PM	#7 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me Well, since I know nothing about your system right now, due to a lack of logs, I can't tell you exactly. Try this instead Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-28-2007, 11:16 PM	#8 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:14:55 PM, on 12/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\wupeng.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 5607 bytes

12-29-2007, 12:01 AM	#10 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me It still fail..it stop at examining event log.I have another question..Is there any way to remove malware crush without using dss?Thz for ur every help..

12-29-2007, 12:30 AM	#13 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me Good job. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe * IMPORTANT !!! Place combofix.exe on your Desktop Disconnect from the internet....pull the plug! Insert your pen drive Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Go to -> Run -> paste in the following single line command & click OK "%userprofile%\desktop\combofix.exe" /killall Follow the prompts. Type "1" and press Enter to begin the scan. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. --------------------------------------------------------------------------------------------- Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this. Re-establish an internet connection. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-29-2007, 12:57 AM	#14 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me ComboFix 07-12-29.5 - Nor Azimah 2007-12-29 15:44:07.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.158 [GMT 8:00] Running from: C:\Documents and Settings\Nor Azimah\desktop\combofix.exe Command switches used :: /killall * Created a new restore point . The following files were disabled during the run: C:\Program Files\iolo\Common\Lib\sguard.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\_000110_.tmp.dll C:\WINDOWS\system32\rlvknlg.exe . ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 ))))))))))))))))))))))))))))))) . 2007-12-29 15:18 . 2007-12-29 15:18 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-29 15:17 . 2007-12-29 15:17 <DIR> d-------- C:\Deckard 2007-12-28 23:18 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys 2007-12-28 23:01 . 2007-12-28 23:01 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2007-12-28 23:01 . 2007-12-28 23:01 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-12-28 12:22 . 2007-12-28 12:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2007-12-28 12:22 . 2007-12-10 19:47 163,640 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2007-12-28 12:22 . 2007-12-10 19:47 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-12-28 12:22 . 2007-12-10 19:47 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2007-12-28 12:22 . 2007-12-10 19:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Program Files\Webroot 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\Webroot 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2007-12-28 12:21 . 2007-12-10 20:08 1,526,584 --a------ C:\WINDOWS\WRSetup.dll 2007-12-28 05:13 . 2007-12-28 23:35 <DIR> d-------- C:\Program Files\Google 2007-12-28 04:08 . 2007-12-28 04:15 12,288 --a------ C:\WINDOWS\system32\wupeng.exe 2007-12-28 02:45 . 2007-12-28 03:17 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\DivX 2007-12-27 22:40 . 2004-08-04 20:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-12-27 22:39 . 2007-12-29 04:05 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\AVG7 2007-12-27 22:39 . 2007-12-27 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-12-27 22:38 . 2007-12-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 22:00 . 2007-12-28 04:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-12-27 18:57 . 2007-12-27 18:57 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Store Purchased 2007-12-27 18:31 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-12-27 18:31 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-12-27 18:31 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-12-27 14:09 . 2003-04-23 18:57 592,017 --a------ C:\WINDOWS\BestWallpaperS.net.tc Series 1.jpg 2007-12-27 14:07 . 2007-12-27 14:07 <DIR> d-------- C:\Program Files\DivX 2007-12-27 12:38 . 2007-12-27 12:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2007-12-27 12:32 . 2007-12-27 12:32 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Shared 2007-12-27 12:32 . 2007-12-28 12:26 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Saved 2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Incomplete 2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\LimeWire 2007-12-27 12:31 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-27 12:30 . 2007-12-27 12:31 <DIR> d-------- C:\Program Files\Java 2007-12-27 12:27 . 2007-12-27 12:27 <DIR> d-------- C:\Program Files\Common Files\Java 2007-12-27 12:26 . 