Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Constant Popups - Virus's Found
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 01-16-2008, 10:16 AM   #1 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Question Constant Popups - Virus's Found
Hi,

I have been getting constant popups when in Internet Explorer for a couple of months now. The other day my Avast Anti Virus detected a virus, then 2 more. It moved them to the chest, but I am still getting loads of popups.

The virus's it found were:

Win32:Agent-OXW [Trj] - It found this one 12 times!!

Win32:CTX - Found once

JS:ClassLoader-7 - Found once

I have followed your 5 Steps, and Windows is up to date etc.

II previously ran Spybot Search and Destroy as well as Ad Aware and BHO Demon before finding this forum.

Also, every now and then the icons on the desktop and the taskbar dissapears leaving just the background picture, then returns after a few seconds?

Hope this is enough information.

Here is my Hijack This Log:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:23, on 16/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyeBay
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cc45ab6d] rundll32.exe "C:\WINDOWS\System32\pqoywgbp.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://roylinedirect.rbos.co.uk
O15 - Trusted Zone: http://roylinedirect.rbs.co.uk
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5226 bytes




Thank you
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 01-20-2008, 03:40 PM   #2 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Bttt :)
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-20-2008, 05:57 PM   #3 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Hello and Welcome. Apologies for any delay in replying, but we have been rather busy lately.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

If you still require assistance for this issue, and since it has been a few days since you first posted, please do this:

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
  1. Close all applications and windows.
  2. Double-click on dss.exe to run it, and follow the prompts.
  3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
  4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.
  5. Please attach extra.txt to your post.
To attach a file to a new post, simply
  1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
  2. copy and paste the following into the "Upload File from your Computer" box:
    C:\Deckard\System Scanner\extra.txt
  3. Click Upload.

What DSS will do:
  • create a new System Restore point in Windows XP and Vista.
  • clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

---------------------------------------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
type "C:\boot.ini">C:\look.txt
Start notepad C:\Look.txt
del peek.bat
Save this as peek.bat Choose to "Save type as - All Files"
It should look like this:
Double click on peek.bat & allow it to run. A notepad file will open. Post the contents of that file in your next reply, and close the file.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 04:15 AM   #4 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Thats okay, I could see that the forum was pretty busy!

main.txt:

Deckard's System Scanner v20071014.68
Run by Howe on 2008-01-21 11:01:44
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
156: 2008-01-21 11:01:48 UTC - RP605 - Deckard's System Scanner Restore Point
155: 2008-01-20 23:05:58 UTC - RP604 - System Checkpoint
154: 2008-01-17 18:12:59 UTC - RP603 - System Checkpoint
153: 2008-01-16 17:08:20 UTC - RP602 - Installed Windows XP KB892130.
152: 2008-01-16 17:07:48 UTC - RP601 - Installed Windows XP KB898461.


-- First Restore Point --
1: 2008-01-06 14:39:42 UTC - RP450 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Howe.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:51, on 21/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Howe\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Howe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyeBay
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1F99BDD9-3D40-4178-AD37-24FCC375FC0F} - C:\WINDOWS\System32\vturp.dll
O2 - BHO: (no name) - {2E219D22-E8E0-4F98-A872-DF71D8565E4E} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {AE4499A5-B867-45E9-A4E2-9F18A9F91F9B} - (no file)
O2 - BHO: (no name) - {EBFFE817-23F9-42C6-AFA8-734D76E5CC5B} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cc45ab6d] rundll32.exe "C:\WINDOWS\System32\pqoywgbp.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://roylinedirect.rbos.co.uk
O15 - Trusted Zone: http://roylinedirect.rbs.co.uk
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: fccaxus - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6092 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

S3 AR5513 (%ATHER.Service.DispName%) - c:\windows\system32\drivers\ar5513.sys (file missing)
S3 CMAP_USBCC (C-Map USBCC Reader Driver (cmapusb.sys)) - c:\windows\system32\drivers\cmapusb.sys <Not Verified; C-Map; C-MapNTLink USBCC Reader driver>
S3 CMAPLDR (C-Map USBCC Reader Loader Driver (cmapldr.sys)) - c:\windows\system32\drivers\cmapldr.sys <Not Verified; C-Map; C-Map loader driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {36FC9E60-C465-11CF-8056-444553540000}
Description: SiS PCI to USB Enhanced Host Controller
Device ID: PCI\VEN_1039&DEV_7002&SUBSYS_18081019&REV_00\3&61AAA01&0&1A
Manufacturer: Silicon Integrated Systems
Name: SiS PCI to USB Enhanced Host Controller
PNP Device ID: PCI\VEN_1039&DEV_7002&SUBSYS_18081019&REV_00\3&61AAA01&0&1A
Service: usbehci


