|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-11-2008, 07:28 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
search-daily hijack
I'm having the same issues as other posters regarding the search-daily.com hijack. Not sure if I could follow the other threads and work through it. Any help is greatly appreciated.
Thank you! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-11-2008, 11:48 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
As I originally posted, I'm having the same issues as other posters regarding the search-daily.com hijack (IE gets redirected). I am thankful for any help you can provide!
Step One: No obvious malware programs installed. Step Two: Panda Activescan site not responding. Step Three: Spyware Blaster installed. Step Four: Service Pack 1 installed. Step Five: Deckard's System Scanner v20071014.68 Run by Martin on 2008-01-12 00:17:49 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; System Restore is disabled (service is not running). Backed up registry hives. Performed disk cleanup. Total Physical Memory: 254 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-01-12 00:20:34 Platform: Windows XP Service Pack 1 (5.01.2600) MSIE: Internet Explorer (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\SYSTEM32\smss.exe C:\WINDOWS\SYSTEM32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\SYSTEM32\services.exe C:\WINDOWS\SYSTEM32\lsass.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\spoolsv.exe C:\WINDOWS\SYSTEM32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\SYSTEM32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\WINDOWS\SYSTEM32\alg.exe C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\wdfmgr.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\SYSTEM32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Documents and Settings\Martin\Desktop\dss.exe C:\Program Files\Webroot\Spy Sweeper\ssu.exe C:\WINDOWS\SYSTEM32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com O1 - Hosts: 192.168.200.3 ad.doubleclick.net O1 - Hosts: 192.168.200.3 ad.fastclick.net O1 - Hosts: 192.168.200.3 ads.fastclick.net O1 - Hosts: 192.168.200.3 ar.atwola.com O1 - Hosts: 192.168.200.3 atdmt.com O1 - Hosts: 192.168.200.3 avp.ch O1 - Hosts: 192.168.200.3 avp.com O1 - Hosts: 192.168.200.3 avp.ru O1 - Hosts: 192.168.200.3 awaps.net O1 - Hosts: 192.168.200.3 banner.fastclick.net O1 - Hosts: 192.168.200.3 banners.fastclick.net O1 - Hosts: 192.168.200.3 ca.com O1 - Hosts: 192.168.200.3 click.atdmt.com O1 - Hosts: 192.168.200.3 clicks.atdmt.com O1 - Hosts: 192.168.200.3 customer.symantec.com O1 - Hosts: 192.168.200.3 dispatch.mcafee.com O1 - Hosts: 192.168.200.3 download.mcafee.com O1 - Hosts: 192.168.200.3 download.microsoft.com O1 - Hosts: 192.168.200.3 downloads-us1.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads-us2.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads-us3.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads.microsoft.com O1 - Hosts: 192.168.200.3 downloads1.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads2.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads3.kaspersky-labs.com O1 - Hosts: 192.168.200.3 downloads4.kaspersky-labs.com O1 - Hosts: 192.168.200.3 engine.awaps.net O1 - Hosts: 192.168.200.3 f-secure.com O1 - Hosts: 192.168.200.3 fastclick.net O1 - Hosts: 192.168.200.3 ftp.avp.ch O1 - Hosts: 192.168.200.3 ftp.downloads1.kaspersky-labs.com O1 - Hosts: 192.168.200.3 ftp.downloads2.kaspersky-labs.com O1 - Hosts: 192.168.200.3 ftp.downloads3.kaspersky-labs.com O1 - Hosts: 192.168.200.3 ftp.f-secure.com O1 - Hosts: 192.168.200.3 ftp.kasperskylab.ru O1 - Hosts: 192.168.200.3 ftp.sophos.com O1 - Hosts: 192.168.200.3 go.microsoft.com O1 - Hosts: 192.168.200.3 ids.kaspersky-labs.com O1 - Hosts: 192.168.200.3 kaspersky-labs.com O1 - Hosts: 192.168.200.3 kaspersky.com O1 - Hosts: 192.168.200.3 liveupdate.symantec.com O1 - Hosts: 192.168.200.3 liveupdate.symantecliveupdate.com O1 - Hosts: 192.168.200.3 mast.mcafee.com O1 - Hosts: 192.168.200.3 mcafee.com O1 - Hosts: 192.168.200.3 media.fastclick.net O1 - Hosts: 192.168.200.3 microsoft.com O1 - Hosts: 192.168.200.3 msdn.microsoft.com O1 - Hosts: 192.168.200.3 my-etrust.com O1 - Hosts: 192.168.200.3 nai.com O1 - Hosts: 192.168.200.3 networkassociates.com O1 - Hosts: 192.168.200.3 norton.com O1 - Hosts: 192.168.200.3 office.microsoft.com O1 - Hosts: 192.168.200.3 pandasoftware.com O1 - Hosts: 192.168.200.3 phx.corporate-ir.net O1 - Hosts: 192.168.200.3 rads.mcafee.com O1 - Hosts: 192.168.200.3 secure.nai.com O1 - Hosts: 192.168.200.3 securityresponse.symantec.com O1 - Hosts: 192.168.200.3 service1.symantec.com O1 - Hosts: 192.168.200.3 sophos.com O1 - Hosts: 192.168.200.3 spd.atdmt.com O1 - Hosts: 192.168.200.3 support.microsoft.com O1 - Hosts: 192.168.200.3 symantec.com O1 - Hosts: 192.168.200.3 trendmicro.com O1 - Hosts: 192.168.200.3 update.symantec.com O1 - Hosts: 192.168.200.3 updates.symantec.com O1 - Hosts: 192.168.200.3 updates1.kaspersky-labs.com O1 - Hosts: 192.168.200.3 updates2.kaspersky-labs.com O1 - Hosts: 192.168.200.3 updates3.kaspersky-labs.com O1 - Hosts: 192.168.200.3 updates4.kaspersky-labs.com O1 - Hosts: 192.168.200.3 updates5.kaspersky-labs.com O1 - Hosts: 192.168.200.3 us.mcafee.com O1 - Hosts: 192.168.200.3 vil.nai.com O1 - Hosts: 192.168.200.3 viruslist.com O1 - Hosts: 192.168.200.3 viruslist.ru O1 - Hosts: 192.168.200.3 virusscan.jotti.org O1 - Hosts: 192.168.200.3 virustotal.com O1 - Hosts: 192.168.200.3 windowsupdate.microsoft.com O1 - Hosts: 192.168.200.3 www.avp.ch O1 - Hosts: 192.168.200.3 www.avp.com O1 - Hosts: 192.168.200.3 www.avp.ru O1 - Hosts: 192.168.200.3 www.awaps.net O1 - Hosts: 192.168.200.3 www.ca.com O1 - Hosts: 192.168.200.3 www.f-secure.com O1 - Hosts: 192.168.200.3 www.fastclick.net O1 - Hosts: 192.168.200.3 www.grisoft.com O1 - Hosts: 192.168.200.3 www.kaspersky-labs.com O1 - Hosts: 192.168.200.3 www.kaspersky.com O1 - Hosts: 192.168.200.3 www.kaspersky.ru O1 - Hosts: 192.168.200.3 www.mcafee.com O1 - Hosts: 192.168.200.3 www.microsoft.com O1 - Hosts: 192.168.200.3 www.my-etrust.com O1 - Hosts: 192.168.200.3 www.nai.com O1 - Hosts: 192.168.200.3 www.networkassociates.com O1 - Hosts: 192.168.200.3 www.pandasoftware.com O1 - Hosts: 192.168.200.3 www.sophos.com O1 - Hosts: 192.168.200.3 www.symantec.com O1 - Hosts: 192.168.200.3 www.symantec.com O1 - Hosts: 192.168.200.3 www.trendmicro.com O1 - Hosts: 192.168.200.3 www.viruslist.com O1 - Hosts: 192.168.200.3 www.viruslist.ru O1 - Hosts: 192.168.200.3 www.virustotal.com O1 - Hosts: 192.168.200.3 www3.ca.