Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Vundo Adclicker removal assistiance logs attached
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 01-18-2008, 08:40 AM   #1 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Vundo Adclicker removal assistiance logs attached
For the past few weeks McAfee has been finding files and removing them, started as Vundo and after I went online to the McAfee site (by clicking the name of Vundo when it came up to tell me it was removed) and followed their suggestions it started coming up with removing Adclicker. Adclicker has been removed several times but I still get strange IE (man how I wish I could remove that program) screens poping up on my computer.

Any help would be greatly appreciated.

I went through and did all the first suggested processes the log from the online scan should be attached to this message as well. Hijack this log follows.

Deckard's System Scanner v20071014.68
Run by Daniel Cole on 2008-01-18 10:32:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2008-01-18 15:32:05 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Daniel Cole.exe) -----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:19 AM, on 1/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Daniel Cole.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: (no name) - {2AFB99E7-FAD7-4AE1-AB07-90F2368E6FD3} - C:\WINDOWS\system32\vtstr.dll
O2 - BHO: (no name) - {30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468} - C:\WINDOWS\system32\mljjihe.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {5c776c71-bde5-73ba-a164-850a4b10af97} - {79fa01b4-a058-461a-ab37-5edb17c677c5} - C:\WINDOWS\system32\dwgotlmi.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [60921b85] rundll32.exe "C:\WINDOWS\system32\fttrnywm.dll",b
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - Startup: Kremlin Sentry.LNK = C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) - https://w3s.webmoney.ru/WMAcceptor.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1174406505544
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1174406501873
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: mljjihe - C:\WINDOWS\SYSTEM32\mljjihe.dll
O23 - Service: McAfee Application Installer Cleanup (0123071200665193) (0123071200665193mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\012307~1.EXE (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MPService - Canon Information Systems, Inc. - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

--
End of file - 11079 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 cis1284 - c:\windows\system32\drivers\cis1284.sys <Not Verified; Canon Information Systems; Canon MultiPASS>
R3 SaiMini - c:\windows\system32\drivers\saimini.sys <Not Verified; Saitek; Configuration Software>
R3 SaiNtBus - c:\windows\system32\drivers\saibus.sys <Not Verified; Saitek; Configuration Software>

S3 bfastfao - c:\docume~1\daniel~1\locals~1\temp\bfastfao.sys (file missing)
S3 PciCon - e:\pcicon.sys (file missing)
S3 SDTHOOK - c:\windows\system32\drivers\sdthook.sys <Not Verified; Panda Software; Panda® Antivirus>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 MPService - c:\program files\canon\multipass\mpservic.exe <Not Verified; Canon Information Systems, Inc.; Canon MultiPASS>
R3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>

S2 0123071200665193mcinstcleanup (McAfee Application Installer Cleanup (0123071200665193)) - c:\windows\temp\012307~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service (file missing)


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\ATK0110\1010110
Manufacturer:
Name:
PNP Device ID: ACPI\ATK0110\1010110
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-01-09 08:20:00 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-01-01 01:00:01 364 --a------ C:\WINDOWS\Tasks\McQcTask.job
2007-12-15 01:02:33 362 --a------ C:\WINDOWS\Tasks\McDefragTask.job


-- Files created between 2007-12-18 and 2008-01-18 -----------------------------

2008-01-18 10:33:07 0 d-------- C:\Program Files\Trend Micro
2008-01-18 00:42:27 0 d-------- C:\Program Files\SpywareBlaster
2008-01-17 23:21:43 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2008-01-17 23:21:13 8576 --a------ C:\WINDOWS\system32\drivers\vugysnkjyeid.sys <Not Verified; Panda Software International; RKPavProc Driver>
2008-01-17 17:27:27 86592 --a------ C:\WINDOWS\system32\fttrnywm.dll
2008-01-17 17:18:25 77376 --a------ C:\WINDOWS\system32\dwgotlmi.dll
2008-01-17 17:16:16 70208 --a------ C:\WINDOWS\system32\pjrkwkdk.dll
2008-01-16 10:13:18 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 09:45:25 76864 --a------ C:\WINDOWS\system32\gnwwwbba.dll
2008-01-16 09:42:52 70208 --a------ C:\WINDOWS\system32\dkbbgsno.dll
2008-01-15 08:05:42 70208 --a------ C:\WINDOWS\system32\avgdpbvm.dll
2008-01-15 08:00:09 79936 --a------ C:\WINDOWS\system32\qiqkkvnc.dll
2008-01-13 22:31:40 70208 --a------ C:\WINDOWS\system32\bvyrvajh.dll
2008-01-13 22:28:41 79936 --a------ C:\WINDOWS\system32\obyrgrwd.dll
2008-01-12 22:33:13 76864 --a------ C:\WINDOWS\system32\asltreif.dll
2008-01-12 22:30:13 70208 --a------ C:\WINDOWS\system32\itgafiyw.dll
2008-01-11 22:26:42 70208 --a------ C:\WINDOWS\system32\xbgapcwf.dll
2008-01-11 22:26:41 76864 --a------ C:\WINDOWS\system32\aluntvja.dll
2008-01-10 22:29:41 70208 --a------ C:\WINDOWS\system32\txweyxpy.dll
2008-01-10 22:26:41 79424 --a------ C:\WINDOWS\system32\tqqunkch.dll
2008-01-09 22:26:44 79936 --a------ C:\WINDOWS\system32\tiknufti.dll
2008-01-08 22:26:44 77888 --a------ C:\WINDOWS\system32\yxkoyxcy.dll
2008-01-07 22:26:44 76864 --a------ C:\WINDOWS\system32\odkcpnxf.dll
2008-01-06 22:26:45 75840 --a------ C:\WINDOWS\system32\hmprjxvs.dll
2008-01-05 23:53:22 421888 --a------ C:\WINDOWS\Nero PhotoShow.scr
2008-01-05 23:53:22 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\Simple Star
2008-01-05 22:26:44 78912 --a------ C:\WINDOWS\system32\hwxapxgj.dll
2008-01-05 21:08:39 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\Ahead
2008-01-05 21:07:18 0 d-------- C:\WINDOWS\InCD
2008-01-05 21:05:09 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
2008-01-05 20:58:20 0 d-------- C:\Program Files\ahead
2008-01-05 19:52:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-01-05 19:52:25 364544 --a------ C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4>
2008-01-05 19:52:25 471040 --a------ C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2008-01-05 19:52:25 262144 --a------ C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2008-01-05 19:52:25 1568768 --a------ C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2008-01-05 19:52:24 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20>
2008-01-05 19:52:24 38912 --a------ C:\WINDOWS\system32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS>
2008-01-05 19:52:21 0 d-------- C:\Program Files\Common Files\Ahead
2008-01-04 22:30:52 7165 --a------ C:\WINDOWS\system32\nyidtmbw.dll
2008-01-04 22:24:49 79424 --a------ C:\WINDOWS\system32\irengowx.dll
2008-01-03 22:30:13 78400 --a------ C:\WINDOWS\system32\xqgcrbxh.dll
2008-01-02 22:30:13 78400 --a------ C:\WINDOWS\system32\ycubohor.dll
2008-01-01 22:30:13 77376 --a------ C:\WINDOWS\system32\wrjdhdiq.dll
2007-12-31 23:39:11 0 d-------- C:\Program Files\Common Files\Stardock
2007-12-31 23:28:36 118784 --a------ C:\WINDOWS\system32\DartWeb.dll <Not Verified; Dart Communications; PowerTCP© Tools>
2007-12-31 23:28:36 221184 --a------ C:\WINDOWS\system32\DartSock.dll <Not Verified; Dart Communications; PowerTCP© Tools>
2007-12-31 23:28:36 49152 --a------ C:\WINDOWS\system32\DartObjects.dll <Not Verified; Dart Communications; PowerTCP© Tools>
2007-12-31 23:27:19 0 d-------- C:\Program Files\Stardock
2007-12-31 22:29:47 78912 --a------ C:\WINDOWS\system32\srostxsy.dll