-- Files created between 2007-12-21 and 2008-01-21 -----------------------------

2055-08-28 21:30:21 0 d-------- C:\WINDOWS\System32\SoftwareDistribution
2008-01-20 22:45:31 85568 --a------ C:\WINDOWS\System32\cjvawlor.dll
2008-01-20 22:43:39 79424 --a------ C:\WINDOWS\System32\oddijovg.dll
2008-01-16 17:07:49 0 d-------- C:\WINDOWS\System32\PreInstall
2008-01-16 17:06:29 0 d-------- C:\WINDOWS\System32\bits
2008-01-16 16:59:36 0 d-------- C:\Program Files\SpywareBlaster
2008-01-16 16:54:39 0 d-------- C:\WINDOWS\System32\ActiveScan
2008-01-16 16:45:51 0 d-------- C:\Program Files\Trend Micro
2008-01-15 20:18:20 0 d-------- C:\Program Files\BHODemon 2
2008-01-15 20:06:05 79936 --a------ C:\WINDOWS\System32\lhxhiqtd.dll
2008-01-13 22:53:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-13 21:13:00 79424 --a------ C:\WINDOWS\System32\mogduifn.dll
2008-01-13 21:11:02 90176 --a------ C:\WINDOWS\System32\bdaqitpp.dll
2008-01-12 15:05:01 0 d-------- C:\Documents and Settings\Howe\Application Data\U3
2008-01-11 22:00:57 79424 --a------ C:\WINDOWS\System32\kmokhrbb.dll
2008-01-10 21:55:55 79424 --a------ C:\WINDOWS\System32\yrhopokw.dll
2008-01-06 14:39:28 187934 --ahs---- C:\WINDOWS\System32\prutv.ini2
2008-01-06 14:39:26 314720 --a------ C:\WINDOWS\System32\vturp.dll
2008-01-05 00:26:00 0 d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-12-23 15:52:51 208896 --a------ C:\WINDOWS\System32\wmpns.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-12-23 15:50:24 225280 --a------ C:\WINDOWS\System32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-12-23 15:50:24 106496 --a------ C:\WINDOWS\System32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-12-23 15:50:07 52224 --a------ C:\WINDOWS\System32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>


-- Find3M Report ---------------------------------------------------------------

2055-08-28 21:30:24 0 d--h----- C:\Program Files\WindowsUpdate
2055-08-20 09:22:00 0 d-------- C:\Documents and Settings\Howe\Application Data\AVG7
2008-01-05 00:27:58 0 d-------- C:\Program Files\QuickTime
2008-01-04 23:57:08 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-04 21:23:23 0 d-------- C:\Documents and Settings\Howe\Application Data\Adobe
2008-01-03 21:23:26 0 d-------- C:\Program Files\Ubi Soft
2007-12-30 22:40:48 4212 --ah----- C:\WINDOWS\System32\zllictbl.dat
2007-12-17 23:08:20 0 d-------- C:\Program Files\Honda Marine
2007-12-10 11:49:48 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-12-10 11:40:34 0 d-------- C:\Program Files\Common Files
2007-12-10 11:40:34 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-10 11:35:52 0 d-------- C:\Program Files\Memory-Map
2007-12-10 11:00:50 2508 --a------ C:\Documents and Settings\Howe\Application Data\$_hpcst$.hpc
2007-11-29 09:36:15 22240 --a------ C:\Documents and Settings\Howe\Application Data\GDIPFONTCACHEV1.DAT


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F99BDD9-3D40-4178-AD37-24FCC375FC0F}]
06/01/2008 14:39 314720 --a------ C:\WINDOWS\System32\vturp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E219D22-E8E0-4F98-A872-DF71D8565E4E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE4499A5-B867-45E9-A4E2-9F18A9F91F9B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBFFE817-23F9-42C6-AFA8-734D76E5CC5B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [22/10/2006 12:22]
"Ad-watch"="C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe" [12/02/2003 22:04]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [04/12/2007 13:00]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [14/11/2007 16:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/01/2008 00:27]
"cc45ab6d"="C:\WINDOWS\System32\pqoywgbp.dll" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [16/07/2003 16:20]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [20/08/2002 15:08]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 15:45]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [15/11/2005 19:44]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [31/08/2007 16:46]

C:\Documents and Settings\Howe\Start Menu\Programs\Startup\
BHODemon 2.0.lnk - C:\Program Files\BHODemon 2\BHODemon.exe [19/06/2005 12:59:30]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [25/01/2006 11:00:21]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 21:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaxus]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\vturp.dll




-- End of Deckard's System Scanner: finished at 2008-01-21 11:04:24 ------------


I Have attached extra.txt to this post.