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) O2 - BHO: (no name) - {698C892E-002B-4145-A339-855013F4D471} - C:\WINDOWS\SYSTEM32\d3dx9_33i.dll O2 - BHO: (no name) - {A3416762-07B0-4E51-A763-36217BAF50F5} - C:\WINDOWS\SYSTEM32\authzd.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NAVSHEXT.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NAVSHEXT.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx O3 - Toolbar: (no name) - ID - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DwlClient] "C:\Program Files\Common Files\Dell\EUSW\Support.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] - O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - (file missing) O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - (file missing) O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX) - http://www.isqft.com/Applets/ScriptX/ScriptX.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26f46bca...p/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113627649515 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploa...loadClient.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file) O20 - Winlogon Notify: ytchvzmn - C:\WINDOWS\System32\authzd.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - - O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - - O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 14063 bytes -- File Associations ----------------------------------------------------------- .bat - batfile - shell\edit\command - unable to read value .cmd - cmdfile - shell\edit\command - unable to read value .inf - inffile - shell\open\command - unable to read value .ini - inifile - shell\open\command - unable to read value .reg - regfile - shell\edit\command - unable to read value .txt - txtfile - shell\open\command - unable to read value .vbs - VBSFile - shell\edit\command - unable to read value -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 bcifvlli - c:\windows\system32\drivers\ivdvymgf.dat R1 cdrbsvsd - c:\windows\system32\drivers\cdrbsvsd.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7> R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R2 A4SII300 - c:\windows\system32\drivers\a4sii300.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> S1 intelppm (Intel Processor Driver) - c:\windows\system32\drivers\intelppm.sys (file missing) S3 HTTP - c:\windows\system32\drivers\http.sys (file missing) S3 ip6fw (IPv6 Windows Firewall Driver) - c:\windows\system32\drivers\ip6fw.sys (file missing) S3 PCAMPR5 (PCAMPR5 NDIS Protocol Driver) - c:\windows\system32\pcampr5.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) S4 SAVRT - - (file missing) S4 SYMTDI - - (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S4 ccEvtMgr (Symantec Event Manager) - - (file missing) S4 SNDSrvc (Symantec Network Drivers Service) - - (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-01-11 00:28:54 466 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job 2008-01-11 00:23:25 432 --a------ C:\WINDOWS\Tasks\At1.job 2008-01-10 20:13:49 1500 --a------ C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job 2005-07-24 11:43:52 414 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job -- Files created between 2007-12-12 and 2008-01-12 ----------------------------- 2008-01-12 00:09:45 0 d-------- C:\Program Files\SpywareBlaster 2008-01-10 20:13:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-01-10 20:13:37 0 d-------- C:\Program Files\Webroot 2008-01-10 20:13:37 0 d-------- C:\Documents and Settings\Martin\Application Data\Webroot 2008-01-10 20:13:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-01-10 20:12:44 164 --a------ C:\install.dat 2008-01-09 21:46:38 0 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-09 21:46:21 11264 --a------ C:\WINDOWS\System32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> 2008-01-07 20:53:26 0 d-------- C:\Program Files\XoftSpySE 2008-01-06 19:04:20 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Identities 2008-01-06 14:59:44 246545 --a------ C:\WINDOWS\System32\libssl32.dll <Not Verified; OpenSSL <www.openssl.org>; OpenSSL> 2008-01-06 14:59:44 1188375 --a------ C:\WINDOWS\System32\libeay32.dll <Not Verified; OpenSSL <www.openssl.org>; OpenSSL> 2008-01-06 14:59:28 36608 --a------ C:\WINDOWS\System32\mwtmqymy.dat 2008-01-06 14:59:28 35072 --a------ C:\WINDOWS\System32\lvuqxizx.dat 2008-01-06 14:59:28 42240 --a------ C:\WINDOWS\System32\duaepeqa.dat 2008-01-06 14:59:28 741632 --a------ C:\WINDOWS\System32\dhesaybh.dat 2008-01-06 14:42:56 120576 --a------ C:\WINDOWS\System32\ygszobyi.dat 2008-01-06 14:35:48 19584 --a------ C:\WINDOWS\System32\drivers\ivdvymgf.dat 2008-01-06 14:33:26 0 d-------- C:\WINDOWS\System32\AppCert 2008-01-06 14:33:09 83968 --a------ C:\WINDOWS\System32\authzd.dll 2008-01-06 14:32:53 16384 --a------ C:\WINDOWS\System32\s6i5w1euqxsh.exe 2008-01-06 14:32:19 84992 --a------ C:\WINDOWS\System32\d3dx9_33i.dll -- Find3M Report --------------------------------------------------------------- 2008-01-11 00:16:51 0 d-------- C:\Program Files\Common Files 2008-01-10 23:59:32 0 d-------- C:\Program Files\Family Trees Quick & Easy 5 2008-01-09 21:48:15 4212 ---h----- C:\WINDOWS\System32\zllictbl.dat 2008-01-06 19:04:20 0 d-------- C:\Documents and Settings\Martin\Application Data\Identities 2007-12-23 23:38:23 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-11-16 22:04:38 0 d-------- C:\Documents and Settings\Martin\Application Data\Adobe 2007-11-14 00:38:29 0 d-------- C:\Program Files\TotalFax 7.0 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{698C892E-002B-4145-A339-855013F4D471}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3416762-07B0-4E51-A763-36217BAF50F5}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [04/07/2003 12:19 AM] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [04/07/2003 12:07 AM] "BCMSMMSG"="BCMSMMSG.exe" [06/02/2003 05:00 AM C:\WINDOWS\BCMSMMSG.exe] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [08/13/2003 10:27 AM] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [08/26/2003 07:47 PM] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [04/03/2002 01:01 AM] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [05/11/2000 01:00 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [06/29/2007 05:24 AM] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [10/07/2003 04:21 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [08/25/2004 11:11 PM] "ccApp"="-" [] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [08/19/2002 09:23 PM] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [06/25/2006 02:02 PM] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [11/02/2004 03:59 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [09/07/2007 03:55 PM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [11/14/2007 04:05 PM] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [10/01/2007 04:40 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] C:\Documents and Settings\Martin\Start Menu\Programs\Startup\ DESKTOP.INI [9/3/2002 9:00:00 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [9/3/2002 9:00:00 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ytchvzmn] authzd.dll 03/02/2005 12:20 PM 83968 C:\WINDOWS\SYSTEM32\authzd.