-- Find3M Report ---------------------------------------------------------------

2008-01-18 10:32:46 331411 --ahs---- C:\WINDOWS\system32\rtstv.ini2
2008-01-18 10:32:34 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\SiteAdvisor
2008-01-18 09:08:40 0 d-------- C:\Program Files\DynDNS Updater
2008-01-18 09:08:24 0 d-------- C:\Program Files\McAfee
2008-01-17 23:41:14 0 d-------- C:\Program Files\DAEMON Tools Pro
2008-01-05 19:52:21 0 d-------- C:\Program Files\Common Files
2007-12-14 01:27:20 85568 --a------ C:\WINDOWS\system32\wteluwnh.dll
2007-12-10 18:48:14 0 d-------- C:\Program Files\a-squared Anti-Malware
2007-12-10 01:32:00 85568 --a------ C:\WINDOWS\system32\ajqgklad.dll
2007-12-09 20:00:03 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-07 17:02:21 0 d-------- C:\Program Files\DO
2007-12-07 01:11:32 0 d-------- C:\Program Files\Lavasoft
2007-12-07 01:11:30 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-05 14:05:40 81984 --a------ C:\WINDOWS\system32\hlckvweg.dll
2007-12-04 19:24:10 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\uTorrent
2007-12-04 14:03:01 80960 --a------ C:\WINDOWS\system32\qtxvsmkh.dll
2007-12-04 0204 80960 --a------ C:\WINDOWS\system32\baanmdvf.dll
2007-12-03 02:10:08 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\DAEMON Tools Pro
2007-12-03 02:04:25 0 d-------- C:\Program Files\Trillian
2007-12-03 01:51:42 321120 --a------ C:\WINDOWS\system32\vtstr.dll
2007-12-03 01:46:33 34304 --a------ C:\WINDOWS\system32\mljjihe.dll
2007-12-01 00:39:38 0 d-------- C:\Documents and Settings\Daniel Cole\Application Data\Media Player Classic
2007-11-28 22:16:24 4608 --a------ C:\WINDOWS\system32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95>
2007-11-28 22:16:24 2272 --a------ C:\WINDOWS\system32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95>
2007-11-27 18:08:47 0 d-------- C:\Program Files\Common Files\McAfee
2007-11-22 10:19:27 0 d-------- C:\Program Files\Java
2007-11-18 02:38:49 23552 --a------ C:\WINDOWS\xobglu32.dll
2007-11-18 02:38:49 63488 --a------ C:\WINDOWS\xobglu16.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2AFB99E7-FAD7-4AE1-AB07-90F2368E6FD3}]
12/03/2007 01:51 AM 321120 --a------ C:\WINDOWS\system32\vtstr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}]
12/03/2007 01:46 AM 34304 --a------ C:\WINDOWS\system32\mljjihe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79fa01b4-a058-461a-ab37-5edb17c677c5}]
01/17/2008 05:18 PM 77376 --a------ C:\WINDOWS\system32\dwgotlmi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" []
"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe" []
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/21/2007 12:21 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"SkyTel"="SkyTel.EXE" [05/17/2006 01:04 AM C:\WINDOWS\SkyTel.exe]
"SaiMfd"="C:\Program Files\Saitek\Software\SaiMfd.exe" [06/17/2005 06:02 PM]
"RTHDCPL"="RTHDCPL.EXE" [11/15/2006 12:21 AM C:\WINDOWS\RTHDCPL.exe]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [06/14/2005 02:23 PM]
"nwiz"="nwiz.exe" [08/23/2006 08:03 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [08/23/2006 08:02 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [08/23/2006 08:03 PM]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [02/17/2006 10:40 AM]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [10/30/2006 07:44 AM]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [10/30/2006 07:44 AM]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" []
"Alcmtr"="ALCMTR.EXE" [05/04/2005 01:43 AM C:\WINDOWS\Alcmtr.exe]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [10/22/2006 11:24 PM]
"@"="" []
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [02/28/2006 06:00 AM]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [02/28/2006 06:00 AM]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [02/28/2006 06:00 AM]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [02/28/2006 06:00 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" []
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [08/03/2007 10:33 PM]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 10:50 AM]
"60921b85"="C:\WINDOWS\system32\fttrnywm.dll" [01/17/2008 05:27 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []
"DynDNS Updater"="C:\Program Files\DynDNS Updater\DynDNS.exe" [09/17/2006 10:32 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [02/28/2006 07:00 AM]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [09/06/2007 08:08 AM]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe" [11/11/2004 08:50 PM]