2007-12-27 12:32 <DIR> d-------- C:\Program Files\LimeWire 2007-12-27 01:53 . 2007-12-29 04:09 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Contacts 2007-12-27 01:52 . 2007-12-27 01:52 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-12-27 01:41 . 2007-12-27 02:23 <DIR> d-------- C:\Program Files\Windows Live 2007-12-27 01:41 . 2007-12-27 01:51 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2007-12-27 01:40 . 2007-12-27 01:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-26 21:57 . 2007-12-26 21:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-26 21:57 . 2007-12-26 21:57 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-26 20:20 . 2007-12-26 20:20 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-12-26 20:09 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-12-26 20:08 . 2007-12-26 20:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-12-26 20:08 . 2007-12-26 20:11 <DIR> d-------- C:\Program Files\ATI Technologies 2007-12-26 20:07 . 2007-12-26 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-12-26 19:27 . 2007-12-27 02:39 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-26 19:27 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-12-26 19:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2007-12-26 19:23 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2007-12-26 19:23 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2007-12-26 19:22 . 2006-12-12 05:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll 2007-12-26 19:21 . 2007-12-26 19:21 <DIR> d-------- C:\WINDOWS\PrimoPDF 2007-12-26 19:17 . 2007-12-26 19:17 <DIR> d--hs---- C:\Documents and Settings\Nor Azimah\UserData 2007-12-26 19:09 . 2007-12-26 19:10 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a--c--- C:\WINDOWS\system32\dllcache\ati2mtag.sys 2007-12-05 11:05 . 2007-12-05 11:05 368,640 --a------ C:\WINDOWS\system32\ATIDEMGX.dll 2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a--c--- C:\WINDOWS\system32\dllcache\ati2dvag.dll 2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a------ C:\WINDOWS\system32\ati2dvag.dll 2007-12-05 10:56 . 2007-12-05 10:56 147,456 --a------ C:\WINDOWS\system32\atipdlxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\Oemdspif.dll 2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\ati2evxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 43,520 --a------ C:\WINDOWS\system32\ati2edxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe 2007-12-05 10:54 . 2007-12-05 10:54 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll 2007-12-05 10:53 . 2007-12-05 10:53 495,616 --a------ C:\WINDOWS\system32\ati2evxx.exe 2007-12-05 10:53 . 2007-12-05 10:53 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL 2007-12-05 10:48 . 2007-12-05 10:48 9,535,488 --a------ C:\WINDOWS\system32\atioglx2.dll 2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll 2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a------ C:\WINDOWS\system32\ati3duag.dll 2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat 2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat 2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a--c--- C:\WINDOWS\system32\dllcache\ativvaxx.dll 2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a------ C:\WINDOWS\system32\ativvaxx.dll 2007-12-05 10:33 . 2007-12-05 10:33 887,724 --a------ C:\WINDOWS\system32\ativva6x.dat 2007-12-05 10:19 . 2007-12-05 10:19 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll 2007-12-05 10:19 . 2007-12-05 10:19 385,024 --a------ C:\WINDOWS\system32\atikvmag.dll 2007-12-05 10:17 . 2007-12-05 10:17 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll 2007-12-05 10:16 . 2007-12-05 10:16 49,152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll 2007-12-05 10:14 . 2007-12-05 10:14 180,224 --a------ C:\WINDOWS\system32\atiok3x2.dll 2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a--c--- C:\WINDOWS\system32\dllcache\ati2cqag.dll 2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a------ C:\WINDOWS\system32\ati2cqag.dll 2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-12-04 09:33 . 2007-12-04 09:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-12-04 09:33 . 2007-12-04 09:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll 2007-12-04 09:33 . 2007-12-04 09:33 630,784 --a------ C:\WINDOWS\system32\divxdec.ax 2007-11-30 06:30 . 2007-11-30 06:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-11-30 06:30 . 2007-11-30 06:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-30 06:30 . 2007-11-30 06:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-11-30 06:30 . 2007-11-30 06:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-11-30 06:30 . 2007-11-30 06:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb 2007-11-30 06:28 . 2007-11-30 06:28 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-30 06:28 . 