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Notification Packages"= :\WINDOW [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs pspuqclm -- Hosts ----------------------------------------------------------------------- 192.168.200.3 ad.doubleclick.net 192.168.200.3 ad.fastclick.net 192.168.200.3 ads.fastclick.net 192.168.200.3 ar.atwola.com 192.168.200.3 atdmt.com 192.168.200.3 avp.ch 192.168.200.3 avp.com 192.168.200.3 avp.ru 192.168.200.3 awaps.net 192.168.200.3 banner.fastclick.net 92 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-01-12 00:23:26 ------------ |
|
|
|
|
01-12-2008, 02:03 PM
|
#4 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
In my earlier post I was unable to access the ActiveScan site. I have since gained access. Below is the report from ActiveScan. Please help!
Incident Status Location Virus:Trj/Downloader.RDL Disinfected Operating system Potentially unwanted tool:application/altnet Not disinfected c:\windows\smdat32a.sys Potentially unwanted tool:application/bestoffer Not disinfected c:\windows\smdat32m.sys Potentially unwanted tool:application/need2find Not disinfected c:\program files\Need2Find Adware:adware/cydoor Not disinfected c:\windows\cdmxtras Adware:adware/rxtoolbar Not disinfected Windows Registry Potentially unwanted tool:Application/SpyDawn Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\av18EE.exe[SpyDawn.exe] Spyware:Cookie/Ccbill Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\Cookies\martin@ccbill[2].txt Potentially unwanted tool:Application/SpyDawn Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\laf18ED.tmp Potentially unwanted tool:Application/P2PNetworking Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\p2psetup.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\All Users\Application Data\SecTaskMan\arpl.exe.q_8042200_q Virus:Trj/Downloader.MDW Disinfected C:\Documents and Settings\All Users\Application Data\SecTaskMan\hrum135.txt.q_8041800_q Virus:Trj/Downloader.MDW Disinfected C:\Documents and Settings\All Users\Application Data\SecTaskMan\hrum135.txt.q_8041800_q.old Adware:Adware/WinAntiVirus2007 Not disinfected C:\Documents and Settings\All Users\Application Data\SecTaskMan\printer.exe.q_8043A00_q Adware:Adware/WinAntiVirus2007 Not disinfected C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8043A00_q Virus:Trj/Downloader.OTR Disinfected C:\Documents and Settings\Martin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\java.class-42ed57a3-192a7163.class Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Martin\Cookies\martin@com[1].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Martin\Desktop\ComboFix.exe[nircmd.com] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Martin\Desktop\ComboFix.exe[nircmd.cfexe] Adware:Adware/Lop Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Bpk.dll.131 Adware:Adware/IST Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.048 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\FavoriteLinks.dll.066 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\FreeSamples.dll.041 Adware:Adware/IST Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Music.dll.023 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Network.dll.062 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\System.dll.088 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Update.dll.066 Adware:Adware/IST Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.074 Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.044 Possible Virus. Not disinfected C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\Setup.exe Virus:Trj/Downloader.MDW Disinfected C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\append.dll.vir Virus:Trj/Downloader.AEU Disinfected C:\WINDOWS\Downloaded Program Files\ied.inf Virus:Trj/Downloader.AIB Disinfected C:\WINDOWS\Downloaded Program Files\start80.inf Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe Virus:Trj/Downloader.RDL Disinfected C:\WINDOWS\SYSTEM32\AppCert\wnl32.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\SYSTEM32\arpl.exe Adware:Adware/Adtomi Not disinfected C:\WINDOWS\SYSTEM32\cvz1.dll Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\SYSTEM32\hrum135.txt Adware:Adware/WinAntiVirus2007 Not disinfected C:\WINDOWS\SYSTEM32\vtr135.dll |
|
|
|
|
01-12-2008, 07:30 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Run DSS again, using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /daft Click on Scan. Tick the boxes which should appear for these entries: .bat - batfile - shell\edit\command - unable to read value .cmd - cmdfile - shell\edit\command - unable to read value .inf - inffile - shell\open\command - unable to read value .ini - inifile - shell\open\command - unable to read value .reg - regfile - shell\edit\command - unable to read value .txt - txtfile - shell\open\command - unable to read value .vbs - VBSFile - shell\edit\command - unable to read value then Click on Fix Click Scan again, you should get a message "All Associations OK!" Next, click Save Log, and post this log in your next reply. ----------------------------------------------- Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 07:31 PM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Please refresh the page, and look above. You were here very quickly, and I've changed my instructions.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 08:08 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Thank you for your help!