This is the results of peek.bat:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect


Thank you again for your help, it is much appreciated.

Louis
Attached Files
File Type: txt extra.txt (9.2 KB, 1 views)
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 09:25 AM   #5 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Good work.

This machine does not have the Windows XP Recovery Console installed.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

---------------------------------------------------------------------------------------------

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please do this:
  1. Download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Place combofix.exe on your Desktop

  2. Go to Microsoft's website => http://support.microsoft.com/kb/310994
    Select the download that's appropriate for your Operating System




    For you, your machine is showing:

    Microsoft Windows XP Professional (build 2600) Service Pack 1
  3. Download the file & save it as it's originally named, next to ComboFix.exe.
  4. Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it as indicated in the image below.


  5. Follow the prompts to start ComboFix (type 1 and press Enter) and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  6. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.
  7. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

    Please do not reboot your machine until we have reviewed the log.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 11:58 AM   #6 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Have just done as you instructed, this is the notepad file that opened:

winxpsp1_en_pro_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 02:15 PM   #7 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Good job.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Disconnect from the internet....pull the plug!
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  3. Double click on combofix.exe & follow the prompts. Type 1, then press Enter to start the fix.
  4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  5. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  6. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
  7. Re-establish an internet connection.
  8. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 03:52 PM   #8 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Combofix Log:

ComboFix 08-01-20.1 - Howe 2008-01-21 22:32:36.1 - NTFSx86
Running from: C:\Documents and Settings\Howe\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\bdaqitpp.dll
C:\WINDOWS\system32\cjvawlor.dll
C:\WINDOWS\system32\kmokhrbb.dll
C:\WINDOWS\system32\lhxhiqtd.dll
C:\WINDOWS\system32\mogduifn.dll
C:\WINDOWS\system32\oddijovg.dll
C:\WINDOWS\system32\pptiqadb.ini
C:\WINDOWS\system32\prutv.ini
C:\WINDOWS\system32\prutv.ini2
C:\WINDOWS\system32\rolwavjc.ini
C:\WINDOWS\system32\yrhopokw.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-21 to 2008-01-21 )))))))))))))))))))))))))))))))
.

