|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-12-2008, 11:45 PM
|
#21 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Response to post #18:
filter.drv - modified 01-06-2008 hb13a.dll - modified 01-09-2008 options.dat - modified 01-06-2008 prx97w.dll - modified 01-06-2008 wsil32.dll - modified 08-29-2002 |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-12-2008, 11:51 PM
|
#22 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Thanks....those need to go. I'd like to collect them also. Sorry to make you go through an extra step.
Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
01-13-2008, 12:16 AM
|
#23 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Files have been submitted of analysis and below is combofix log.
ComboFix 08-01-13.1 - Martin 2008-01-13 1:00:04.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.98 [GMT -6:00] Running from: C:\Documents and Settings\Martin\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Martin\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\SYSTEM32\dhesaybh.dat C:\WINDOWS\SYSTEM32\duaepeqa.dat C:\WINDOWS\SYSTEM32\lvuqxizx.dat C:\WINDOWS\SYSTEM32\mwtmqymy.dat C:\WINDOWS\SYSTEM32\ygszobyi.dat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\SYSTEM32\AppCert C:\WINDOWS\SYSTEM32\AppCert\filter.drv C:\WINDOWS\SYSTEM32\AppCert\hb13a.dll C:\WINDOWS\SYSTEM32\AppCert\options.dat C:\WINDOWS\SYSTEM32\AppCert\prx97w.dll C:\WINDOWS\SYSTEM32\AppCert\wsil32.dll C:\WINDOWS\SYSTEM32\dhesaybh.dat C:\WINDOWS\SYSTEM32\duaepeqa.dat C:\WINDOWS\SYSTEM32\lvuqxizx.dat C:\WINDOWS\SYSTEM32\mwtmqymy.dat C:\WINDOWS\SYSTEM32\ygszobyi.dat . ((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))) . 2008-01-12 22:40 . 2003-07-16 14:44 245,920 -r-hs---- C:\cmldr 2008-01-12 22:40 . 2007-01-15 19:57 211 -rahs---- C:\BOOT.BAK 2008-01-12 21:29 . 2008-01-12 21:29 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-12 13:57 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS 2008-01-12 13:33 . 2008-01-12 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2008-01-12 13:33 . 2008-01-12 13:33 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2008-01-12 13:33 . 2008-01-12 13:33 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2008-01-12 13:33 . 2008-01-12 13:33 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2008-01-12 12:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 00:17 . 2008-01-12 00:17 <DIR> d-------- C:\Deckard 2008-01-12 00:09 . 2008-01-12 00:12 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-12 00:09 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-01-10 20:40 . 2008-01-10 20:40 <DIR> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Program Files\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-01-10 20:13 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll 2008-01-10 20:13 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys 2008-01-10 20:13 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys 2008-01-10 20:13 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys 2008-01-10 20:13 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys 2008-01-10 20:12 . 2008-01-10 20:27 164 --a------ C:\install.dat 2008-01-09 21:46 . 2008-01-09 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-09 21:46 . 2007-11-14 16:05 1,086,952 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll 2008-01-09 21:46 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-01-09 21:46 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2008-01-07 20:53 . 2008-01-07 20:59 <DIR> d-------- C:\Program Files\XoftSpySE 2008-01-06 14:59 . 2008-01-06 14:59 1,188,375 --a------ C:\WINDOWS\SYSTEM32\libeay32.dll 2008-01-06 14:59 . 2008-01-06 14:59 246,545 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-13 05:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-01-12 20:32 --------- d-----w C:\Program Files\Norton AntiVirus 2008-01-12 20:26 --------- d-----w C:\Program Files\iTunes 2008-01-11 05:59 --------- d-----w C:\Program Files\Family Trees Quick & Easy 5 2007-12-24 05:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-11-14 06:38 --------- d-----w C:\Program Files\TotalFax 7.0 2007-11-07 04:40 724,984 ----a-w C:\Documents and Settings\Martin\gotomypc_437.exe 2005-07-24 17:22 32 --sha-w C:\WINDOWS\{3E6F4D71-DAD8-40A3-A03E-6BAE2FEC7583}.dat 2005-07-24 17:22 32 --sha-w C:\WINDOWS\SYSTEM32\{9D957D8C-3407-47AA-AA06-4EC784B82DB4}.dat . ((((((((((((((((((((((((((((( snapshot_2008-01-12_20.42.54.39 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-13 02:40:47 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-13 06:59:42 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-13 06:59:42 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-13 02:40:47 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-13 06:59:43 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-13 06:59:43 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-13 02:40:47 4,390,912 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat + 2008-01-13 06:59:43 4,411,392 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat - 2008-01-13 02:40:47 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-13 