When I ran the DSS scan the following entry also appeared. Should I scan again and fix this also? DAFT Log saved on 2008-01-12 21:04:06 ----------------------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* |
|
|
|
|
01-12-2008, 08:09 PM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Hi, no that should be default value for XP SP1
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 08:37 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Nothing unusual accept when running combofix norton antivirus tried to block the script. Hope this does not create problems.
Thank you! DAFT Log saved on 2008-01-12 21:04:06 ----------------------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* ********************************************************* ComboFix 08-01-13.1 - Martin 2008-01-12 21:14:08.3 - NTFSx86 Running from: C:\Documents and Settings\Martin\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))) . 2008-01-12 13:57 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS 2008-01-12 13:33 . 2008-01-12 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2008-01-12 13:33 . 2008-01-12 13:33 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2008-01-12 13:33 . 2008-01-12 13:33 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2008-01-12 13:33 . 2008-01-12 13:33 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2008-01-12 12:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 00:17 . 2008-01-12 00:17 <DIR> d-------- C:\Deckard 2008-01-12 00:09 . 2008-01-12 00:12 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-12 00:09 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-01-10 20:40 . 2008-01-10 20:40 <DIR> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Program Files\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-01-10 20:13 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll 2008-01-10 20:13 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys 2008-01-10 20:13 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys 2008-01-10 20:13 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys 2008-01-10 20:13 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys 2008-01-10 20:12 . 2008-01-10 20:27 164 --a------ C:\install.dat 2008-01-09 21:46 . 2008-01-09 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-09 21:46 . 2007-11-14 16:05 1,086,952 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll 2008-01-09 21:46 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-01-09 21:46 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2008-01-07 20:53 . 2008-01-07 20:59 <DIR> d-------- C:\Program Files\XoftSpySE 2008-01-06 14:59 . 2008-01-06 14:59 1,188,375 --a------ C:\WINDOWS\SYSTEM32\libeay32.dll 2008-01-06 14:59 . 2008-01-06 14:59 741,632 --a------ C:\WINDOWS\SYSTEM32\dhesaybh.dat 2008-01-06 14:59 . 2008-01-06 14:59 246,545 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll 2008-01-06 14:59 . 2008-01-06 14:59 42,240 --a------ C:\WINDOWS\SYSTEM32\duaepeqa.dat 2008-01-06 14:59 . 2008-01-11 21:49 36,608 --a------ C:\WINDOWS\SYSTEM32\mwtmqymy.dat 2008-01-06 14:59 . 2008-01-06 14:59 35,072 --a------ C:\WINDOWS\SYSTEM32\lvuqxizx.dat 2008-01-06 14:42 . 2008-01-06 14:42 120,576 --a------ C:\WINDOWS\SYSTEM32\ygszobyi.dat 2008-01-06 14:33 . 2008-01-12 15:49 <DIR> d-------- C:\WINDOWS\SYSTEM32\AppCert 2008-01-06 14:32 . 2004-09-07 11:55 16,384 --a------ C:\WINDOWS\SYSTEM32\s6i5w1euqxsh.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-12 20:32 --------- d-----w C:\Program Files\Norton AntiVirus 2008-01-12 20:26 --------- d-----w C:\Program Files\iTunes 2008-01-12 20:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-01-11 05:59 --------- d-----w C:\Program Files\Family Trees Quick & Easy 5 2007-12-24 05:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-12-01 18:51 20,748,502 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-11-14 06:38 --------- d-----w C:\Program Files\TotalFax 7.0 2007-11-07 04:40 724,984 ----a-w C:\Documents and Settings\Martin\gotomypc_437.exe 2005-08-25 21:14 2,819,072 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2005-08-25 20:49 1,392,640 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2005-02-22 23:00 3,023,872 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2005-02-22 22:59 1,933,312 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2005-01-28 09:28 1,930,240 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2005-01-18 04:40 1,925,120 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2004-11-05 23:50 1,338,880 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2004-03-16 01:39 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2004-03-16 01:39 1,019,904 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2005-07-24 17:22 32 --sha-w C:\WINDOWS\{3E6F4D71-DAD8-40A3-A03E-6BAE2FEC7583}.dat 2005-07-24 17:22 32 --sha-w C:\WINDOWS\SYSTEM32\{9D957D8C-3407-47AA-AA06-4EC784B82DB4}.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07 114688] "BCMSMMSG"="BCMSMMSG.exe" [2003-06-02 05:00 122880 C:\WINDOWS\BCMSMMSG.exe] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27 28672] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47 204800] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 01:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-10-07 16:21 294912] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-25 23:11 180269] "ccApp"="-" [] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 21:23 34504] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-25 14:02 100056] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 15:59 218240] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 15:55 267064] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40 5367608] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ :\WINDOW R2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS [1998-02-26 14:10] . Contents of the 'Scheduled Tasks' folder "2008-01-11 06:28:54 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job" - C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca "2005-07-24 17:43:52 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE "2008-01-11 02:13:49 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-12 21:17:54 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-12 21:18:44 ComboFix-quarantined-files.txt 2008-01-13 03:18:41 ComboFix2.txt 2008-01-13 02:43:32 ********************************************************* Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:29:38 PM, on 1/12/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DwlClient] "C:\Program Files\Common Files\Dell\EUSW\Support.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] - O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.isqft.com/Applets/ScriptX/ScriptX.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26f46bca...p/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113627649515 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploa...loadClient.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 7253 bytes |
|
|
|
|
01-12-2008, 08:50 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Did you create the NTFS4FreeDos bootable CD?
Please go to: VirusTotal
Please be sure to label each report when you post them, so I know which is which.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 09:00 PM
|
#11 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Also, please go to Start > Run and copy/paste then following, then press Enter:
C:\Qoobox\ComboFix2.txt A notepad file will open. Post the contents of that file in reply.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 09:05 PM
|
#12 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
[quote=tetonbob;1263562]Did you create the NTFS4FreeDos bootable CD?