C:\Documents and Settings\Daniel Cole\Start Menu\Programs\Startup\
Kremlin Sentry.LNK - C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe [2/19/2006 9:57:29 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 12:01:04 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}"= C:\WINDOWS\system32\mljjihe.dll [12/03/2007 01:46 AM 34304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljjihe]
mljjihe.dll 12/03/2007 01:46 AM 34304 C:\WINDOWS\system32\mljjihe.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtstr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80825ec2-d6d4-11db-9a64-806d6172696f}]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83a0b37a-a16e-11dc-9aab-001a9244c33d}]
AutoRun\command- F:\Lunch.exe

*Newly Created Service* - 0123071200665193MCINSTCLEANUP



-- End of Deckard's System Scanner: finished at 2008-01-18 10:33:55 ------------
Attached Files
File Type: txt extra.txt (15.6 KB, 1 views)
File Type: txt panda spy wear report.txt (20.5 KB, 2 views)
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 01-21-2008, 10:24 PM   #2 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
bump.
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-22-2008, 11:33 AM   #3 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

If you have any questions along the way...STOP and ask them before proceeding.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-24-2008, 07:27 AM   #4 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
Thanks! Did I bump correctly by the way? Want to make sure I do things the right way.

combo fix log

ComboFix 08-01-23.2 - Daniel Cole 2008-01-24 0:53:29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1330 [GMT -5:00]
Running from: C:\Documents and Settings\Daniel Cole\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ajqgklad.dll
C:\WINDOWS\system32\aluntvja.dll
C:\WINDOWS\system32\asltreif.dll
C:\WINDOWS\system32\avgdpbvm.dll
C:\WINDOWS\system32\awlityso.dll
C:\WINDOWS\system32\baanmdvf.dll
C:\WINDOWS\system32\bvyrvajh.dll
C:\WINDOWS\system32\dalkgqja.ini
C:\WINDOWS\system32\dkbbgsno.dll
C:\WINDOWS\system32\dwgotlmi.dll
C:\WINDOWS\system32\eytqqlql.dll
C:\WINDOWS\system32\gnwwwbba.dll
C:\WINDOWS\system32\hlckvweg.dll
C:\WINDOWS\system32\hmprjxvs.dll
C:\WINDOWS\system32\hnwuletw.ini
C:\WINDOWS\system32\hoiwrluv.dll
C:\WINDOWS\system32\hwxapxgj.dll
C:\WINDOWS\system32\irengowx.dll
C:\WINDOWS\system32\itgafiyw.dll
C:\WINDOWS\system32\jdvxjxfu.ini
C:\WINDOWS\system32\jtvjoapv.dll
C:\WINDOWS\system32\kpfbvkav.dll
C:\WINDOWS\system32\kwfeampq.ini
C:\WINDOWS\system32\lqlqqtye.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljjihe.dll
C:\WINDOWS\system32\mmswlggj.dll
C:\WINDOWS\system32\ntldftuo.dll
C:\WINDOWS\system32\nyidtmbw.dll
C:\WINDOWS\system32\obyrgrwd.dll
C:\WINDOWS\system32\odkcpnxf.dll
C:\WINDOWS\system32\orcrbqms.dll
C:\WINDOWS\system32\ovlsftmx.dll
C:\WINDOWS\system32\owjqykvc.dll
C:\WINDOWS\system32\pjrkwkdk.dll
C:\WINDOWS\system32\qiqkkvnc.dll
C:\WINDOWS\system32\qpmaefwk.dll
C:\WINDOWS\system32\qtxvsmkh.dll
C:\WINDOWS\system32\reowemfv.dll
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\rtstv.ini2
C:\WINDOWS\system32\srostxsy.dll
C:\WINDOWS\system32\tiknufti.dll
C:\WINDOWS\system32\tqqunkch.dll
C:\WINDOWS\system32\txweyxpy.dll
C:\WINDOWS\system32\ufxjxvdj.dll
C:\WINDOWS\system32\vedycjmw.dll
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\system32\vulrwioh.ini
C:\WINDOWS\system32\wrjdhdiq.dll
C:\WINDOWS\system32\wteluwnh.dll
C:\WINDOWS\system32\xbgapcwf.dll
C:\WINDOWS\system32\xhvwthap.dll
C:\WINDOWS\system32\xqgcrbxh.dll
C:\WINDOWS\system32\yavoubiq.dll
C:\WINDOWS\system32\ycubohor.dll
C:\WINDOWS\system32\yxkoyxcy.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 00:51 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-24 00:51 . 2007-06-16 16:45 211 --a------ C:\Boot.bak
2008-01-24 00:50 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-24 00:43 . 2008-01-24 00:43 <DIR> d-------- C:\Program Files\iTunes
2008-01-24 00:43 . 2008-01-24 00:43 <DIR> d-------- C:\Program Files\iPod
2008-01-24 00:42 . 2008-01-24 00:42 <DIR> d-------- C:\Program Files\QuickTime
2008-01-21 19:07 . 2008-01-24 00:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-21 19:07 . 2008-01-21 19:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-19 17:26 . 2008-01-20 17:26 750,818 --ahs---- C:\WINDOWS\system32\shicrggd.ini
2008-01-18 17:26 . 2008-01-19 16:26 795,287 --ahs---- C:\WINDOWS\system32\nxufmabm.ini
2008-01-18 10:33 . 2008-01-18 10:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-18 10:31 . 2008-01-18 10:31 <DIR> d-------- C:\Deckard
2008-01-18 00:42 . 2008-01-18 00:44 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-18 00:42 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-01-17 23:21 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-17 23:21 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\vugysnkjyeid.sys
2008-01-17 17:27 . 2008-01-18 09:08 797,113 --ahs---- C:\WINDOWS\system32\mwynrttf.ini
2008-01-16 10:13 . 2008-01-18 00:10 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 10:13 . 2008-01-17 23:19 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-16 10:13 . 2008-01-17 23:19 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-16 10:13 . 2008-01-17 23:19 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-16 09:54 . 2008-01-17 09:54 845,433 --ahs---- C:\WINDOWS\system32\ftajytqy.ini
2008-01-15 08:11 . 2008-01-16 09:43 835,149 --ahs---- C:\WINDOWS\system32\wqekfrrn.ini
2008-01-13 22:34 . 2008-01-15 08:00 829,568 --ahs---- C:\WINDOWS\system32\aiutknjh.ini
2008-01-12 22:39 . 2008-01-13 15:37 832,914 --ahs---- C:\WINDOWS\system32\fiamgxhy.ini
2008-01-11 22:32 . 2008-01-12 22:32 832,794 --ahs---- C:\WINDOWS\system32\ukndhkgs.ini
2008-01-10 22:38 . 2008-01-10 22:38 830,715 --ahs---- C:\WINDOWS\system32\wwlpnncr.ini
2008-01-10 22:29 . 2008-01-24 00:53 16,502 --a------ C:\WINDOWS\BM63a12819.xml
2008-01-10 22:29 . 2008-01-24 00:53 22 --a------ C:\WINDOWS\pskt.ini
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-09 22:32 . 2008-01-10 22:33 837,038 --ahs---- C:\WINDOWS\system32\fqunvrnl.ini
