|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-19-2008, 11:49 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 6
OS: xp
|
Need help removing "mm27nov[1].exe", and other
I seem to have caught a by teh title above and althogh my symantec antivirus catches and supposedly deletes it, it keeps re-appearing, usually paired with anotehr .exe file such as 702595621.exe. Also getting pop-ups on internet explorer for teh first tiem ever.I have a 8 files located in my symantec quarntine listed as downloaders and trojan.adclickers... im sure thers plenty more that the scan hasnt picked up. I attached teh panda scan text and extra text from dds.Heres the dds log:
Deckard's System Scanner v20071014.68 Run by Tomek on 2008-01-19 13:26:43 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 2 Restore Point(s) -- 2: 2008-01-19 18:27:14 UTC - RP283 - Deckard's System Scanner Restore Point 1: 2008-01-18 19:55:37 UTC - RP282 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 255 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-01-19 13:31:18 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonNT.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\WINDOWS\explorer.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\Common Files\AOL\1163036108\ee\aolsoftware.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AIM6\aim6.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\AIM6\aolsoftware.exe C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\AZGF9IJ2\dss[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.roadrunner.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\superfindout.dll O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - C:\Program Files\Helper\superfindout.dll O2 - BHO: (no name) - {FC7FF7DC-C5F6-D3CA-D1F2-CD9E1FC437EB} - C:\WINDOWS\system32\iphttphl2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\Run: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\Run: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\Run: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\Run: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\Run: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\Run: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\Run: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\Run: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\Run: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\Run: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\Run: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\Run: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\Run: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\Run: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\Run: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\Run: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\Run: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\Run: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\Run: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\Run: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\Run: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\Run: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\Run: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\Run: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\Run: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\Run: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\Run: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\Run: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\Run: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\Run: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\Run: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\Run: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\Run: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\Run: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\Run: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\Run: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\Run: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\Run: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\Run: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\Run: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\Run: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\Run: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\Run: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\Run: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\Run: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\Run: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\Run: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\Run: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\Run: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\Run: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1000512.exe 61A847B5BBF72813329B385373FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310F3D1DC7E4638E8323A15806F97BDE4417E6FD967002BA754E2C2832217339926033AAC O4 - HKLM\..