NTFS4FreeDos - Was that the console recovery? If so, no! Should I go back and do this? Thank you! |
|
|
|
|
01-12-2008, 09:10 PM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
It was part of the initial instructions. As I stated at the outset, it's very important that you follow each step accurately and completely.
If you don't have a Windows XP CD, yes, download and burn to disk the NTFS4FreeDOS using the instructions on this page: http://www.bleepingcomputer.com/comb...o-use-combofix If you have a Windows XP CD, then install the Recovery Console, also using the instructions on that page. Let me know when you've done this, and be sure to also post the requested information from my last two posts.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 09:45 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Alright, Recovery Console is now installed (from XP disk), below are the three files scanned at Virustotal and the combofix log.
Again, Thank you!!! File s6i5w1euqxsh.exe received on 12.21.2007 11:50:32 (CET)Antivirus Version Last Update Result AhnLab-V3 - - - AntiVir - - TR/Crypt.Morphine.Gen Authentium - - - Avast - - - AVG - - Generic9.ABFU BitDefender - - - CAT-QuickHeal - - (Suspicious) - DNAScan ClamAV - - Trojan.Small-4481 DrWeb - - - eSafe - - Suspicious File eTrust-Vet - - - Ewido - - - FileAdvisor - - Low threat detected Fortinet - - - F-Prot - - W32/Heuristic-114!Eldorado F-Secure - - - Ikarus - - - Kaspersky - - Backdoor.Win32.Agent.djt McAfee - - New Malware.bl Microsoft - - VirTool:Win32/Obfuscator.Q NOD32v2 - - a variant of Win32/Small.BB Norman - - - Panda - - Suspicious file Prevx1 - - BHO.BLR Rising - - - Sophos - - - Sunbelt - - - Symantec - - - TheHacker - - - VBA32 - - - VirusBuster - - - Webwasher-Gateway - - Trojan.Crypt.Morphine.Gen Additional information MD5: 5c492c590f41ca6706bb50b1b0eeef0a SHA1: 0964e2a764c579d68133c800e6f96347b46979ed SHA256: 9df912eed3f742fe876c4714cb905f01419c9e0b6f8223b41de1ef0669d0f8fc SHA512: 85f9e6f7dda8f0d240d5a7ca350791f2410e0682876efc17e7c6bc7580da7c53 e2f6e8113d905d9f95176d2c9fc274415b89f072caf63449edcd512782fb83c0 ***************************************************************** File lvuqxizx.dat received on 01.13.2008 05:13:29 (CET)Antivirus Version Last Update Result AhnLab-V3 2008.1.12.10 2008.01.11 - AntiVir 7.6.0.46 2008.01.11 - Authentium 4.93.8 2008.01.12 - Avast 4.7.1098.0 2008.01.12 - AVG 7.5.0.516 2008.01.12 - BitDefender 7.2 2008.01.13 - CAT-QuickHeal 9.00 2008.01.12 - ClamAV 0.91.2 2008.01.13 - DrWeb 4.44.0.09170 2008.01.12 - eSafe 7.0.15.0 2008.01.10 - eTrust-Vet 31.3.5451 2008.01.11 - Ewido 4.0 2008.01.12 - FileAdvisor 1 2008.01.13 - Fortinet 3.14.0.0 2008.01.13 - F-Prot 4.4.2.54 2008.01.13 - F-Secure 6.70.13030.0 2008.01.12 - Ikarus T3.1.1.20 2008.01.13 - Kaspersky 7.0.0.125 2008.01.13 - McAfee 5205 2008.01.11 - Microsoft 1.3109 2008.01.13 - NOD32v2 2787 2008.01.13 - Norman 5.80.02 2008.01.11 - Panda 9.0.0.4 2008.01.12 - Prevx1 V2 2008.01.13 - Rising 20.26.60.00 2008.01.13 - Sophos 4.24.0 2008.01.13 - Sunbelt 2.2.907.0 2008.01.12 - Symantec 10 2008.01.12 - TheHacker 6.2.9.186 2008.01.11 - VBA32 3.12.2.5 2008.01.13 - VirusBuster 4.3.26:9 2008.01.12 - Webwasher-Gateway 6.6.2 2008.01.13 - Additional information File size: 35072 bytes MD5: 801364191160beb952e56a522f22b83e SHA1: 7c0c8e3e8cf3632f9aaca4156da5e7e966fc4ec0 PEiD: - ******************************************************* File ygszobyi.dat received on 01.13.2008 05:20:36 (CET)Antivirus Version Last Update Result AhnLab-V3 2008.1.12.10 2008.01.11 - AntiVir 7.6.0.46 2008.01.11 - Authentium 4.93.8 2008.01.12 - Avast 4.7.1098.0 2008.01.12 - AVG 7.5.0.516 2008.01.12 - BitDefender 7.2 2008.01.13 - CAT-QuickHeal 9.00 2008.01.12 - ClamAV 0.91.2 2008.01.13 - DrWeb 4.44.0.09170 2008.01.12 - eSafe 7.0.15.0 2008.01.10 - eTrust-Vet 31.3.5451 2008.01.11 - Ewido 4.0 2008.01.12 - FileAdvisor 1 2008.01.13 - Fortinet 3.14.0.0 2008.01.13 - F-Prot 4.4.2.54 2008.01.13 - F-Secure 6.70.13030.0 2008.01.12 - Ikarus T3.1.1.20 2008.01.13 - Kaspersky 7.0.0.125 2008.01.13 - McAfee 5205 2008.01.11 - Microsoft 1.3109 2008.01.13 - NOD32v2 2787 2008.01.13 - Norman 5.80.02 2008.01.11 - Panda 9.0.0.4 2008.01.12 - Prevx1 V2 2008.01.13 - Rising 20.26.60.00 2008.01.13 - Sophos 4.24.0 2008.01.13 - Sunbelt 2.2.907.0 2008.01.12 - Symantec 10 2008.01.12 - TheHacker 6.2.9.186 2008.01.11 - VBA32 3.12.2.5 2008.01.13 - VirusBuster 4.3.26:9 2008.01.12 - Webwasher-Gateway 6.6.2 2008.01.13 - Additional information File size: 120576 bytes MD5: c9c0603a8934264b96156875aae0646e SHA1: 785c981ecdd7c0b104b2597f8f9977e2335efd56 PEiD: - ********************************************************* ComboFix 08-01-13.1 - Martin 2008-01-12 20:40:57.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.93 [GMT -6:00] Running from: C:\Documents and Settings\Martin\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))) . 2008-01-12 13:57 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS 2008-01-12 13:33 . 2008-01-12 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2008-01-12 13:33 . 2008-01-12 13:33 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2008-01-12 13:33 . 2008-01-12 13:33 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2008-01-12 13:33 . 2008-01-12 13:33 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2008-01-12 12:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 00:17 . 2008-01-12 00:17 <DIR> d-------- C:\Deckard 2008-01-12 00:09 . 2008-01-12 00:12 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-12 00:09 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-01-10 20:40 . 2008-01-10 20:40 <DIR> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Program Files\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-01-10 20:13 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll 2008-01-10 20:13 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys 2008-01-10 20:13 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys 2008-01-10 20:13 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys 2008-01-10 20:13 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys 2008-01-10 20:12 . 2008-01-10 20:27 164 --a------ C:\install.dat 2008-01-09 21:46 . 2008-01-09 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-09 21:46 . 2007-11-14 16:05 1,086,952 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll 2008-01-09 21:46 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-01-09 21:46 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2008-01-07 20:53 . 2008-01-07 20:59 <DIR> d-------- C:\Program Files\XoftSpySE 2008-01-06 14:59 . 2008-01-06 14:59 1,188,375 --a------ C:\WINDOWS\SYSTEM32\libeay32.dll 2008-01-06 14:59 . 2008-01-06 14:59 741,632 --a------ C:\WINDOWS\SYSTEM32\dhesaybh.dat 2008-01-06 14:59 . 2008-01-06 14:59 246,545 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll 2008-01-06 14:59 . 