06:59:43 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2001-07-14 23:32:24 69,632 ----a-w C:\WINDOWS\setupupd\temp\wsdueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07 114688] "BCMSMMSG"="BCMSMMSG.exe" [2003-06-02 05:00 122880 C:\WINDOWS\BCMSMMSG.exe] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27 28672] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47 204800] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 01:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-10-07 16:21 294912] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-25 23:11 180269] "ccApp"="-" [] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 21:23 34504] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-25 14:02 100056] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 15:59 218240] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 15:55 267064] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40 5367608] . Contents of the 'Scheduled Tasks' folder "2008-01-11 06:28:54 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job" - C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca "2005-07-24 17:43:52 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE "2008-01-11 02:13:49 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-13 01:03:56 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-13 1:10:13 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-13 07:10:08 ComboFix2.txt 2008-01-13 05:16:18 ComboFix3.txt 2008-01-13 03:18:45 ComboFix4.txt 2008-01-13 02:43:32 |
|
|
|
|
01-13-2008, 12:22 AM
|
#24 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Good job, thanks!
Before we continue, I have a question. Is your Norton subscription current? Norton AntiVirus 2003 seems rather old at this point, but if you keep it current, I guess it's OK.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-13-2008, 12:27 AM
|
#26 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
The norton subscription is not current. A couple of days ago I installed Webroot Spy Sweeper with Antivirus. Is this good or should I do something different?
|
|
|
|
|
01-13-2008, 12:30 AM
|
#27 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Well, that's fine, but you should only have one AntiVirus installed.
Do this, please. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- Create an uninstall list: With HiJackThis still open
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-13-2008, 12:36 AM
|
#28 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:33:32 AM, on 1/13/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DwlClient] "C:\Program Files\Common Files\Dell\EUSW\Support.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] - O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.isqft.com/Applets/ScriptX/ScriptX.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26f46bca...p/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113627649515 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploa...loadClient.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 7223 bytes ********************************************************* Adobe Download Manager 1.2 (Remove Only) Adobe Flash Player 9 Adobe Photoshop CS Adobe Reader 6.0.1 AnswerWorks Runtime Apple Software Update AutoCAD 2000i AutoCAD Express Tools - AutoCAD 2000i BCM V.92 56K Modem Broadcom Management Programs Dell Digital Jukebox Driver Dell Media Experience Dell Solution Center Dell Support DS21Patch DVDSentry HijackThis 2.0.2 Intel(R) Extreme Graphics Driver Internet Explorer Default Page Internet Explorer Q903235 iTunes Jasc Paint Shop Photo Album Jasc Paint Shop Pro 8 Dell Edition Java 2 Runtime Environment, SE v1.4.2 Kazaa 3.0 LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) Macromedia Flash Player Microsoft .NET Framework 1.1 Microsoft Encarta Encyclopedia Standard 2004 Microsoft FrontPage 2002 Microsoft Office 2000 Standard Microsoft Streets and Trips 2001 Modem Helper MSN Music Assistant Mustek Scanner Solutions for 600 III EP Plus v3.2 Norton AntiVirus 2003 Norton WMI Update Panda ActiveScan PowerDVD QuickTime RealPlayer SBC Yahoo! Applications Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896426) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905495) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924496) Sony USB Driver Sound Blaster Live! Spy Sweeper SpywareBlaster v3.5.1 Update for Windows XP (KB835409) Update for Windows XP (KB898461) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Viewpoint Media Player Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB828741 Windows XP Hotfix - KB835732 Windows XP Hotfix - KB842773 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883939 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB896688 Windows XP Hotfix - KB896727 Windows XP Hotfix - KB897715 Windows XP Hotfix - KB905915 Windows XP Hotfix - KB911567 Windows XP Hotfix - KB912812 Windows XP Hotfix - KB916281 Windows XP Hotfix - KB918439 Windows XP Hotfix - KB918899 Windows XP Hotfix - KB925486 WinZip ZoneAlarm |
|
|
|
|
01-13-2008, 12:46 AM
|
#29 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
We have some more work to do.