\Run: [troy44] C:\WINDOWS\troy44.exe O4 - HKLM\..\Run: [Kernel32_sysdamper] C:\WINDOWS\system32\drivers\sysdamp.exe O4 - HKLM\..\RunServices: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\RunServices: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\RunServices: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\RunServices: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\RunServices: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\RunServices: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\RunServices: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\RunServices: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\RunServices: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\RunServices: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\RunServices: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\RunServices: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\RunServices: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\RunServices: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\RunServices: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\RunServices: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\RunServices: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\RunServices: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\RunServices: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\RunServices: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\RunServices: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\RunServices: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\RunServices: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\RunServices: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\RunServices: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\RunServices: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\RunServices: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\RunServices: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\RunServices: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\RunServices: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\RunServices: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\RunServices: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\RunServices: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\RunServices: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\RunServices: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\RunServices: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\RunServices: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\RunServices: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\RunServices: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\RunServices: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\RunServices: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\RunServices: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\RunServices: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\RunServices: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\RunServices: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\RunServices: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\RunServices: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\RunServices: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\RunServices: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\RunServices: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\RunServices: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\RunServices: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe O4 - HKLM\..\RunOnce: [RemoveInstallPath] cmd.exe C:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "C:\PROGRA~1\Dot1XCfg" > nul O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\nwprovau.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1200715576843 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1200715543375 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonNT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE O23 - Service: Microsoft NAT Service (MSNAT) - Unknown owner - C:\WINDOWS\system32\msnat.