2008-01-06 14:59 42,240 --a------ C:\WINDOWS\SYSTEM32\duaepeqa.dat 2008-01-06 14:59 . 2008-01-11 21:49 36,608 --a------ C:\WINDOWS\SYSTEM32\mwtmqymy.dat 2008-01-06 14:59 . 2008-01-06 14:59 35,072 --a------ C:\WINDOWS\SYSTEM32\lvuqxizx.dat 2008-01-06 14:42 . 2008-01-06 14:42 120,576 --a------ C:\WINDOWS\SYSTEM32\ygszobyi.dat 2008-01-06 14:33 . 2008-01-12 15:49 <DIR> d-------- C:\WINDOWS\SYSTEM32\AppCert 2008-01-06 14:32 . 2004-09-07 11:55 16,384 --a------ C:\WINDOWS\SYSTEM32\s6i5w1euqxsh.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-12 20:32 --------- d-----w C:\Program Files\Norton AntiVirus 2008-01-12 20:26 --------- d-----w C:\Program Files\iTunes 2008-01-12 20:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-01-11 05:59 --------- d-----w C:\Program Files\Family Trees Quick & Easy 5 2007-12-24 05:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-12-01 18:51 20,748,502 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-11-14 06:38 --------- d-----w C:\Program Files\TotalFax 7.0 2007-11-07 04:40 724,984 ----a-w C:\Documents and Settings\Martin\gotomypc_437.exe 2005-08-25 21:14 2,819,072 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2005-08-25 20:49 1,392,640 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2005-02-22 23:00 3,023,872 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2005-02-22 22:59 1,933,312 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2005-01-28 09:28 1,930,240 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2005-01-18 04:40 1,925,120 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2004-11-05 23:50 1,338,880 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2004-03-16 01:39 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2004-03-16 01:39 1,019,904 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2005-07-24 17:22 32 --sha-w C:\WINDOWS\{3E6F4D71-DAD8-40A3-A03E-6BAE2FEC7583}.dat 2005-07-24 17:22 32 --sha-w C:\WINDOWS\SYSTEM32\{9D957D8C-3407-47AA-AA06-4EC784B82DB4}.dat . ((((((((((((((((((((((((((((( snapshot@2008-01-12_12.19.12.56 ))))))))))))))))))))))))))))))))))))))))) . + 2006-08-24 14:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll - 2008-01-12 18:09:34 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-13 02:40:47 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-12 18:09:34 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-12 18:09:34 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-13 02:40:47 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-12 18:09:34 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-12 18:09:34 4,354,048 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat + 2008-01-13 02:40:47 4,390,912 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat - 2008-01-12 18:09:34 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-13 02:40:47 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2007-03-29 15:20:50 110,592 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll + 2006-10-05 22:15:26 233,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll + 2005-06-03 20:03:18 96,256 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll + 2003-08-01 17:00:16 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll + 2005-05-20 19:42:44 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll + 2007-11-12 15:46:18 26,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\JID.dll + 2006-02-17 00:20:20 4,608 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll + 2005-10-26 00:08:32 348,160 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll + 2007-11-26 17:10:36 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\NanoWrapper.dll + 2004-05-04 21:01:02 139,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll + 2006-07-14 19:04:10 45,056 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe + 2006-04-10 16:50:02 159,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll + 2006-02-14 19:05:38 94,208 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll + 2006-02-17 00:35:38 180,224 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll + 2006-10-05 22:15:38 122,880 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll + 2007-06-04 17:31:52 57,344 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavsddl.dll + 2006-06-30 20:13:38 8,704 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe + 2004-02-04 20:08:42 49,152 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll + 2007-10-30 16:04:14 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\Prescan.dll + 2006-08-01 19:23:10 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll + 2007-11-21 16:00:06 376,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll + 2007-10-31 19:05:06 32,768 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\PSKAHKPRESCAN.dll + 2006-08-17 17:38:14 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll + 2006-09-04 17:49:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll + 2006-08-18 14:46:18 779,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskavs.dll + 2007-03-26 20:25:34 417,792 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll + 2006-08-09 16:42:24 90,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll + 2006-07-19 16:55:58 208,896 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll + 2006-01-20 22:57:00 9,728 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll + 2006-05-17 15:50:12 14,336 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll + 2006-08-16 16:58:12 33,280 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll + 2006-06-30 20:42:36 266,240 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll + 2006-08-17 20:33:14 62,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll + 2006-08-08 19:13:10 13,312 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll + 2006-08-18 14:53:08 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll + 2006-08-18 14:49:50 167,936 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll + 2007-10-18 15:30:16 105,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnahk.dll + 2007-11-23 20:29:08 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psndsk.dll + 2007-10-18 15:30:38 42,496 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnflg.dll + 2007-10-30 17:19:22 98,304 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnglknt.dll + 2007-08-22 14:52:00 20,272 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnhsh.dll + 2007-11-12 21:49:34 11,776 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnjidsign.dll + 2007-08-22 14:52:04 76,080 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnkrnl.dll + 2007-08-22 14:52:06 21,296 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnmem.dll + 2007-10-04 21:26:28 28,672 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\PsnPen.dll + 2007-10-23 17:40:10 