Please use the instructions on this page to completely uninstall your Norton Products. --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
--------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-13-2008, 03:01 AM
|
#30 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Norton is gone.
Java updated. Kaspersky and HijackThis logs are below. Looks like more work. ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, January 13, 2008 3:51:30 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 13/01/2008 Kaspersky Anti-Virus database records: 509951 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 51680 Number of viruses found: 9 Number of infected objects: 15 Number of suspicious objects: 0 Duration of the scan process: 01:03:32 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\20080112210212\backup\DOCUME~1\Martin\LOCALS~1\Temp\av18EE.exe/data0006 Infected: not-a-virus:FraudTool.Win32.SpyHeal.a skipped C:\Deckard\System Scanner\20080112210212\backup\DOCUME~1\Martin\LOCALS~1\Temp\av18EE.exe NSIS: infected - 1 skipped C:\Deckard\System Scanner\20080112210212\backup\DOCUME~1\Martin\LOCALS~1\Temp\laf18ED.tmp Infected: not-virus:Hoax.Win32.Renos.dv skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Documents\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\AlbumArtSmall.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\AlbumArt_{79D3A434-2D93-4194-AD18-F79744B5CF43}_Large.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\AlbumArt_{79D3A434-2D93-4194-AD18-F79744B5CF43}_Small.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Folder.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.ASX Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.BMP Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.WMA Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\AlbumArtSmall.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\AlbumArt_{08115859-E625-4BCD-83A8-57E01873B42F}_Large.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\AlbumArt_{08115859-E625-4BCD-83A8-57E01873B42F}_Small.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Large.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Small.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Folder.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Thumbs.db Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- 4 and 5 star rated.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- Have not heard recently.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- Listen to late at night.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- Listen to on Weekdays.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- Listen to on Weekends.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- One Audio CD worth.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Favorites -- One Data CD-R worth.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Fresh tracks -- yet to be played.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Fresh tracks -- yet to be rated.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Fresh tracks.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\High bitrate media in my library.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Low bitrate media in my library.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Music tracks I dislike.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Music tracks I have not rated.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\178A3E91\Music tracks with content protection.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\01_Music_auto_rated_at_5_stars.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\02_Music_added_in_the_last_month.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\03_Music_rated_at_4_or_5_stars.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\04_Music_played_in_the_last_month.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\05_Pictures_taken_in_the_last_month.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\06_Pictures_rated_4_or_5_stars.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\07_TV_recorded_in_the_last_week.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\08_Video_rated_at_4_or_5_stars.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\09_Music_played_the_most.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\10_All_Music.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\11_All_Pictures.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\178A3EFE\12_All_Video.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Thumbs.db Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Martin\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Martin\Desktop\[4]-Submit_2008-01-12@23.10.zip/s6i5w1euqxsh.exe Infected: Backdoor.Win32.Agent.djt skipped C:\Documents and Settings\Martin\Desktop\[4]-Submit_2008-01-12@23.10.zip ZIP: infected - 1 skipped C:\Documents and Settings\Martin\Local Settings\Application Data\ApplicationHistory\NotifyAlert.exe.83a8f8c0.ini.inuse Object is locked skipped C:\Documents and Settings\Martin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Martin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Martin\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Martin\Local Settings\Temp\Perflib_Perfdata_1c8.dat Object is locked skipped C:\Documents and Settings\Martin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Martin\ntuser.dat Object is locked skipped C:\Documents and Settings\Martin\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\SecTaskMan\printer.exe.q_8043A00_q.vir Infected: not-virus:Hoax.Win32.Renos.hz skipped C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8043A00_q.vir Infected: not-virus:Hoax.Win32.Renos.hz skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\authzd.dll.vir Infected: Trojan-Clicker.Win32.Delf.mi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cvz1.dll.vir Infected: Trojan.Win32.Kolweb.f skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\ivdvymgf.dat.vir Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vtr135.dll.vir Infected: Trojan-Downloader.Win32.Agent.bxx skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP25\A0000135.dll Infected: Trojan-Downloader.Win32.Agent.bfj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP25\A0000145.dll Infected: Trojan-Clicker.Win32.Delf.mi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP28\A0001173.old Infected: Trojan.Win32.Agent.ali skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP30\A0001328.dll Infected: Trojan.Win32.Kolweb.f skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP30\A0001329.dll Infected: Trojan-Downloader.Win32.Agent.bxx skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP33\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\DESKTOP.ldb Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\TEMP\ZLT01952.TMP Object is locked skipped C:\WINDOWS\TEMP\ZLT01969.TMP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ********************************************************* Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:56:23 AM, on 1/13/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DwlClient] "C:\Program Files\Common Files\Dell\EUSW\Support.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.isqft.com/Applets/ScriptX/ScriptX.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26f46bca...p/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113627649515 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploa...loadClient.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 6430 bytes |
|
|
|
|
01-13-2008, 03:28 AM
|
#31 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
I mentioned earlier that I had installed Webroot Spy Sweeper. There are currently 40 items quarantined in Spy Sweeper. Can these items be deleted? I have attached two GIFs (print screen) showing the quarantined files.