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe service O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Print Spooler Service (uaijiteb5ooyei) - Unknown owner - C:\WINDOWS\system32\cjnr4r43236485.exe /service O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe -- End of file - 16530 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 SIODRV - c:\windows\system32\drivers\siodrv.sys <Not Verified; Intel Corporation; Intel(R) Active Monitor> R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> R3 SMBios (Intel (R) System Management BIOS Service) - c:\windows\system32\drivers\smbios.sys <Not Verified; Intel Corporation; Intel (R) System Management BIOS Driver> R3 smbusp (Intel(R) SMBus 2.0 Driver) - c:\windows\system32\drivers\smb.sys <Not Verified; Intel Corporation; Intel(R) SMBus Controller> S3 dump_wmimmc - c:\ijji\english\gunbound revolution\gameguard\dump_wmimmc.sys (file missing) S3 Jukebox3 - c:\windows\system32\drivers\ctpdusb.sys (file missing) S3 NAL (Nal Service ) - c:\windows\system32\drivers\iqvw32.sys <Not Verified; Intel Corporation; Intel(R) iQVW32.SYS> S3 npkcrypt - c:\program files\gravity\ro\npkcrypt.sys (file missing) S3 npkycryp - c:\program files\gravity\ro\npkycryp.sys (file missing) S3 NPPTNT2 - c:\windows\system32\npptnt2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT> S3 pxark - c:\windows\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> S3 STEAMDVR - c:\program files\valve\steam\bin\x86\steamdvr.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 imonNT (Intel(R) Active Monitor) - c:\program files\intel\intel(r) active monitor\imonnt.exe <Not Verified; Intel Corp.; Intel(R) Active Monitor> S2 Creative Service for CDROM Access - c:\windows\system32\ctsvccda.exe (file missing) S2 FCI - c:\windows\system32\svchost.exe:ext.exe (file missing) S2 MDM (Machine Debug Manager) - "c:\program files\common files\microsoft shared\vs7debug\mdm.exe" (file missing) S2 MSNAT (Microsoft NAT Service) - "c:\windows\system32\msnat.exe" (file missing) S2 Network Monitor - c:\program files\network monitor\netmon.exe service (file missing) S2 uaijiteb5ooyei (Print Spooler Service) - c:\windows\system32\cjnr4r43236485.exe /service (file missing) S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: PCI Simple Communications Controller Device ID: PCI\VEN_8086&DEV_1040&SUBSYS_10008086&REV_00\4&29817089&0&10F0 Manufacturer: Name: PCI Simple Communications Controller PNP Device ID: PCI\VEN_8086&DEV_1040&SUBSYS_10008086&REV_00\4&29817089&0&10F0 Service: -- Scheduled Tasks ------------------------------------------------------------- 2008-01-19 13:00:01 256 --ah----- C:\WINDOWS\Tasks\AF20026B907BB563.job -- Files created between 2007-12-19 and 2008-01-19 ----------------------------- 2008-01-18 23:00:18 0 d-------- C:\Program Files\SpywareBlaster 2008-01-18 22:51:28 65 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys 2008-01-18 22:51:28 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware> 2008-01-18 21  05 0 d-------- C:\WINDOWS\system32\ActiveScan2008-01-18 21 01 0 d-------- C:\WINDOWS\LastGood2008-01-18 15:33:43 10624 --a------ C:\WINDOWS\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> 2008-01-18 15:33:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-01-18 15:33:33 0 d-------- C:\Documents and Settings\Tomek\Application Data\PrevxCSI 2008-01-15 14:37:34 2 --a------ C:\344788627 2008-01-15 14:37:33 258127 --a------ C:\WINDOWS\system32\sysdamp.exe 2008-01-15 14:37:24 54764 --a------ C:\WINDOWS\system32\dxdss.sys 2008-01-15 14:37:19 212008 --a------ C:\WINDOWS\system32\iphttphl2.dll 2008-01-15 14:37:19 58880 --a------ C:\uxgq.exe 2008-01-15 14:36:04 0 d-------- C:\WINDOWS\system32\edcA17 2008-01-11 17:54:34 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor 2008-01-11 16:49:21 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll 2008-01-11 16:49:21 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> 2008-01-02 12:12:27 0 d-------- C:\Program Files\Temporary 2008-01-01 20:29:56 0 d-------- C:\Program Files\Helper 2008-01-01 20:29:06 54764 --a------ C:\WINDOWS\system32\xpdx.sys 2008-01-01 20:28:14 0 d-------- C:\WINDOWS\system32\ardCo17 -- Find3M Report --------------------------------------------------------------- 2008-01-18 22:24:36 0 d-------- C:\Program Files\Symantec AntiVirus 2008-01-18 22:14:57 0 d-------- C:\Program Files\Google 2008-01-18 22:12:07 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-18 22:09:21 0 d-------- C:\Program Files\AIM6 2008-01-18 20:59:45 0 d-------- C:\Program Files\Viewpoint 2008-01-11 17:54:50 0 d--h----- C:\Program Files\InstallShield Installation Information -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}] 01/18/2008 03:51 PM 15872 --a------ C:\Program Files\Helper\superfindout.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684CC}] 01/18/2008 03:51 PM 15872 --a------ C:\Program Files\Helper\superfindout.