2008-01-21 18:48 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-21 18:48 . 2007-03-15 23:53 194 --a------ C:\Boot.bak
2008-01-21 18:45 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-21 11:01 . 2008-01-21 11:01 <DIR> d-------- C:\Deckard
2008-01-17 16:06 . 2005-10-20 22:33 991,232 --a------ C:\WINDOWS\system32\esent.dll
2008-01-16 17:07 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-16 17:06 . 2008-01-16 17:06 <DIR> d-------- C:\WINDOWS\system32\bits
2008-01-16 17:05 . 2004-07-01 22:08 361,984 --a--c--- C:\WINDOWS\system32\dllcache\qmgr.dll
2008-01-16 17:05 . 2004-07-01 22:08 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2008-01-16 17:05 . 2004-07-01 22:08 331,776 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2008-01-16 17:05 . 2004-07-01 22:08 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2008-01-16 17:05 . 2004-07-01 22:08 17,408 --a--c--- C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,680 -----c--- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2008-01-16 16:59 . 2008-01-16 16:59 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-16 16:54 . 2008-01-16 16:56 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 16:54 . 2008-01-16 16:56 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-16 16:54 . 2008-01-16 16:56 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-16 16:54 . 2008-01-16 16:56 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-16 16:45 . 2008-01-16 16:45 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-15 20:18 . 2008-01-15 20:20 <DIR> d-------- C:\Program Files\BHODemon 2
2008-01-15 20:17 . 2008-01-20 22:43 1,073,712 ---hs---- C:\WINDOWS\system32\pbgwyoqp.ini
2008-01-13 22:53 . 2008-01-13 23:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-12 15:05 . 2008-01-12 15:05 <DIR> d-------- C:\Documents and Settings\Howe\Application Data\U3
2008-01-11 21:57 . 2008-01-13 21:11 1,060,742 --ahs---- C:\WINDOWS\system32\tctvqrxu.ini
2008-01-10 21:57 . 2008-01-11 20:04 1,058,084 --ahs---- C:\WINDOWS\system32\dmeccnvq.ini
2008-01-06 14:39 . 2008-01-06 14:39 314,720 --a------ C:\WINDOWS\system32\vturp.dll
2008-01-05 00:26 . 2008-01-05 00:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-05 00:26 . 2008-01-21 22:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-05 00:26 . 2008-01-21 22:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-03 21:39 . 2008-01-03 21:39 24 --a------ C:\WINDOWS\AM_D8.PRF
2007-12-23 15:52 . 2002-12-11 17:34 208,896 --a------ C:\WINDOWS\system32\wmpns.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2055-08-20 09:22 --------- d-----w C:\Documents and Settings\Howe\Application Data\AVG7
2008-01-15 20:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-05 00:27 --------- d-----w C:\Program Files\QuickTime
2008-01-04 23:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 21:23 --------- d-----w C:\Program Files\Ubi Soft
2007-12-17 23:08 --------- d-----w C:\Program Files\Honda Marine
2007-12-10 11:49 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-10 11:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-10 11:35 --------- d-----w C:\Program Files\Memory-Map
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 09:36 22,240 ----a-w C:\Documents and Settings\Howe\Application Data\GDIPFONTCACHEV1.DAT
2007-11-14 16:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2007-10-25 15:42 9,606,972 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-03-03 19:51 1,861,120 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-03-03 19:46 1,860,608 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-01-08 16:22 1,742,848 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2006-09-04 12:37 1,530,368 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2006-07-01 05:43 1,462,784 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2006-03-18 10:12 65,024 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2006-03-15 17:42 21,504 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2006-03-15 17:42 1,205,760 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2006-03-15 10:38 22,528 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2006-03-14 18:12 18,432 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2006-03-14 18:12 1,204,736 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2006-03-14 18:05 1,175,552 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2006-01-25 14:00 1,114,112 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2004-03-11 13:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
1999-05-07 05:22 8,944 ----a-w C:\WINDOWS\inf\USBSCAN.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E219D22-E8E0-4F98-A872-DF71D8565E4E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE4499A5-B867-45E9-A4E2-9F18A9F91F9B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E35A3CEC-ED0F-49F3-B6F4-100D423CF2FA}]
2008-01-06 14:39 314720 --a------ C:\WINDOWS\System32\vturp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBFFE817-23F9-42C6-AFA8-734D76E5CC5B}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 16:20 13312]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 16:18 1670144]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [2005-11-15 19:44 1200128]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22 7700480]
"Ad-watch"="C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe" [2003-02-12 22:04 392192]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 13:00 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-05 00:27 77824]
"cc45ab6d"="C:\WINDOWS\System32\pqoywgbp.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-07-16 16:20 13312]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-25 11:00:21 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaxus]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\vturp.dll

S3 AR5513;%ATHER.Service.DispName%;C:\WINDOWS\System32\DRIVERS\ar5513.sys []
S3 CMAP_USBCC;C-Map USBCC Reader Driver (cmapusb.sys);C:\WINDOWS\System32\Drivers\cmapusb.sys [2003-02-27 17:02]
S3 CMAPLDR;C-Map USBCC Reader Loader Driver (cmapldr.sys);C:\WINDOWS\System32\Drivers\cmapldr.sys [2003-02-27 17:57]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-21 22:41:25
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106]
-> C:\WINDOWS\System32\vturp.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2800.1106]
-> C:\WINDOWS\System32\vturp.dll
.
Completion time: 2008-01-21 22:46:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-21 22:46:30
.
2008-01-21 20:21:09 --- E O F ---



Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:52, on 21/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\eb5ff0ae9fdaa24285c4924997a7aa90\update\update.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyeBay
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cc45ab6d] rundll32.exe "C:\WINDOWS\System32\pqoywgbp.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://roylinedirect.rbos.co.uk
O15 - Trusted Zone: http://roylinedirect.rbs.co.uk
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5561 bytes
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 04:57 PM   #9 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
S& D Spybot's Tea Timer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.
  • See this link for a tutorial

Download ResetTeaTimer.bat by right-clicking on the link, and choosing Save As. Save it to your desktop, or somewhere you can find it easily.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Ad-Aware's AdWatch

Please disable AdWatch, as it may hinder the removal of some entries. You can re-enable it after you're clean.
To disable AdWatch:
  • Open AdAware SE.
  • Go to AdWatch User Interface.
  • Go to Tools and Preferences.
  • At the bottom of the screen you will see 2 options Active and Automatic.
  • Active: This will turn Ad-Watch On\Off without closing it
  • Automatic: Suspicious activity will be blocked automatically
  • Uncheck both options. You can enable these after resolving your problem.
  • Unless they are turned off they could interfere with the fix..


Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Killall::

File::
C:\WINDOWS\System32\vturp.dll
C:\WINDOWS\system32\pbgwyoqp.ini
C:\WINDOWS\system32\tctvqrxu.ini
C:\WINDOWS\system32\dmeccnvq.ini

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E219D22-E8E0-4F98-A872-DF71D8565E4E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE4499A5-B867-45E9-A4E2-9F18A9F91F9B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E35A3CEC-ED0F-49F3-B6F4-100D423CF2FA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBFFE817-23F9-42C6-AFA8-734D76E5CC5B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cc45ab6d"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaxus]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
Save this as CScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------

Also post a new HijackThis log.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 03:48 AM   #10 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
combofix's log:



ComboFix 08-01-20.1 - Howe 2008-01-22 10:34:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.907 [GMT 0:00]
Running from: C:\Documents and Settings\Howe\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Howe\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\dmeccnvq.ini
C:\WINDOWS\system32\pbgwyoqp.ini
C:\WINDOWS\system32\tctvqrxu.ini
C:\WINDOWS\System32\vturp.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dmeccnvq.ini
C:\WINDOWS\system32\pbgwyoqp.ini
C:\WINDOWS\system32\tctvqrxu.ini
C:\WINDOWS\System32\vturp.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-22 to 2008-01-22 )))))))))))))))))))))))))))))))
.

2008-01-21 22:42 . 2008-01-22 10:37 6,783 --ahs---- C:\WINDOWS\system32\prutv.ini2
2008-01-21 22:42 . 2008-01-22 10:38 6,783 --ahs---- C:\WINDOWS\system32\prutv.ini
2008-01-21 18:48 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-21 18:48 . 2007-03-15 23:53 194 --a------ C:\Boot.bak
2008-01-21 18:45 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-21 11:01 . 2008-01-21 11:01 <DIR> d-------- C:\Deckard
2008-01-17 16:06 . 2005-10-20 22:33 991,232 --a------ C:\WINDOWS\system32\esent.dll
2008-01-16 17:07 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-16 17:06 . 2008-01-16 17:06 <DIR> d-------- C:\WINDOWS\system32\bits
2008-01-16 17:05 . 2004-07-01 22:08 361,984 --a--c--- C:\WINDOWS\system32\dllcache\qmgr.dll
2008-01-16 17:05 . 2004-07-01 22:08 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2008-01-16 17:05 . 2004-07-01 22:08 331,776 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2008-01-16 17:05 . 2004-07-01 22:08 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2008-01-16 17:05 . 2004-07-01 22:08 17,408 --a--c--- C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,680 -----c--- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,680 --a------ C:\WINDOWS\system32\bitsprx2.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2008-01-16 17:05 . 2004-07-01 22:08 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2008-01-16 16:59 . 2008-01-16 16:59 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-16 16:54 . 2008-01-16 16:56 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 16:54 . 2008-01-16 16:56 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-16 16:54 . 2008-01-16 16:56 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-16 16:54 . 2008-01-16 16:56 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-16 16:45 . 2008-01-16 16:45 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-15 20:18 . 2008-01-15 20:20 <DIR> d-------- C:\Program Files\BHODemon 2
2008-01-13 22:53 . 2008-01-13 23:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-12 15:05 . 2008-01-12 15:05 <DIR> d-------- C:\Documents and Settings\Howe\Application Data\U3
2008-01-05 00:26 . 2008-01-05 00:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-05 00:26 . 2008-01-22 10:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-05 00:26 . 2008-01-21 22:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-03 21:39 . 2008-01-03 21:39 24 --a------ C:\WINDOWS\AM_D8.PRF
2007-12-23 15:52 . 2002-12-11 17:34 208,896 --a------ C:\WINDOWS\system32\wmpns.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2055-08-20 09:22 --------- d-----w C:\Documents and Settings\Howe\Application Data\AVG7
2008-01-15 20:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-05 00:27 --------- d-----w C:\Program Files\QuickTime
2008-01-04 23:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 21:23 --------- d-----w C:\Program Files\Ubi Soft
2007-12-17 23:08 --------- d-----w C:\Program Files\Honda Marine
2007-12-10 11:49 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-10 11:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-10 11:35 --------- d-----w C:\Program Files\Memory-Map
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 09:36 22,240 ----a-w C:\Documents and Settings\Howe\Application Data\GDIPFONTCACHEV1.DAT
2007-11-14 16:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2007-10-25 15:42 9,606,972 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-03-03 19:51 1,861,120 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-03-03 19:46 1,860,608 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-01-08 16:22 1,742,848 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2006-09-04 12:37 1,530,368 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2006-07-01 05:43 1,462,784 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2006-03-18 10:12 65,024 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2006-03-15 17:42 21,504 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2006-03-15 17:42 1,205,760 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2006-03-15 10:38 22,528 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2006-03-14 18:12 18,432 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2006-03-14 18:12 1,204,736 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2006-03-14 18:05 1,175,552 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2006-01-25 14:00 1,114,112 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2004-03-11 13:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
1999-05-07 05:22 8,944 ----a-w C:\WINDOWS\inf\USBSCAN.SYS
.