|
|
|
|
|
01-13-2008, 08:45 AM
|
#32 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
The items found by Kaspersky are in Quarantine or System Restore's cache. They will be addressed by uninstalling ComboFix using the method described below.
First.... Go to Start > Run and copy/paste the following, then press Enter: cmd /c del /a/f "C:\Documents and Settings\Martin\Desktop\[4]-Submit_2008-01-12@23.10.zip" With regards to the SpySweeper Quarantine items, as you can see on the screenshot, items there are safe, as they've likely been renamed...but, yes you can delete them finally from the system using the program's interface. Other than that..... Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 02-04-2008 at 02:08 PM. |
|
|
|
|
01-13-2008, 12:00 PM
|
#33 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
In your last post you said to run the following:
cmd /c del /a/f "C:\Documents and Settings\Martin\Desktop\[4]-Submit_2008-01-12@23.10.zip" I did and the zip file on my desktop was removed. There is still a zip file [4]-Submit_2008-01-13@0.59.zip. Should I run the command on this file also? |
|
|
|
|
01-13-2008, 12:31 PM
|
#34 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
I am currently scanning with Spy Sweeper and so far 3 viruses have been detected (Troj/Dloadr-BDZ, Troj/Spywad-AR and Troj/Zlobou-Gen). I will post response of all detections when through scanning.
Thank you! |
|
|
|
|
01-13-2008, 12:47 PM
|
#35 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Just delete this file:
[4]-Submit_2008-01-13@0.59.zip Right click on it, and delete it. Where is SpySweeper finding these items? No one scanner is perfect, and some will see what others will not. Did you uninstall ComboFix before performing this latest scan with SpySweeper?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-13-2008, 01:00 PM
|
#36 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
This is the Spy Sweeper log. Unable to quarantine. Are they already quarantined by another program? If so, how can I delete?
Also, see post #33. Thank You! 1:50 PM: Removal process completed. Elapsed time 00:00:21 1:50 PM: Informational: Virus infected file c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp not cleaned. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 20 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 19 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 18 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 17 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 16 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 15 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 14 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 13 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 12 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 11 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 10 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 9 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 8 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 7 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 6 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 5 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 4 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 3 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 2 rounds of disinfection. 1:50 PM: Informational: File c:\deckard\system scanner\20080112210212\backup\docume~1\martin\locals~1\temp\laf18ed.tmp still infected with virus Troj/Zlobou-Gen after 1 round of disinfection. 1:50 PM: Quarantining All Traces: Troj/Zlobou-Gen 1:50 PM: Informational: Virus infected file c:\qoobox\quarantine\c\documents and settings\all users\application data\sectaskman\winavxx.exe.q_8043a00_q.vir not cleaned. 1:50 PM: Informational: Virus infected file c:\qoobox\quarantine\c\documents and settings\all users\application data\sectaskman\printer.exe.q_8043a00_q.vir not cleaned. 1:50 PM: Quarantining All Traces: Troj/Spywad-AR 1:50 PM: Informational: Virus infected file c:\qoobox\quarantine\c\windows\system32\vtr135.dll.vir not cleaned. 1:50 PM: Quarantining All Traces: Troj/Dloadr-BDZ 1:49 PM: Removal process initiated 1:38 PM: Traces Found: 4 1:38 PM: Full Sweep has completed. Elapsed time 00:37:38 1:38 PM: File Sweep Complete, Elapsed Time: 00:33:02 1:37 PM: Warning: SweepDirectories: Cannot find directory "e:". This directory was not added to the list of paths to be scanned. 1:37 PM: Warning: SweepDirectories: Cannot find directory "d:". This directory was not added to the list of paths to be scanned. 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\edit[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms4c09ee9b-008a-482e-ac08-c83734f19b04.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsd8687386-d734-4c56-941a-90ef12076ea6.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmse8928799-70ff-403c-918d-a5e4aa235100.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms2a92381c-f141-4bbc-98b5-f1a236245b9f.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms9d773a2f-9083-4ffe-9bf1-b3c8738e322c.