2008-01-08 22:32 . 2008-01-08 22:33 826,274 --ahs---- C:\WINDOWS\system32\jstdljjd.ini
2008-01-07 22:32 . 2008-01-07 22:32 814,628 --ahs---- C:\WINDOWS\system32\wdwacjkr.ini
2008-01-06 22:32 . 2008-01-06 22:32 814,573 --ahs---- C:\WINDOWS\system32\nnwsuihl.ini
2008-01-06 03:00 . 2008-01-23 01:33 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-01-05 23:53 . 2004-07-13 15:47 421,888 --a------ C:\WINDOWS\Nero PhotoShow.scr
2008-01-05 22:32 . 2008-01-05 22:32 814,513 --ahs---- C:\WINDOWS\system32\spbaqrto.ini
2008-01-05 21:08 . 2004-05-14 10:12 1,916,928 --------- C:\WINDOWS\UNNVEContent.exe
2008-01-05 21:08 . 2004-11-30 12:14 67,990 --------- C:\WINDOWS\UNNVEContent.cfg
2008-01-05 21:07 . 2008-01-05 21:07 <DIR> d-------- C:\WINDOWS\InCD
2008-01-05 21:07 . 2004-11-26 08:44 2,461,696 --------- C:\WINDOWS\UNMRW.exe
2008-01-05 21:07 . 2004-05-14 10:12 1,916,928 --------- C:\WINDOWS\UNAheadManual.exe
2008-01-05 21:07 . 2004-11-26 13:36 98,176 --a------ C:\WINDOWS\system32\drivers\InCDfs.sys
2008-01-05 21:07 . 2005-01-05 05:12 55,606 --------- C:\WINDOWS\UNMRW.cfg
2008-01-05 21:07 . 2004-05-06 04:06 33,193 --------- C:\WINDOWS\UNAheadManual.cfg
2008-01-05 21:07 . 2004-11-26 13:36 28,928 --a------ C:\WINDOWS\system32\drivers\InCDpass.sys
2008-01-05 21:07 . 2004-11-26 07:36 27,648 --a------ C:\WINDOWS\system32\drivers\InCDrm.sys
2008-01-05 21:07 . 2004-11-26 13:36 7,808 --a------ C:\WINDOWS\system32\drivers\InCDrec.sys
2008-01-05 21:06 . 2004-11-11 06:50 2,433,024 --------- C:\WINDOWS\UNNMP.exe
2008-01-05 21:06 . 2005-01-05 05:12 52,521 --------- C:\WINDOWS\UNNMP.cfg
2008-01-05 21:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-05 20:58 . 2008-01-05 23:51 <DIR> d-------- C:\Program Files\ahead
2008-01-05 20:58 . 2004-09-15 09:22 2,146,304 --------- C:\WINDOWS\UNNeroVision.exe
2008-01-05 20:58 . 2005-01-05 05:12 129,831 --------- C:\WINDOWS\UNNeroVision.cfg
2008-01-05 19:52 . 2008-01-05 21:04 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-05 19:52 . 2004-09-22 17:00 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2008-01-05 19:52 . 2004-09-22 17:00 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2008-01-05 19:52 . 2004-09-22 17:00 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2008-01-05 19:52 . 2004-09-22 17:00 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-01-05 19:52 . 2004-09-22 17:00 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2008-01-05 19:52 . 2004-09-22 17:00 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-01-05 19:52 . 2004-09-22 17:00 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-01-03 22:36 . 2008-01-05 19:56 814,453 --ahs---- C:\WINDOWS\system32\pwhoeows.ini
2008-01-02 22:33 . 2008-01-03 22:33 895,785 --ahs---- C:\WINDOWS\system32\bmemrpbn.ini
2008-01-01 22:33 . 2008-01-01 22:33 801,552 --ahs---- C:\WINDOWS\system32\atqeprlb.ini
2007-12-31 23:39 . 2007-12-31 23:39 <DIR> d-------- C:\Program Files\Common Files\Stardock
2007-12-31 23:39 . 2002-01-05 06:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-12-31 23:39 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-12-31 23:39 . 2002-01-05 06:38 54,784 --a------ C:\WINDOWS\system32\msvci70.dll
2007-12-31 23:39 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-12-31 23:28 . 2002-11-22 00:00 221,184 --a------ C:\WINDOWS\system32\DartSock.dll
2007-12-31 23:28 . 2002-11-25 00:00 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll
2007-12-31 23:28 . 2000-10-10 01:00 49,152 --a------ C:\WINDOWS\system32\DartObjects.dll
2007-12-31 23:27 . 2007-12-31 23:38 <DIR> d-------- C:\Program Files\Stardock
2007-12-31 22:32 . 2008-01-01 22:33 801,492 --ahs---- C:\WINDOWS\system32\qthmnocp.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:04 --------- d-----w C:\Program Files\DynDNS Updater
2008-01-21 07:15 --------- d-----w C:\Program Files\Trillian
2008-01-18 14:08 --------- d-----w C:\Program Files\McAfee
2008-01-18 04:41 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-01-11 08:12 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-10 23:48 --------- d-----w C:\Program Files\a-squared Anti-Malware
2007-12-10 01:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 22:02 --------- d-----w C:\Program Files\DO
2007-12-07 06:11 --------- d-----w C:\Program Files\Lavasoft
2007-12-07 06:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-03 06:46 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-29 03:16 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2007-11-27 23:08 --------- d-----w C:\Program Files\Common Files\McAfee
2007-11-18 07:38 63,488 ----a-w C:\WINDOWS\xobglu16.dll
2007-11-18 07:38 23,552 ----a-w C:\WINDOWS\xobglu32.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
"DynDNS Updater"="C:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 10:32 1352704]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 08:08 136136]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe" [2004-11-11 20:50 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" [ ]
"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-21 00:21 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SkyTel"="SkyTel.EXE" [2006-05-17 01:04 2879488 C:\WINDOWS\SkyTel.exe]
"SaiMfd"="C:\Program Files\Saitek\Software\SaiMfd.exe" [2005-06-17 18:02 126976]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-15 00:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [2005-06-14 14:23 159744]
"nwiz"="nwiz.exe" [2006-08-23 20:03 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-23 20:02 86016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-23 20:03 7630848]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2006-02-17 10:40 270336]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 07:44 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 07:44 1953792]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [ ]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 06:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 06:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 06:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 06:00 455168]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