((((((((((((((((((((((((((((( snapshot@2008-01-21_22.46.11.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-21 18:47:17 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-22 10:33:56 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-21 18:47:17 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-22 10:33:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-21 18:47:17 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-22 10:33:57 4,972,544 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-21 18:47:18 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-22 10:33:57 106,496 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-21 18:47:18 4,956,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-22 10:33:57 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-21 18:47:19 106,496 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-22 10:33:57 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-21 22:22:22 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-22 10:13:33 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-21 22:22:22 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-22 10:13:33 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-01-21 22:22:22 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-22 10:13:33 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-22 10:41:03 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_538.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 16:20 13312]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 16:18 1670144]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [2005-11-15 19:44 1200128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22 7700480]
"Ad-watch"="C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe" [2003-02-12 22:04 392192]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 13:00 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-05 00:27 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-07-16 16:20 13312]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-25 11:00:21 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

S3 AR5513;%ATHER.Service.DispName%;C:\WINDOWS\System32\DRIVERS\ar5513.sys []
S3 CMAP_USBCC;C-Map USBCC Reader Driver (cmapusb.sys);C:\WINDOWS\System32\Drivers\cmapusb.sys [2003-02-27 17:02]
S3 CMAPLDR;C-Map USBCC Reader Loader Driver (cmapldr.sys);C:\WINDOWS\System32\Drivers\cmapldr.sys [2003-02-27 17:57]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-22 10:41:44
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-22 10:45:41 - machine was rebooted [Howe]
ComboFix-quarantined-files.txt 2008-01-22 10:45:36
ComboFix2.txt 2008-01-21 22:46:33
.
2008-01-21 20:21:09 --- E O F ---


Hijack This:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:47:39, on 22/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyeBay
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://roylinedirect.rbos.co.uk
O15 - Trusted Zone: http://roylinedirect.rbs.co.uk
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5673 bytes



Not totally sure what this is doing, but the computer is running faster now, also didnt get a popup upon opening IE to post this message! :)
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 08:12 AM   #11 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
We're making good progress, and your report is exactly what I want to hear!

Using Windows Explorer, or Windows Search, locate and delete these files:

C:\WINDOWS\system32\prutv.ini2
C:\WINDOWS\system32\prutv.ini

If you cannot find them, let me know.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the drop-down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------


Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 01:56 PM   #12 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
I cant see C:\WINDOWS\system32\prutv.ini2 & C:\WINDOWS\system32\prutv.ini looking in windows explorer, but, If I type C:\WINDOWS\system32\prutv.ini2 and/or C:\WINDOWS\system32\prutv.ini into 'run' it opens the file! So I guess there there?

Updated Java, went without a hitch.