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms4adad729-b8bd-43ea-b3d0-df893f9ea6a5.tmp] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\post_new[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\collapse_thead[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\z-trash[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\thumbsdown[1].gif] 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms4c09ee9b-008a-482e-ac08-c83734f19b04.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsd8687386-d734-4c56-941a-90ef12076ea6.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmse8928799-70ff-403c-918d-a5e4aa235100.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms2a92381c-f141-4bbc-98b5-f1a236245b9f.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms9d773a2f-9083-4ffe-9bf1-b3c8738e322c.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms4adad729-b8bd-43ea-b3d0-df893f9ea6a5.tmp". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\edit[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\collapse_thead[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\post_new[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\z-trash[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\thumbsdown[1].gif". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\all users\documents\my music\sample music\thumbs.db:encryptable] 1:36 PM: Warning: Failed to open file "c:\documents and settings\all users\documents\my music\sample music\thumbs.db:encryptable". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\thumbsup[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\html[1].gif] 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\thumbsup[1].gif". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\4-dontknow[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\4-thatsbad[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\wave[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\outdent[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\code[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\insertimage[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\email[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\indent[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\unlink[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\insertunorderedlist[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\insertorderedlist[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\justifyleft[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\underline[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\italic[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\resize_1[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\spelling[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\resize_0[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\undo[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\attach[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\smilie[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\menupop[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\color[1].gif] 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\4-dontknow[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\4-thatsbad[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\wave[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\html[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\code[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\insertimage[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\email[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\indent[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\unlink[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\outdent[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\insertunorderedlist[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\insertorderedlist[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\justifyleft[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\underline[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\italic[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\resize_1[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\spelling[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\resize_0[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\undo[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\attach[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\smilie[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\menupop[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\color[1].gif". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\separator[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\removeformat[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\clear[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\getad[3]] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\rating_1[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\rating_2[1].gif] 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\separator[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\removeformat[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\clear[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\getad[3]". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\rating_1[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\rating_2[1].gif". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\icon_eek[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\quote[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\collapse_tcat[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\txt[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\delicious[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\sticky[1].gif] 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\getad[5]] 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\all users\documents\my music\thumbs.db:encryptable] 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\collapse_tcat[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\txt[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\00emsuxq\quote[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\delicious[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\7hmwz9sj\icon_eek[1].gif". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\pagefile.sys] 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\wo6p5i9e\sticky[1].gif". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\martin\local settings\temporary internet files\content.ie5\90rd84l8\getad[5]". The operation completed successfully 1:36 PM: Warning: Failed to open file "c:\documents and settings\all users\documents\my music\thumbs.db:encryptable". The operation completed successfully 1:36 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\windows\system32\config\default] 1:35 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\windows\system32\config\software] 1:35 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms9bbe0af7-3e22-4b96-8280-dd6469c8c46d.tmp] 1:34 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms6bb1393c-08dc-4c41-a63e-66842bd728ba.tmp] 1:33 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\hiberfil.sys] 1:33 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsb22d2845-f65f-4b62-878b-cee2792199b2.tmp] 1:33 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\windows\system32\config\system] 1:33 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsafd6c8dc-a316-4135-b806-19a0db67a0cf.tmp] 1:31 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms5322d8a3-5e8f-45f4-aa81-54a9ac84d3c2.tmp] 1:31 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\all users\documents\my music\music.wma] 1:29 PM: ApplicationMinimized - EXIT 1:29 PM: ApplicationMinimized - ENTER 1:27 PM: ApplicationMinimized - EXIT 1:27 PM: ApplicationMinimized - ENTER 1:26 PM: Warning: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\windows\system32\config\security] 1:23 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms723bd349-64b7-42ee-8c59-57ddb3c4bc1d.tmp] 1:23 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsa606cba1-25d1-49e4-b8a5-bc67bfcb356c.tmp] 1:22 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\martin\ntuser.dat] 1:19 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms7e1aebf8-d1d2-4844-a403-ded43e461e75.tmp] 1:18 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssms18510100-2137-4ad2-bf54-0be84005b781.tmp] 1:15 PM: Warning: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\ssmsa7d75226-c56e-48f3-b596-763b003ebe7f.tmp] 1:13 PM: C:\Deckard\System Scanner\20080112210212\backup\DOCUME~1\Martin\LOCALS~1\Temp\laf18ED.tmp (ID = 0) 1:13 PM: Found Troj/Zlobou-Gen: Troj/Zlobou-Gen 1:11 PM: C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\SecTaskMan\printer.exe.q_8043A00_q.vir (ID = 0) 1:09 PM: C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8043A00_q.vir (ID = 0) 1:09 PM: Found Troj/Spywad-AR: Troj/Spywad-AR 1:06 PM: C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vtr135.dll.vir (ID = 0) 1:06 PM: Found Troj/Dloadr-BDZ: Troj/Dloadr-BDZ 1:05 PM: Starting File Sweep 1:05 PM: Warning: SweepDirectories: Cannot find directory "a:". This directory was not added to the list of paths to be scanned. 1:05 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 1:05 PM: Starting Cookie Sweep 1:05 PM: Registry Sweep Complete, Elapsed Time:00:00:24 1:05 PM: Starting Registry Sweep 1:05 PM: Memory Sweep Complete, Elapsed Time: 00:03:53 1:04 PM: ApplicationMinimized - EXIT 1:04 PM: ApplicationMinimized - ENTER 1:01 PM: Starting Memory Sweep 1:01 PM: Start Full Sweep 1:01 PM: Sweep initiated using definitions version 1065 12:54 PM: ApplicationMinimized - EXIT 12:54 PM: ApplicationMinimized - ENTER 12:54 PM: Deletion from quarantine completed. Elapsed time 00:00:02 12:54 PM: Processing: toplist cookie 12:54 PM: Processing: atlas dmt cookie 12:54 PM: Processing: atlas dmt cookie 12:54 PM: Processing: statcounter cookie 12:54 PM: Processing: statcounter cookie 12:54 PM: Processing: serving-sys cookie 12:54 PM: Processing: webtrendslive cookie 12:54 PM: Processing: tribalfusion cookie 12:54 PM: Processing: tribalfusion cookie 12:54 PM: Processing: pricegrabber cookie 12:54 PM: Processing: pricegrabber cookie 12:54 PM: Processing: enhance cookie 12:54 PM: Processing: yieldmanager cookie 12:54 PM: Processing: bs.serving-sys cookie 12:54 PM: Processing: dealtime cookie 12:54 PM: Processing: dealtime cookie 12:54 PM: Processing: dealtime cookie 12:54 PM: Processing: linksynergy cookie 12:54 PM: Processing: mediaplex cookie 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: rx toolbar 12:54 PM: Processing: topsearch 12:54 PM: Processing: topsearch 12:54 PM: Processing: topsearch 12:54 PM: Processing: instafinder 12:54 PM: Processing: instafinder 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: altnet 12:54 PM: Processing: pesttrap 12:54 PM: Processing: bullguard popup ad 12:54 PM: Processing: bullguard popup ad 12:54 PM: Processing: antivermins 12:54 PM: Processing: antivermins 12:54 PM: Processing: antivermins 12:54 PM: Processing: spy dawn 12:54 PM: Processing: pesttrap fakealert 12:54 PM: Processing: pesttrap fakealert 12:54 PM: Processing: trojan-durvil 12:54 PM: Processing: trojan-durvil 12:54 PM: Processing: W32/KWBot-C 12:54 PM: Processing: purityscan 12:54 PM: Processing: Troj/Zlobou-Gen 12:54 PM: Processing: Troj/Zlobou-Gen 12:54 PM: Processing: Troj/Zlobou-Gen 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Spywad-AR 12:54 PM: Processing: Troj/Fortn-A 12:54 PM: Processing: Troj/Fortn-A 12:54 PM: Processing: Troj/Fortn-A 12:54 PM: Processing: Troj/Fortn-A 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-BDZ 12:54 PM: Processing: Troj/Dloadr-AYQ 12:54 PM: Processing: Troj/Dloadr-AYQ 12:54 PM: Processing: Troj/Dloadr-AYQ 12:54 PM: Processing: Troj/BytVrfy-A 12:54 PM: Processing: Troj/BytVrfy-A 12:54 PM: Processing: Troj/ByteV-Fam 12:54 PM: Processing: Troj/ByteV-Fam 12:54 PM: Processing: Troj/ByteV-Fam 12:54 PM: Processing: Troj/ByteVeri-X 12:54 PM: Processing: Troj/ByteVeri-X 12:54 PM: Processing: Troj/ByteVeri-X 12:54 PM: Processing: Troj/ByteVeri-X 12:54 PM: Processing: Troj/BHO-EL 12:54 PM: Processing: Troj/BHO-EL 12:54 PM: Processing: Troj/BHO-EL 12:54 PM: Processing: trojan-downloader-moneymind 12:54 PM: Processing: trojan-downloader-moneymind 12:54 PM: Processing: trojan-downloader-moneymind 12:54 PM: Processing: trojan-downloader-moneymind 12:54 PM: Processing: Mal/EncPk-BB 12:54 PM: Processing: Mal/EncPk-BB 12:54 PM: Processing: Mal/EncPk-BB 12:54 PM: Processing: Mal/EncPk-BB 12:54 PM: Processing: Mal/Emogen-Y 12:54 PM: Processing: Mal/ClsDLod-A 12:54 PM: Processing: Mal/ClsDLod-A 12:54 PM: Processing: Mal/ClsDLod-A 12:54 PM: Processing: Exp/WMF-A 12:54 PM: Processing: Exp/WMF-A 12:54 PM: Deletion from quarantine initiated 4:45 AM: Informational: Virus infected file C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP30\A0001329.DLL not cleaned. 4:45 AM: File System Shield: found: Virus: Troj/Dloadr-BDZ, version 4:30 AM: ApplicationMinimized - EXIT 4:30 AM: ApplicationMinimized - ENTER 4:22 AM: ApplicationMinimized - EXIT 4:22 AM: ApplicationMinimized - ENTER 4:21 AM: ApplicationMinimized - EXIT 4:21 AM: ApplicationMinimized - ENTER 4:19 AM: ApplicationMinimized - EXIT 4:19 AM: ApplicationMinimized - ENTER 4:18 AM: ApplicationMinimized - EXIT 4:18 AM: ApplicationMinimized - ENTER 4:14 AM: ApplicationMinimized - EXIT 4:14 AM: ApplicationMinimized - ENTER 4:04 AM: ApplicationMinimized - EXIT 4:04 AM: ApplicationMinimized - ENTER Keylogger: Off E-mail Attachment: Off BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On 3:54 AM: ApplicationMinimized - EXIT 3:54 AM: ApplicationMinimized - ENTER Common Ad Sites: On Hosts File Shield: On Internet Communication Shield: On ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On File System Shield: On Execution Shield: On System Services Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 3:53 AM: Shield States 3:53 AM: License Check Status (0): Success 3:53 AM: Spyware Definitions: 1065 3:53 AM: Informational: Loaded AntiVirus Engine: 2.53.1; SDK Version: 4.25E; Virus Definitions: 1/9/2008 6:38:54 AM (GMT) 3:52 AM: Spy Sweeper 5.5.7.103 started 3:52 AM: Spy Sweeper 5.5.7.103 started 3:52 AM: | Start of Session, Sunday, January 13, 2008 | *************** |
|
|
|
|
01-13-2008, 01:02 PM
|
#37 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Again, I ask...did you uninstall ComboFix as instructed, using the /u command? Did a message box appear, saying ComboFix successfully uninstalled?
Edit: Quote:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 01-13-2008 at 01:03 PM. |
|
|
|
|
|
01-13-2008, 01:08 PM
|
#39 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,240
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Well, there's your answer. Perform all my instructions, then do things on your own, please.
If you uninstall ComboFix using the /u command as instructed, the finds in Qoobox and Deckard, as well as System Volume Information, will no longer be found by SpySweeper.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-13-2008, 02:03 PM
|
#40 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Sorry about that, thought I might need combofix to delete zip file on desktop. Combofix is uninstalled. Everything seems normal!!!
Couple of last questions, do you recommend installing XP Service Pack 2 and is the zone alarm fire wall good? I will review your earlier post regarding additional protection and utilities to prevent this from happening again. This will be my last post unless you can think of anything else. Although the overall experience has been bad, correcting the problem has been good and informative. Thank you for everthing and keep up the good work. |
|
|
|
| Thread Tools | |
|
|