C:\Documents and Settings\Daniel Cole\Start Menu\Programs\Startup\
Kremlin Sentry.LNK - C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe [2006-02-19 21:57:29 227840]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [1999-04-26 18:07]
S2 0123071200665193mcinstcleanup;McAfee Application Installer Cleanup (0123071200665193);C:\WINDOWS\TEMP\012307~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog []
S3 bfastfao;bfastfao;C:\DOCUME~1\DANIEL~1\LOCALS~1\Temp\bfastfao.sys []
S3 PciCon;PciCon;E:\PciCon.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80825ec2-d6d4-11db-9a64-806d6172696f}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83a0b37a-a16e-11dc-9aab-001a9244c33d}]
\Shell\AutoRun\command - F:\Lunch.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-23 13:20:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-15 06:02:33 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:00:01 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 00:58:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

Hijack this log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:37, on 2008-01-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - Startup: Kremlin Sentry.LNK = C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) - https://w3s.webmoney.ru/WMAcceptor.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1174406505544
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1174406501873
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: McAfee Application Installer Cleanup (0123071200665193) (0123071200665193mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\012307~1.EXE (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MPService - Canon Information Systems, Inc. - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

--
End of file - 10724 bytes
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-24-2008, 09:38 AM   #5 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
Quote:
Did I bump correctly by the way? Want to make sure I do things the right way.
Yes you did, and thanks for asking and your consideration.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Killall::

File::
C:\WINDOWS\system32\shicrggd.ini
C:\WINDOWS\system32\nxufmabm.ini
C:\WINDOWS\system32\mwynrttf.ini
C:\WINDOWS\system32\ftajytqy.ini
C:\WINDOWS\system32\wqekfrrn.ini
C:\WINDOWS\system32\aiutknjh.ini
C:\WINDOWS\system32\fiamgxhy.ini
C:\WINDOWS\system32\ukndhkgs.ini
C:\WINDOWS\system32\wwlpnncr.ini
C:\WINDOWS\BM63a12819.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\fqunvrnl.ini
C:\WINDOWS\system32\jstdljjd.ini
C:\WINDOWS\system32\wdwacjkr.ini
C:\WINDOWS\system32\nnwsuihl.ini
C:\WINDOWS\system32\spbaqrto.ini
C:\WINDOWS\system32\pwhoeows.ini
C:\WINDOWS\system32\bmemrpbn.ini
C:\WINDOWS\system32\atqeprlb.ini
C:\WINDOWS\system32\qthmnocp.ini
Save this as CScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-25-2008, 08:00 AM   #6 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
Your welcome. This site helped me before and you are doing it for free so I want to be sure I do things correctly. I think I was supposed to name the file CFScript though...like in the picture? I tried to name it CScript like you suggested but it didn't work and it asked me if I was trying to run CFScript. So I named the text file that and it seemed to work.

Here is the log it produced:

ComboFix 08-01-23.2 - Daniel Cole 2008-01-25 0:47:47.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1587 [GMT -5:00]
Running from: C:\Documents and Settings\Daniel Cole\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Daniel Cole\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\BM63a12819.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aiutknjh.ini
C:\WINDOWS\system32\atqeprlb.ini
C:\WINDOWS\system32\bmemrpbn.ini
C:\WINDOWS\system32\fiamgxhy.ini
C:\WINDOWS\system32\fqunvrnl.ini
C:\WINDOWS\system32\ftajytqy.ini
C:\WINDOWS\system32\jstdljjd.ini
C:\WINDOWS\system32\mwynrttf.ini
C:\WINDOWS\system32\nnwsuihl.ini
C:\WINDOWS\system32\nxufmabm.ini
C:\WINDOWS\system32\pwhoeows.ini
C:\WINDOWS\system32\qthmnocp.ini
C:\WINDOWS\system32\shicrggd.ini
C:\WINDOWS\system32\spbaqrto.ini
C:\WINDOWS\system32\ukndhkgs.ini
C:\WINDOWS\system32\wdwacjkr.ini
C:\WINDOWS\system32\wqekfrrn.ini
C:\WINDOWS\system32\wwlpnncr.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM63a12819.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aiutknjh.ini
C:\WINDOWS\system32\atqeprlb.ini
C:\WINDOWS\system32\bmemrpbn.ini
C:\WINDOWS\system32\fiamgxhy.ini
C:\WINDOWS\system32\fqunvrnl.ini
C:\WINDOWS\system32\ftajytqy.ini
C:\WINDOWS\system32\jstdljjd.ini
C:\WINDOWS\system32\mwynrttf.ini
C:\WINDOWS\system32\nnwsuihl.ini
C:\WINDOWS\system32\nxufmabm.ini
C:\WINDOWS\system32\pwhoeows.ini
C:\WINDOWS\system32\qthmnocp.ini
C:\WINDOWS\system32\shicrggd.ini
C:\WINDOWS\system32\spbaqrto.ini
C:\WINDOWS\system32\ukndhkgs.ini
C:\WINDOWS\system32\wdwacjkr.ini
C:\WINDOWS\system32\wqekfrrn.ini
C:\WINDOWS\system32\wwlpnncr.ini
.
---- Previous Run -------
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ajqgklad.dll
C:\WINDOWS\system32\aluntvja.dll
C:\WINDOWS\system32\asltreif.dll
C:\WINDOWS\system32\avgdpbvm.dll
C:\WINDOWS\system32\awlityso.dll
C:\WINDOWS\system32\baanmdvf.dll
C:\WINDOWS\system32\bvyrvajh.dll
C:\WINDOWS\system32\dalkgqja.ini
C:\WINDOWS\system32\dkbbgsno.dll
C:\WINDOWS\system32\dwgotlmi.dll
C:\WINDOWS\system32\eytqqlql.dll
C:\WINDOWS\system32\gnwwwbba.dll
C:\WINDOWS\system32\hlckvweg.dll
C:\WINDOWS\system32\hmprjxvs.dll
C:\WINDOWS\system32\hnwuletw.ini
C:\WINDOWS\system32\hoiwrluv.dll
C:\WINDOWS\system32\hwxapxgj.dll
C:\WINDOWS\system32\irengowx.dll
C:\WINDOWS\system32\itgafiyw.dll
C:\WINDOWS\system32\jdvxjxfu.ini
C:\WINDOWS\system32\jtvjoapv.dll
C:\WINDOWS\system32\kpfbvkav.dll
C:\WINDOWS\system32\kwfeampq.ini
C:\WINDOWS\system32\lqlqqtye.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljjihe.dll
C:\WINDOWS\system32\mmswlggj.dll
C:\WINDOWS\system32\ntldftuo.dll
C:\WINDOWS\system32\nyidtmbw.dll
C:\WINDOWS\system32\obyrgrwd.dll
C:\WINDOWS\system32\odkcpnxf.dll
C:\WINDOWS\system32\orcrbqms.dll
C:\WINDOWS\system32\ovlsftmx.dll
C:\WINDOWS\system32\owjqykvc.dll
C:\WINDOWS\system32\pjrkwkdk.dll
C:\WINDOWS\system32\qiqkkvnc.dll
C:\WINDOWS\system32\qpmaefwk.dll
C:\WINDOWS\system32\qtxvsmkh.dll
C:\WINDOWS\system32\reowemfv.dll
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\rtstv.ini2
C:\WINDOWS\system32\srostxsy.dll
C:\WINDOWS\system32\tiknufti.dll
C:\WINDOWS\system32\tqqunkch.dll
C:\WINDOWS\system32\txweyxpy.dll
C:\WINDOWS\system32\ufxjxvdj.dll
C:\WINDOWS\system32\vedycjmw.dll
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\system32\vulrwioh.ini
C:\WINDOWS\system32\wrjdhdiq.dll
C:\WINDOWS\system32\wteluwnh.dll
C:\WINDOWS\system32\xbgapcwf.dll
C:\WINDOWS\system32\xhvwthap.dll
C:\WINDOWS\system32\xqgcrbxh.dll
C:\WINDOWS\system32\yavoubiq.dll
C:\WINDOWS\system32\ycubohor.dll
C:\WINDOWS\system32\yxkoyxcy.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-24 00:51 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-24 00:51 . 2007-06-16 16:45 211 --a------ C:\Boot.bak
2008-01-24 00:50 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-24 00:43 . 2008-01-24 00:43 <DIR> d-------- C:\Program Files\iTunes
2008-01-24 00:43 . 2008-01-24 00:43 <DIR> d-------- C:\Program Files\iPod
2008-01-24 00:42 . 2008-01-24 00:42 <DIR> d-------- C:\Program Files\QuickTime
2008-01-21 19:07 . 2008-01-25 00:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-21 19:07 . 2008-01-21 19:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-18 10:33 . 2008-01-18 10:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-18 10:31 . 2008-01-18 10:31 <DIR> d-------- C:\Deckard
2008-01-18 00:42 . 2008-01-18 00:44 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-18 00:42 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-01-17 23:21 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-17 23:21 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\vugysnkjyeid.sys
2008-01-16 10:13 . 2008-01-18 00:10 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 10:13 . 2008-01-17 23:19 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-16 10:13 . 2008-01-17 23:19 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-16 10:13 . 2008-01-17 23:19 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-06 03:00 . 2008-01-23 01:33 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-01-05 23:53 . 2004-07-13 15:47 421,888 --a------ C:\WINDOWS\Nero PhotoShow.scr
2008-01-05 21:08 . 2004-05-14 10:12 1,916,928 --------- C:\WINDOWS\UNNVEContent.exe
2008-01-05 21:08 . 2004-11-30 12:14 67,990 --------- C:\WINDOWS\UNNVEContent.cfg
2008-01-05 21:07 . 2008-01-05 21:07 <DIR> d-------- C:\WINDOWS\InCD
2008-01-05 21:07 . 2004-11-26 08:44 2,461,696 --------- C:\WINDOWS\UNMRW.exe
2008-01-05 21:07 . 2004-05-14 10:12 1,916,928 --------- C:\WINDOWS\UNAheadManual.exe
2008-01-05 21:07 . 2004-11-26 13:36 98,176 --a------ C:\WINDOWS\system32\drivers\InCDfs.sys
2008-01-05 21:07 . 2005-01-05 05:12 55,606 --------- C:\WINDOWS\UNMRW.cfg
2008-01-05 21:07 . 2004-05-06 04:06 33,193 --------- C:\WINDOWS\UNAheadManual.cfg
2008-01-05 21:07 . 2004-11-26 13:36 28,928 --a------ C:\WINDOWS\system32\drivers\InCDpass.sys
2008-01-05 21:07 . 2004-11-26 07:36 27,648 --a------ C:\WINDOWS\system32\drivers\InCDrm.sys
2008-01-05 21:07 . 2004-11-26 13:36 7,808 --a------ C:\WINDOWS\system32\drivers\InCDrec.sys
2008-01-05 21:06 . 2004-11-11 06:50 2,433,024 --------- C:\WINDOWS\UNNMP.exe
2008-01-05 21:06 . 2005-01-05 05:12 52,521 --------- C:\WINDOWS\UNNMP.cfg
2008-01-05 21:05 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-05 20:58 . 2008-01-05 23:51 <DIR> d-------- C:\Program Files\ahead
2008-01-05 20:58 . 2004-09-15 09:22 2,146,304 --------- C:\WINDOWS\UNNeroVision.exe
2008-01-05 20:58 . 2005-01-05 05:12 129,831 --------- C:\WINDOWS\UNNeroVision.cfg
2008-01-05 19:52 . 2008-01-05 21:04 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-05 19:52 . 2004-09-22 17:00 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2008-01-05 19:52 . 2004-09-22 17:00 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2008-01-05 19:52 . 2004-09-22 17:00 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2008-01-05 19:52 . 2004-09-22 17:00 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-01-05 19:52 . 2004-09-22 17:00 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2008-01-05 19:52 . 2004-09-22 17:00 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-01-05 19:52 . 2004-09-22 17:00 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2007-12-31 23:39 . 2007-12-31 23:39 <DIR> d-------- C:\Program Files\Common Files\Stardock
2007-12-31 23:39 . 2002-01-05 06:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-12-31 23:39 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-12-31 23:39 . 2002-01-05 06:38 54,784 --a------ C:\WINDOWS\system32\msvci70.dll
2007-12-31 23:39 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-12-31 23:28 . 2002-11-22 00:00 221,184 --a------ C:\WINDOWS\system32\DartSock.dll
2007-12-31 23:28 . 2002-11-25 00:00 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll
2007-12-31 23:28 . 2000-10-10 01:00 49,152 --a------ C:\WINDOWS\system32\DartObjects.dll
2007-12-31 23:27 . 2007-12-31 23:38 <DIR> d-------- C:\Program Files\Stardock