Ran Kaspersky online scanner, produced 16 Virus's, 40 Infected Objects and 1 Suspicious Object. This is its log:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 22, 2008 8:02:22 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/01/2008
Kaspersky Anti-Virus database records: 527121
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 85394
Number of viruses found: 16
Number of infected objects: 40
Number of suspicious objects: 1
Duration of the scan process: 01:14:28

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Howe\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Howe\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\freeripmp3.exe/data0011 Infected: not-a-virus:AdWare.Win32.MyWay.j skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\freeripmp3.exe Inno: infected - 1 skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\Louis's Folder\Web Cam\web cam use on internet.html Suspicious: Exploit.HTML.CodeBaseExec skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0018.BIN/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.v skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0018.BIN/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.a skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.BargainBuddy.a skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0025.BIN/UCMIE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0025.BIN/IUCMORE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0025.BIN Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN/data0001.cab/Save.exe Infected: not-a-virus:AdWare.Win32.SaveNow.e skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN/data0001.cab/SaveUninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bl skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN/data0001.cab/Weather/Weather.exe Infected: not-a-virus:AdWare.Win32.SaveNow skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN/data0001.cab/Weather/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bl skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.bl skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe/WISE0027.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bl skipped
C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe WiseSFX: infected - 12 skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx/[From eBay Inc <identdep_op0970007@ebay.com>][Date Sat, 27 Aug 2005 21:00:15 -0300]/UNNAMED/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx/[From eBay Inc <identdep_op0970007@ebay.com>][Date Sat, 27 Aug 2005 21:00:15 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx/[From aw-confirm@eBay.com <aw-confirm@eBay.com>][Date Sat, 29 May 2004 20:02:35 +0300]/UNNAMED/html Infected: Trojan-Spy.HTML.Bayfraud.em skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx/[From aw-confirm@eBay.com <aw-confirm@eBay.com>][Date Sat, 29 May 2004 20:02:35 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.em skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx/[From eBay.com<norespondnoreply@ebay.com>][Date Sun, 10 Oct 2004 00:52:26 -0700]/html Infected: Trojan-Spy.HTML.Bayfraud.l skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx Mail MS Outlook 5: infected - 5 skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Goss ross cup & saucer.dbx/[From dapritch60@aol.com][Date Fri, 6 May 2005 08:51:53 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Goss ross cup & saucer.dbx Mail MS Outlook 5: infected - 1 skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Paypal.dbx/[From update@paypal.com <update@paypal.com>][Date Thu, 03 Jun 2004 01:37:42 +0300]/html Infected: Trojan-Spy.HTML.Paylap.by skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Paypal.dbx/[From update@paypal.com <update@paypal.com>][Date Mon, 28 Jun 2004 11:00:16 +0300]/html Infected: Trojan-Spy.HTML.Paylap.by skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Paypal.dbx Mail MS Outlook 5: infected - 2 skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Welbeck shoe (3).dbx/[From <endofauction@ebay.com>][Date Sun, 12 May 2002 15:38:05 PDT]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Howe\Desktop\Emails OE6\Welbeck shoe (3).dbx Mail MS Outlook 5: infected - 1 skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\eBay.dbx/[From <aw-confirm@eBay.com>][Date Sat, 29 May 2004 20:02:35 +0300]/html Infected: Trojan-Spy.HTML.Bayfraud.em skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\eBay.dbx Mail MS Outlook 5: infected - 1 skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\Welbeck shoe (3).dbx/[From <endofauction@ebay.com>][Date Sun, 12 May 2002 15:38:05 PDT]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\Welbeck shoe (3).dbx Mail MS Outlook 5: infected - 1 skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Howe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Howe\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Howe\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Howe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Howe\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Howe\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\BHODemon 2\_BHODemon_ATHLON.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bdaqitpp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kmokhrbb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mogduifn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\yrhopokw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\System Volume Information\_restore{BA3DC8E2-2967-4E83-8344-B9271A4E8130}\RP667\A0154943.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{BA3DC8E2-2967-4E83-8344-B9271A4E8130}\RP667\A0154945.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\System Volume Information\_restore{BA3DC8E2-2967-4E83-8344-B9271A4E8130}\RP667\A0154947.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\System Volume Information\_restore{BA3DC8E2-2967-4E83-8344-B9271A4E8130}\RP667\A0154949.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\System Volume Information\_restore{BA3DC8E2-2967-4E83-8344-B9271A4E8130}\RP673\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\ATHLON.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{61B31AA5-D2A1-4262-B1B4-397508118910}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_52c.dat Object is locked skipped
C:\WINDOWS\Temp\ZLT01e75.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT01e7c.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.