2007-11-30 06:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-28 06:04 --------- d-----w C:\Documents and Settings\Nor Azimah\Application Data\iolo 2007-12-26 11:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo 2007-12-26 10:58 --------- d-----w C:\Program Files\iolo 2007-12-26 10:58 --------- d-----w C:\Documents and Settings\LocalService\Application Data\iolo 2007-12-26 10:47 --------- d-----w C:\Program Files\TGTSoft 2007-12-26 10:31 --------- d-----w C:\Program Files\microsoft frontpage 2007-11-29 22:30 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-11-29 22:30 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-11-29 22:30 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-25 02:31] "System Mechanic Popup Blocker"="D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" [2007-10-03 09:05] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 09:05] "SystemGuardAlerter"="D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" [2007-10-03 09:05] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-27 22:38] "Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [2007-12-28 04:15] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-12-10 20:08] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-27 22:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8de7b6da-b39e-11dc-b565-0000e267c523}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe \Shell\Explore\command - Flash.10.Setup.exe \Shell\Open\command - Flash.10.Setup.exe \Shell\Scan for Viruses\command - Scanner.exe . ************************************************************************ catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-29 15:49:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156] -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\system32\csrss.exe -> C:\Program Files\iolo\Common\Lib\sguard.dll . Completion time: 2007-12-29 15:52:27 - machine was rebooted . 2007-12-26 18:40:38 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:56:42 PM, on 12/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\System32\alg.exe D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\wupeng.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 5564 bytes

12-29-2007, 01:17 AM	#16 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me do i have to pulled the internet plug and shutdown anti virus and spyware

12-29-2007, 01:49 AM	#17 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me Yes, that's fine, thanks....please do. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-29-2007, 01:56 AM	#18 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me ComboFix 07-12-29.5 - Nor Azimah 2007-12-29 16:44:10.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.119 [GMT 8:00] Running from: C:\Documents and Settings\Nor Azimah\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Nor Azimah\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\wupeng.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\wupeng.exe . ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 ))))))))))))))))))))))))))))))) . 2007-12-29 15:18 . 2007-12-29 15:18 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-28 23:18 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys 2007-12-28 23:01 . 2007-12-28 23:01 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2007-12-28 23:01 . 2007-12-28 23:01 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-12-28 12:22 . 2007-12-28 12:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2007-12-28 12:22 . 2007-12-10 19:47 163,640 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2007-12-28 12:22 . 2007-12-10 19:47 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-12-28 12:22 . 2007-12-10 19:47 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2007-12-28 12:22 . 2007-12-10 19:47 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Program Files\Webroot 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\Webroot 2007-12-28 12:21 . 2007-12-28 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2007-12-28 12:21 . 2007-12-10 20:08 1,526,584 --a------ C:\WINDOWS\WRSetup.dll 2007-12-28 05:13 . 2007-12-28 23:35 <DIR> d-------- C:\Program Files\Google 2007-12-28 02:45 . 2007-12-28 03:17 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\DivX 2007-12-27 22:40 . 2004-08-04 20:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-12-27 22:39 . 2007-12-29 04:05 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\AVG7 2007-12-27 22:39 . 2007-12-27 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-12-27 22:38 . 2007-12-27 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 22:00 . 2007-12-28 04:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-12-27 18:57 . 2007-12-27 18:57 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Store Purchased 2007-12-27 18:31 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-12-27 18:31 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-12-27 18:31 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-12-27 14:09 . 