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 05:01 --------- d-----w C:\Program Files\DynDNS Updater
2008-01-21 07:15 --------- d-----w C:\Program Files\Trillian
2008-01-18 14:08 --------- d-----w C:\Program Files\McAfee
2008-01-18 04:41 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-01-11 08:12 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-10 23:48 --------- d-----w C:\Program Files\a-squared Anti-Malware
2007-12-10 01:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 22:02 --------- d-----w C:\Program Files\DO
2007-12-07 06:11 --------- d-----w C:\Program Files\Lavasoft
2007-12-07 06:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-03 06:46 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-29 03:16 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2007-11-27 23:08 --------- d-----w C:\Program Files\Common Files\McAfee
2007-11-18 07:38 63,488 ----a-w C:\WINDOWS\xobglu16.dll
2007-11-18 07:38 23,552 ----a-w C:\WINDOWS\xobglu32.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-24_ 1.01.53.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-24 05:51:02 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-25 05:47:27 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-24 05:51:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-25 05:47:27 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-24 05:51:02 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-25 05:47:27 229,376 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-24 05:51:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-25 05:47:27 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-24 05:51:02 5,476,352 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-25 05:47:27 5,476,352 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-24 05:51:02 155,648 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-25 05:47:27 155,648 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-23 23:12:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-25 04:15:37 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-23 23:12:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-25 04:15:37 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-25 04:15:37 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
"DynDNS Updater"="C:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 10:32 1352704]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 08:08 136136]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe" [2004-11-11 20:50 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP_STATUS_MONITOR"="C:\Program Files\Canon\MultiPASS\monitr32.exe" [ ]
"MPTBox"="C:\Program Files\Canon\MultiPASS\MPTBox.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-21 00:21 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SkyTel"="SkyTel.EXE" [2006-05-17 01:04 2879488 C:\WINDOWS\SkyTel.exe]
"SaiMfd"="C:\Program Files\Saitek\Software\SaiMfd.exe" [2005-06-17 18:02 126976]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-15 00:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [2005-06-14 14:23 159744]
"nwiz"="nwiz.exe" [2006-08-23 20:03 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-23 20:02 86016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-23 20:03 7630848]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2006-02-17 10:40 270336]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 07:44 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 07:44 1953792]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [ ]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 06:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 06:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 06:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 06:00 455168]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

C:\Documents and Settings\Daniel Cole\Start Menu\Programs\Startup\
Kremlin Sentry.LNK - C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe [2006-02-19 21:57:29 227840]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [1999-04-26 18:07]
S2 0123071200665193mcinstcleanup;McAfee Application Installer Cleanup (0123071200665193);C:\WINDOWS\TEMP\012307~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog []
S3 bfastfao;bfastfao;C:\DOCUME~1\DANIEL~1\LOCALS~1\Temp\bfastfao.sys []
S3 PciCon;PciCon;E:\PciCon.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80825ec2-d6d4-11db-9a64-806d6172696f}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83a0b37a-a16e-11dc-9aab-001a9244c33d}]
\Shell\AutoRun\command - F:\Lunch.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-23 13:20:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-15 06:02:33 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:00:01 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 00:53:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-25-2008, 08:26 AM   #7 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
Nice recovery on CFScript. Yes, that's correct. Not sure I've ever typo'd that, after thousands of scripts. Thankfully ComboFix and you acted correctly.