Hijackthis's Log:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:01:47, on 22/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dll?MyeBay
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://roylinedirect.rbos.co.uk
O15 - Trusted Zone: http://roylinedirect.rbs.co.uk
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5823 bytes



We seemed to be getting there, its a bit dissapointing that kaspersky found 14 virus's! :( The computer is still running fast though, and no popups at all! :)

Louis
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 02:24 PM   #13 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Many of the finds by Kaspersky are in quarantine, which we'll remove in a while.

Kaspersky has found suspicious mails. Please delete them. From the looks of them, they are in dedicated folders in both Outlook and Outlook Express.

C:\Documents and Settings\Howe\Desktop\Emails OE6\eBay.dbx
/[From eBay Inc <identdep_op0970007@ebay.com>][Date Sat, 27 Aug 2005 21:00:15 -0300]
/[From aw-confirm@eBay.com <aw-confirm@eBay.com>][Date Sat, 29 May 2004 20:02:35 +0300]
/[From eBay.com<norespondnoreply@ebay.com>][Date Sun, 10 Oct 2004 00:52:26 -0700]

C:\Documents and Settings\Howe\Desktop\Emails OE6\Goss ross cup & saucer.dbx
/[From dapritch60@aol.com][Date Fri, 6 May 2005 08:51:53 -0700]

C:\Documents and Settings\Howe\Desktop\Emails OE6\Paypal.dbx
/[From update@paypal.com <update@paypal.com>][Date Thu, 03 Jun 2004 01:37:42 +0300]
/[From update@paypal.com <update@paypal.com>][Date Mon, 28 Jun 2004 11:00:16 +0300]

C:\Documents and Settings\Howe\Desktop\Emails OE6\Welbeck shoe (3).dbx
/[From <endofauction@ebay.com>][Date Sun, 12 May 2002 15:38:05 PDT]

C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\eBay.dbx
/[From <aw-confirm@eBay.com>][Date Sat, 29 May 2004 20:02:35 +0300]

C:\Documents and Settings\Howe\Local Settings\Application Data\Identities\{98C58546-FE04-4138-940B-6ABB3E0373C3}\Microsoft\Outlook Express\Welbeck shoe (3).dbx
/[From <endofauction@ebay.com>][Date Sun, 12 May 2002 15:38:05 PDT]



Open NOTEPAD.exe and copy/paste the text in the codebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\freeripmp3.exe"
"C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\Louis's Folder\Web Cam\web cam use on internet.html"
"C:\Documents and Settings\Howe\Desktop\ALL MY STUFF\Louis's Folder\Louis's Old Folder\tested\setupmp3towav.exe"
"C:\WINDOWS\system32\prutv.ini2"
"C:\WINDOWS\system32\prutv.ini"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)

for %%g in (

%systemdrive%\Deckard

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 03:44 PM   #14 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Deleted Successfully !!
Press any key to continue . . .

I pressed a key and it closed! :)

Am I free of virus's & spyware now! :) :)
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 03:45 PM   #15 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Your logs appear clean.You should be good to go. We still have a few items to address. These next steps will take care of the other kaspersky finds.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • SpywareGuard to catch and block spyware before it can execute.
  • IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • FIREWALL
    Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

    Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 04:22 PM   #16 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Thankyou very much for all of your help. I am more than grateful, I would have had to formatted my hard drive and re installed windows if it wasnt for you.

I have uninstalled combofix from my computer.
I am currently using Avast Anti Virus and Zone Alarm Firewall, are these the best Antivirus and Firewall free products available?

Once again, thankyou, and I will definatly come back if I ever get any more problems. And reccommend you to friends.

Regards,

Louis
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 04:29 PM   #17 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,254
OS: 2000 Pro; XP Pro; XP Home


Re: Constant Popups - Virus's Found
Hi Louis -

You're quite welcome for the help.

As far as best goes, that can be somewhat subjective. Those are very good, and if you're comfortable with them and how they operate, they should be fine. If you want to look into other options, have a look at these comparatives for testing results:


AV:

www.av-comparatives.org

Firewall:

http://www.firewallguide.com/software.htm

http://www.av-comparatives.org/weblog/?p=48

http://www.matousec.com/projects/win...ts-results.php
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 05:16 PM   #18 (permalink)
Registered User
 
Join Date: Jan 2008
Posts: 10
OS: Windows XP


Re: Constant Popups - Virus's Found
Thankyou, I will have a look through those sometime and see what else is available!

Louis
elv_1986 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 06:34 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85