2003-04-23 18:57 592,017 --a------ C:\WINDOWS\BestWallpaperS.net.tc Series 1.jpg 2007-12-27 14:07 . 2007-12-27 14:07 <DIR> d-------- C:\Program Files\DivX 2007-12-27 12:38 . 2007-12-27 12:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2007-12-27 12:32 . 2007-12-27 12:32 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Shared 2007-12-27 12:32 . 2007-12-28 12:26 <DIR> d-------- C:\Documents and Settings\Nor Azimah\LimeWire Saved 2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Incomplete 2007-12-27 12:32 . 2007-12-28 13:56 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Application Data\LimeWire 2007-12-27 12:31 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-27 12:30 . 2007-12-27 12:31 <DIR> d-------- C:\Program Files\Java 2007-12-27 12:27 . 2007-12-27 12:27 <DIR> d-------- C:\Program Files\Common Files\Java 2007-12-27 12:26 . 2007-12-27 12:32 <DIR> d-------- C:\Program Files\LimeWire 2007-12-27 01:53 . 2007-12-29 04:09 <DIR> d-------- C:\Documents and Settings\Nor Azimah\Contacts 2007-12-27 01:52 . 2007-12-27 01:52 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-12-27 01:41 . 2007-12-27 02:23 <DIR> d-------- C:\Program Files\Windows Live 2007-12-27 01:41 . 2007-12-27 01:51 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2007-12-27 01:40 . 2007-12-27 01:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-26 21:57 . 2007-12-26 21:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-26 21:57 . 2007-12-26 21:57 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-26 20:20 . 2007-12-26 20:20 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-12-26 20:09 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-12-26 20:08 . 2007-12-26 20:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-12-26 20:08 . 2007-12-26 20:11 <DIR> d-------- C:\Program Files\ATI Technologies 2007-12-26 20:07 . 2007-12-26 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-12-26 19:27 . 2007-12-27 02:39 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-26 19:27 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-12-26 19:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2007-12-26 19:23 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2007-12-26 19:23 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2007-12-26 19:23 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2007-12-26 19:22 . 2006-12-12 05:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll 2007-12-26 19:21 . 2007-12-26 19:21 <DIR> d-------- C:\WINDOWS\PrimoPDF 2007-12-26 19:17 . 2007-12-26 19:17 <DIR> d--hs---- C:\Documents and Settings\Nor Azimah\UserData 2007-12-26 19:09 . 2007-12-26 19:10 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-12-05 13:26 . 2007-12-05 13:26 2,782,208 --a--c--- C:\WINDOWS\system32\dllcache\ati2mtag.sys 2007-12-05 11:05 . 2007-12-05 11:05 368,640 --a------ C:\WINDOWS\system32\ATIDEMGX.dll 2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a--c--- C:\WINDOWS\system32\dllcache\ati2dvag.dll 2007-12-05 11:04 . 2007-12-05 11:04 269,312 --a------ C:\WINDOWS\system32\ati2dvag.dll 2007-12-05 10:56 . 2007-12-05 10:56 147,456 --a------ C:\WINDOWS\system32\atipdlxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\Oemdspif.dll 2007-12-05 10:55 . 2007-12-05 10:55 122,880 --a------ C:\WINDOWS\system32\ati2evxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 43,520 --a------ C:\WINDOWS\system32\ati2edxx.dll 2007-12-05 10:55 . 2007-12-05 10:55 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe 2007-12-05 10:54 . 2007-12-05 10:54 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll 2007-12-05 10:53 . 2007-12-05 10:53 495,616 --a------ C:\WINDOWS\system32\ati2evxx.exe 2007-12-05 10:53 . 2007-12-05 10:53 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL 2007-12-05 10:48 . 2007-12-05 10:48 9,535,488 --a------ C:\WINDOWS\system32\atioglx2.dll 2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll 2007-12-05 10:44 . 2007-12-05 10:44 3,175,584 --a------ C:\WINDOWS\system32\ati3duag.dll 2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat 2007-12-05 10:33 . 2007-12-05 10:33 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat 2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a--c--- C:\WINDOWS\system32\dllcache\ativvaxx.dll 2007-12-05 10:33 . 2007-12-05 10:33 1,640,192 --a------ C:\WINDOWS\system32\ativvaxx.dll 2007-12-05 10:33 . 2007-12-05 10:33 887,724 --a------ C:\WINDOWS\system32\ativva6x.dat 2007-12-05 10:19 . 2007-12-05 10:19 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll 2007-12-05 10:19 . 2007-12-05 10:19 385,024 --a------ C:\WINDOWS\system32\atikvmag.dll 2007-12-05 10:17 . 2007-12-05 10:17 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll 2007-12-05 10:16 . 2007-12-05 10:16 49,152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll 2007-12-05 10:14 . 2007-12-05 10:14 180,224 --a------ C:\WINDOWS\system32\atiok3x2.dll 2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a--c--- C:\WINDOWS\system32\dllcache\ati2cqag.dll 2007-12-05 10:11 . 