Log looks much better. Your machine should be behaving well.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the drop-down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-26-2008, 10:49 AM   #8 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
Don't seem to be quite done yet at least the online scan found some things it seems. Amazingly.

Hijack this log file
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18, on 2008-01-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - Startup: Kremlin Sentry.LNK = C:\Program Files\Mach5 Software\Kremlin\Kremlin Sentry.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) - https://w3s.webmoney.ru/WMAcceptor.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1174406505544
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1174406501873
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: McAfee Application Installer Cleanup (0123071200665193) (0123071200665193mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\012307~1.EXE (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MPService - Canon Information Systems, Inc. - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

--
End of file - 10907 bytes

The kapaskey log found some things but it only allows me to save it as web page not a text file...copy and paste from the web page it saved as

KASPERSKY ONLINE SCANNER REPORT
2008-01-25 11:17
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/01/2008
Kaspersky Anti-Virus database records: 532950
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 189512
Number of viruses found 10
Number of infected objects 25
Number of suspicious objects 0
Duration of the scan process 01:55:14

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{66445BA4-3C4F-42C4-B495-C524FBBBA8C9}.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{C57598F4-6ED4-4CC9-957C-133E4C3FF108}.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR2.tmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\cert8.db Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\history.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\key3.db Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\parent.lock Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Daniel Cole\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Daniel Cole\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Application Data\Mozilla\Firefox\Profiles\5w64bjgz.default\XUL.mfl Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\History\History.IE5\MSHist012008012520080126\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Temp\~DF28EA.tmp Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Cole\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Daniel Cole\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.dat Object is locked skipped
C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.idx Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ajqgklad.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\asltreif.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnl skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\baanmdvf.dll.vir Infected: Trojan.Win32.BHO.abs skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hlckvweg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ak skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hoiwrluv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nyidtmbw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\qpmaefwk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ebw skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\qtxvsmkh.dll.vir Infected: Trojan.Win32.BHO.abs skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tqqunkch.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wteluwnh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xqgcrbxh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ec skipped
C:\QooBox\Quarantine\catchme2008-01-24_ 05820.32.zip/mljjihe.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.atj skipped
C:\QooBox\Quarantine\catchme2008-01-24_ 05820.32.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP13\change.log Object is locked skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000644.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000646.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnl skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000649.dll Infected: Trojan.Win32.BHO.abs skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000655.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ak skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000657.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.eby skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000665.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000673.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ebw skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000674.dll Infected: Trojan.Win32.BHO.abs skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000678.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnp skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000683.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000686.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ec skipped
C:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP7\A0000701.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.atj skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\mcafee_w8QXT4qifehV3tq Object is locked skipped
C:\WINDOWS\Temp\mcmsc_BeUNcQbrvRS75FC Object is locked skipped
C:\WINDOWS\Temp\mcmsc_CsutCxG4g5jDzXf Object is locked skipped
C:\WINDOWS\Temp\mcmsc_H7sYTaPEQa8dSXx Object is locked skipped
C:\WINDOWS\Temp\mcmsc_WZKMcRPp9i0esZN Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{EC71D1EA-57CD-40C9-ACFC-111830100830}\RP13\change.log Object is locked skipped
Scan process completed.
Last edited by dacole; 01-26-2008 at 10:51 AM.
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-26-2008, 10:53 AM   #9 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
You should be presented with these images:





You should be able to use the dropdown, and change the file type.

<edit> We cross posted. That seems to be fine. </edit>
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-26-2008, 10:57 AM   #10 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
Items found by Kaspersky are in ComboFix quarantine, or System Restore points. They will be addressed by uninstalling ComboFix using the method described below.


Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs (if you don't already have them):
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • FIREWALL
    Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

    Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-26-2008, 03:17 PM   #11 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
Thank you so much! Just a few questions. First off as you are in my home state if you are ever near New Bern (I have no idea where Transylvania county is) let me know and I can buy you a beer. This forum has been very good to me.

My clock seems to be in 24 hour millitary time now at least it doesn't have the am or pm it used to have and I can't find a way to change it...

I use Microsoft update and it supposedly updates itself automatically is it still nessecary to go to their site?

Spyware blaster and IE spy add got in the beginning of this adventure. I will get MVPS even though your explanation of what it does went over my head..

I use Mcafee firewall and anti-virus and it is supposed to update itself automaticlly as well. It amazed me that something got through that..windows firewall comes up everytime I boot up my machine but I turn it off. I also use AdAware that shouldn't conflict with anything should it?

Been using trillian and firefox for a year now think I heard about them both here actually

Hadn't heard of ERUNT I'll use it now.
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-26-2008, 06:29 PM   #12 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,208
OS: 2000 Pro; XP Pro; XP Home


Re: Vundo Adclicker removal assistiance logs attached
I'm in WNC near Asheville. Don't get to the coast very often; thanks for the offer, it's the thought that counts.

Military time:

in Control Panel>Regional and Language Options

Regional Options tab> Customize

Time tab

Time Format box

h:mm:ss: tt

Ok your way out.

======================

AutoUpdates is fine. It's not a bad idea to visit from time to time, to make sure AutoUpdates is doing it's job.

======================

Ad-Aware should not conflict with any of those.

Cheers!
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-27-2008, 01:26 PM   #13 (permalink)
Registered User
 
Join Date: Jan 2008
Location: New Bern, North Carolina
Posts: 7
OS: Win XP service pack 2


Re: Vundo Adclicker removal assistiance logs attached
Ah I went up UNCA for college if I'm ever up that way again I"ll drop you a line. Thanks again!
dacole is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 11:06 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85