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psntuc.dll + 2007-05-24 17:27:36 27,136 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\PSNXprs.dll + 2007-04-18 23:16:04 353,840 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll + 2007-01-22 20:42:48 35,328 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll + 2007-06-08 15:44:36 8,576 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\RKPavProc.sys + 2007-06-05 16:56:40 44,928 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sdthook.sys + 1997-09-18 12:12:32 9,488 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll + 2006-02-28 23:23:40 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll + 2007-09-17 15:14:08 126,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\Tucan.dll + 2006-08-02 18:39:06 73,728 ----a-w C:\WINDOWS\SYSTEM32\asuninst.exe - 2005-01-28 20:38:00 421,128 ----a-w C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL + 2007-10-11 20:12:48 1,468,968 ----a-w C:\WINDOWS\SYSTEM32\LegitCheckControl.dll - 2005-10-12 23:12:25 14,048 ------w C:\WINDOWS\SYSTEM32\spmsg.dll + 2007-10-08 20:46:18 14,640 ------w C:\WINDOWS\SYSTEM32\spmsg.dll + 2003-03-26 00:53:50 11,776 ----a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07 114688] "BCMSMMSG"="BCMSMMSG.exe" [2003-06-02 05:00 122880 C:\WINDOWS\BCMSMMSG.exe] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27 28672] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47 204800] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 01:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-10-07 16:21 294912] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-25 23:11 180269] "ccApp"="-" [] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 21:23 34504] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-25 14:02 100056] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 15:59 218240] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 15:55 267064] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40 5367608] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ :\WINDOW R2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS [1998-02-26 14:10] . Contents of the 'Scheduled Tasks' folder "2008-01-11 06:28:54 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job" - C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca "2005-07-24 17:43:52 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE "2008-01-11 02:13:49 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-12 20:42:45 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-12 20:43:31 ComboFix-quarantined-files.txt 2008-01-13 02:43:09 |
|
|
|
|
01-12-2008, 09:56 PM
|
#15 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Great, thanks.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
01-12-2008, 10:53 PM
|
#16 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 23
OS: XP Home Edition 2002 service pack 1
|
Re: search-daily hijack
Problem: When Combofix finished, the browser opened but I could not regain the internet conection without rebooting. I have the file to be submitted for analysis but not sure where to send it.
Below is the combofix log. ComboFix 08-01-13.1 - Martin 2008-01-12 23:10:44.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.54 [GMT -6:00] Running from: C:\Documents and Settings\Martin\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Martin\Desktop\CFScript.txt * Created a new restore point FILE C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\av18EE.exe C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\laf18ED.tmp C:\Deckard\System Scanner\backup\DOCUME~1\Martin\LOCALS~1\Temp\p2psetup.exe C:\Documents and Settings\All Users\Application Data\SecTaskMan\arpl.exe.q_8042200_q C:\Documents and Settings\All Users\Application Data\SecTaskMan\printer.exe.q_8043A00_q C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8043A00_q C:\Program Files\Common Files\Totem Shared\Update\Bpk.dll.131 C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.048 C:\Program Files\Common Files\Totem Shared\Update\FavoriteLinks.dll.066 C:\Program Files\Common Files\Totem Shared\Update\FreeSamples.dll.041 C:\Program Files\Common Files\Totem Shared\Update\Music.dll.023 C:\Program Files\Common Files\Totem Shared\Update\Network.dll.062 C:\Program Files\Common Files\Totem Shared\Update\System.dll.088 C:\Program Files\Common Files\Totem Shared\Update\Update.dll.066 C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.074 C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.044 C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\Setup.exe c:\windows\smdat32a.sys c:\windows\smdat32m.sys C:\WINDOWS\SYSTEM32\arpl.exe C:\WINDOWS\SYSTEM32\cvz1.dll C:\WINDOWS\SYSTEM32\vtr135.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\SecTaskMan\arpl.exe.q_8042200_q C:\Documents and Settings\All Users\Application Data\SecTaskMan\printer.exe.q_8043A00_q C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8043A00_q C:\Program Files\Common Files\Totem Shared\Update\Bpk.dll.131 C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.048 C:\Program Files\Common Files\Totem Shared\Update\FavoriteLinks.dll.066 C:\Program Files\Common Files\Totem Shared\Update\FreeSamples.dll.041 C:\Program Files\Common Files\Totem Shared\Update\Music.dll.023 C:\Program Files\Common Files\Totem Shared\Update\Network.dll.062 C:\Program Files\Common Files\Totem Shared\Update\System.dll.088 C:\Program Files\Common Files\Totem Shared\Update\Update.dll.066 C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.074 C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.044 C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\Setup.exe c:\program files\Need2Find c:\program files\Need2Find\bar\History\search c:\windows\cdmxtras c:\windows\cdmxtras\uninst.exe c:\windows\smdat32a.sys c:\windows\smdat32m.sys C:\WINDOWS\SYSTEM32\arpl.exe C:\WINDOWS\SYSTEM32\cvz1.dll C:\WINDOWS\SYSTEM32\s6i5w1euqxsh.exe C:\WINDOWS\SYSTEM32\vtr135.dll . ((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))) . 2008-01-12 22:40 . 2003-07-16 14:44 245,920 -r-hs---- C:\cmldr 2008-01-12 22:40 . 2007-01-15 19:57 211 -rahs---- C:\BOOT.BAK 2008-01-12 21:29 . 2008-01-12 21:29 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-12 13:57 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SDTHOOK.SYS 2008-01-12 13:33 . 2008-01-12 14:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2008-01-12 13:33 . 2008-01-12 13:33 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2008-01-12 13:33 . 2008-01-12 13:33 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2008-01-12 13:33 . 2008-01-12 13:33 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2008-01-12 12:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 00:17 . 2008-01-12 00:17 <DIR> d-------- C:\Deckard 2008-01-12 00:09 . 