2007-12-05 10:11 499,712 --a------ C:\WINDOWS\system32\ati2cqag.dll 2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-12-04 09:33 . 2007-12-04 09:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-12-04 09:33 . 2007-12-04 09:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-12-04 09:33 . 2007-12-04 09:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll 2007-12-04 09:33 . 2007-12-04 09:33 630,784 --a------ C:\WINDOWS\system32\divxdec.ax 2007-11-30 06:30 . 2007-11-30 06:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-11-30 06:30 . 2007-11-30 06:30 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-30 06:30 . 2007-11-30 06:30 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-11-30 06:30 . 2007-11-30 06:30 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-11-30 06:30 . 2007-11-30 06:30 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb 2007-11-30 06:28 . 2007-11-30 06:28 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-30 06:28 . 2007-11-30 06:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-11-30 06:28 . 2007-11-30 06:28 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest 2007-11-30 06:28 . 2007-11-30 06:28 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-28 06:04 --------- d-----w C:\Documents and Settings\Nor Azimah\Application Data\iolo 2007-12-26 11:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo 2007-12-26 10:58 --------- d-----w C:\Program Files\iolo 2007-12-26 10:58 --------- d-----w C:\Documents and Settings\LocalService\Application Data\iolo 2007-12-26 10:53 74,703 ----a-w C:\WINDOWS\system32\mfc45.dll 2007-12-26 10:47 --------- d-----w C:\Program Files\TGTSoft 2007-12-26 10:31 --------- d-----w C:\Program Files\microsoft frontpage 2007-11-29 22:30 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-11-29 22:30 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-11-29 22:30 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-11-29 22:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-11-29 22:30 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-11-29 22:30 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-27 09:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-18 03:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-03 01:05 378,216 ----a-w C:\WINDOWS\system32\Incinerator.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-25 02:31] "System Mechanic Popup Blocker"="D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" [2007-10-03 09:05] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 09:05] "SystemGuardAlerter"="D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" [2007-10-03 09:05] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-27 22:38] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-12-10 20:08] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-27 22:38] . ************************************************************************ catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-29 16:48:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156] -> C:\Program Files\iolo\Common\Lib\sguard.dll PROCESS: C:\WINDOWS\system32\csrss.exe -> C:\Program Files\iolo\Common\Lib\sguard.dll . Completion time: 2007-12-29 16:53:43 - machine was rebooted C:\ComboFix2.txt ... 2007-12-29 15:52 . 2007-12-26 18:40:38 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:56:12 PM, on 12/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe D:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" O4 - HKLM\..\Run: [SystemGuardAlerter] "D:\Program Files\iolo\System Mechanic 7\SystemGuardAlerter.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "D:\Program Files\iolo\System Mechanic 7\PopupBlocker.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198667988135 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B47A665D-363D-470C-BF66-7CC6F5801701}: NameServer = 202.188.0.133 202.188.1.5 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - D:\Program Files\iolo\System Mechanic 7\IoloSGCtrl.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 5465 bytes

12-29-2007, 02:00 AM	#19 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,740 OS: 2000 Pro; XP Pro; XP Home	Re: Plz Plz Help Me That should be the end of the popup alerts. P2P - I see you have P2P software ( Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6 u3 and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u3-windowsi586-p.exe to install the newest version. After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. --------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. See this thread for a pictorial guide: Online Scanner First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

12-29-2007, 02:18 AM	#20 (permalink)
erica316 Registered User Join Date: Dec 2007 Posts: 30 OS: xp	Re: Plz Plz Help Me I cant remove java via add/remove program.Can i remove manually via my computer