2008-01-12 00:12 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-12 00:09 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-01-10 20:40 . 2008-01-10 20:40 <DIR> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Program Files\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-01-10 20:13 . 2008-01-10 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-01-10 20:13 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll 2008-01-10 20:13 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys 2008-01-10 20:13 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys 2008-01-10 20:13 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys 2008-01-10 20:13 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys 2008-01-10 20:12 . 2008-01-10 20:27 164 --a------ C:\install.dat 2008-01-09 21:46 . 2008-01-09 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-09 21:46 . 2007-11-14 16:05 1,086,952 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll 2008-01-09 21:46 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-01-09 21:46 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2008-01-07 20:53 . 2008-01-07 20:59 <DIR> d-------- C:\Program Files\XoftSpySE 2008-01-06 14:59 . 2008-01-06 14:59 1,188,375 --a------ C:\WINDOWS\SYSTEM32\libeay32.dll 2008-01-06 14:59 . 2008-01-06 14:59 741,632 --a------ C:\WINDOWS\SYSTEM32\dhesaybh.dat 2008-01-06 14:59 . 2008-01-06 14:59 246,545 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll 2008-01-06 14:59 . 2008-01-06 14:59 42,240 --a------ C:\WINDOWS\SYSTEM32\duaepeqa.dat 2008-01-06 14:59 . 2008-01-11 21:49 36,608 --a------ C:\WINDOWS\SYSTEM32\mwtmqymy.dat 2008-01-06 14:59 . 2008-01-06 14:59 35,072 --a------ C:\WINDOWS\SYSTEM32\lvuqxizx.dat 2008-01-06 14:42 . 2008-01-06 14:42 120,576 --a------ C:\WINDOWS\SYSTEM32\ygszobyi.dat 2008-01-06 14:33 . 2008-01-12 15:49 <DIR> d-------- C:\WINDOWS\SYSTEM32\AppCert . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-13 05:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-01-12 20:32 --------- d-----w C:\Program Files\Norton AntiVirus 2008-01-12 20:26 --------- d-----w C:\Program Files\iTunes 2008-01-11 05:59 --------- d-----w C:\Program Files\Family Trees Quick & Easy 5 2007-12-24 05:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-12-01 18:51 20,748,502 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-11-14 06:38 --------- d-----w C:\Program Files\TotalFax 7.0 2007-11-07 04:40 724,984 ----a-w C:\Documents and Settings\Martin\gotomypc_437.exe 2005-08-25 21:14 2,819,072 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2005-08-25 20:49 1,392,640 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2005-02-22 23:00 3,023,872 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2005-02-22 22:59 1,933,312 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2005-01-28 09:28 1,930,240 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2005-01-18 04:40 1,925,120 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2004-11-05 23:50 1,338,880 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2004-03-16 01:39 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2004-03-16 01:39 1,019,904 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2005-07-24 17:22 32 --sha-w C:\WINDOWS\{3E6F4D71-DAD8-40A3-A03E-6BAE2FEC7583}.dat 2005-07-24 17:22 32 --sha-w C:\WINDOWS\SYSTEM32\{9D957D8C-3407-47AA-AA06-4EC784B82DB4}.dat . ((((((((((((((((((((((((((((( snapshot_2008-01-12_20.42.54.39 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-13 02:40:47 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-13 05:09:56 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-13 05:09:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-13 02:40:47 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-13 05:09:56 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-13 02:40:47 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-13 05:09:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-13 02:40:47 4,390,912 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat + 2008-01-13 05:09:56 4,395,008 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat - 2008-01-13 02:40:47 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-13 05:09:56 12,288 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2001-07-14 23:32:24 69,632 ----a-w C:\WINDOWS\setupupd\temp\wsdueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07 114688] "BCMSMMSG"="BCMSMMSG.exe" [2003-06-02 05:00 122880 C:\WINDOWS\BCMSMMSG.exe] "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2003-08-13 10:27 28672] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 19:47 204800] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 01:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720] "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-10-07 16:21 294912] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-08-25 23:11 180269] "ccApp"="-" [] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 21:23 34504] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-25 14:02 100056] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 15:59 218240] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 15:55 267064] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40 5367608] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ :\WINDOW R2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS [1998-02-26 14:10] . Contents of the 'Scheduled Tasks' folder "2008-01-11 06:28:54 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job" - C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca "2005-07-24 17:43:52 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE "2008-01-11 02:13:49 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-12 23:15:00 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-12 23:16:17 ComboFix-quarantined-files.txt 2008-01-13 05:16:13 ComboFix2.txt 2008-01-13 03:18:45 ComboFix3.txt 2008-01-13 02:43:32 |
|
|
|
|
01-12-2008, 11:10 PM
|
#17 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Hi -
Please upload the file to this site: http://www.bleepingcomputer.com/subm....php?channel=4 Include a link to this topic. Or, on your desktop, there should be a file, CF-Submit.htm Looks like your default browser icon. Doubleclick on it, it will open in your default browser. The upload instructions will be on that page.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 11:15 PM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Also, please take a peek in this folder. DO NOT click on anything in it, if there is anything. Just tell me file names.
C:\WINDOWS\SYSTEM32\AppCert
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-12-2008, 11:23 PM
|
#20 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,150
OS: 2000 Pro; XP Pro; XP Home
|
Re: search-daily hijack
Thanks.
Please see post #18.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