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC7FF7DC-C5F6-D3CA-D1F2-CD9E1FC437EB}] 01/15/2008 02:37 PM 212008 --a------ C:\WINDOWS\system32\iphttphl2.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 02:18 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/24/2006 02:24 AM] "HostManager"="C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe" [05/09/2006 07:24 PM] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [02/17/2006 11:59 AM] "cjnr4r42986185"="C:\WINDOWS\system32\cjnr4r42986185.exe" [] "nlkfev76087652"="C:\WINDOWS\system32\nlkfev76087652.exe" [] "cjnr4r42192690"="C:\WINDOWS\system32\cjnr4r42192690.exe" [] "cjnr4r43639770"="C:\WINDOWS\system32\cjnr4r43639770.exe" [] "nlkfev72724542"="C:\WINDOWS\system32\nlkfev72724542.exe" [] "cjnr4r476025"="C:\WINDOWS\system32\cjnr4r476025.exe" [] "cjnr4r47663240"="C:\WINDOWS\system32\cjnr4r47663240.exe" [] "cjnr4r41198495"="C:\WINDOWS\system32\cjnr4r41198495.exe" [] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "dior4f43929931"="C:\WINDOWS\system32\dior4f43929931.exe" [] "mlsdf8h3548229"="C:\WINDOWS\system32\mlsdf8h3548229.exe" [] "cjnr4r42264435"="C:\WINDOWS\system32\cjnr4r42264435.exe" [] "nlkfev79403662"="C:\WINDOWS\system32\nlkfev79403662.exe" [] "cjnr4r42273260"="C:\WINDOWS\system32\cjnr4r42273260.exe" [] "sklrr7y4712878"="C:\WINDOWS\system32\sklrr7y4712878.exe" [] "dior4f47934371"="C:\WINDOWS\system32\dior4f47934371.exe" [] "sklrr7y9546028"="C:\WINDOWS\system32\sklrr7y9546028.exe" [] "nlkfev79015397"="C:\WINDOWS\system32\nlkfev79015397.exe" [] "sklrr7y5688178"="C:\WINDOWS\system32\sklrr7y5688178.exe" [] "sklrr7y2715978"="C:\WINDOWS\system32\sklrr7y2715978.exe" [] "cjnr4r46193640"="C:\WINDOWS\system32\cjnr4r46193640.exe" [] "nlkfev77533962"="C:\WINDOWS\system32\nlkfev77533962.exe" [] "sklrr7y6312728"="C:\WINDOWS\system32\sklrr7y6312728.exe" [] "cjnr4r43337735"="C:\WINDOWS\system32\cjnr4r43337735.exe" [] "sklrr7y8168548"="C:\WINDOWS\system32\sklrr7y8168548.exe" [] "sklrr7y1871983"="C:\WINDOWS\system32\sklrr7y1871983.exe" [] "sklrr7y7508933"="C:\WINDOWS\system32\sklrr7y7508933.exe" [] "nlkfev71825087"="C:\WINDOWS\system32\nlkfev71825087.exe" [] "nlkfev73246982"="C:\WINDOWS\system32\nlkfev73246982.exe" [] "dior4f47282931"="C:\WINDOWS\system32\dior4f47282931.exe" [] "nlkfev75326202"="C:\WINDOWS\system32\nlkfev75326202.exe" [] "mlsdf8h8887034"="C:\WINDOWS\system32\mlsdf8h8887034.exe" [] "dior4f43695691"="C:\WINDOWS\system32\dior4f43695691.exe" [] "nlkfev74649652"="C:\WINDOWS\system32\nlkfev74649652.exe" [] "cjnr4r44112275"="C:\WINDOWS\system32\cjnr4r44112275.exe" [] "sklrr7y2746243"="C:\WINDOWS\system32\sklrr7y2746243.exe" [] "mlsdf8h1076759"="C:\WINDOWS\system32\mlsdf8h1076759.exe" [] "cjnr4r43726670"="C:\WINDOWS\system32\cjnr4r43726670.exe" [] "mlsdf8h2532124"="C:\WINDOWS\system32\mlsdf8h2532124.exe" [] "cjnr4r44741090"="C:\WINDOWS\system32\cjnr4r44741090.exe" [] "mlsdf8h7618944"="C:\WINDOWS\system32\mlsdf8h7618944.exe" [] "mlsdf8h8742639"="C:\WINDOWS\system32\mlsdf8h8742639.exe" [] "cjnr4r43416115"="C:\WINDOWS\system32\cjnr4r43416115.exe" [] "cjnr4r47649280"="C:\WINDOWS\system32\cjnr4r47649280.exe" [] "sklrr7y3730863"="C:\WINDOWS\system32\sklrr7y3730863.exe" [] "cjnr4r43236485"="C:\WINDOWS\system32\cjnr4r43236485.exe" [] "dior4f49385346"="C:\WINDOWS\system32\dior4f49385346.exe" [] "sklrr7y6004428"="C:\WINDOWS\system32\sklrr7y6004428.exe" [] "sklrr7y996773"="C:\WINDOWS\system32\sklrr7y996773.exe" [] "sklrr7y1053608"="C:\WINDOWS\system32\sklrr7y1053608.exe" [] "mlsdf8h7611949"="C:\WINDOWS\system32\mlsdf8h7611949.exe" [] "cjnr4r497715"="C:\WINDOWS\system32\cjnr4r497715.exe" [] "A2E1F63A"="C:\WINDOWS\system32\nlkfev77134272.exe" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 01:03 PM] "SNM"="C:\Program Files\SpyNoMore\SNM.exe" [] "runner1"="C:\WINDOWS\mrofinu1000512.exe" [] "troy44"="C:\WINDOWS\troy44.exe" [] "Kernel32_sysdamper"="C:\WINDOWS\system32\drivers\sysdamp.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/01/2006 01:32 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/20/2007 04:45 PM] "kernel"="C:\Program Files\kernel\kernel.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "RemoveInstallPath"=cmd.exe C:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "C:\PROGRA~1\Dot1XCfg" > nul [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "cjnr4r42986185"=C:\WINDOWS\system32\cjnr4r42986185.exe "nlkfev76087652"=C:\WINDOWS\system32\nlkfev76087652.exe "cjnr4r42192690"=C:\WINDOWS\system32\cjnr4r42192690.exe "cjnr4r43639770"=C:\WINDOWS\system32\cjnr4r43639770.exe "nlkfev72724542"=C:\WINDOWS\system32\nlkfev72724542.exe "cjnr4r476025"=C:\WINDOWS\system32\cjnr4r476025.exe "cjnr4r47663240"=C:\WINDOWS\system32\cjnr4r47663240.exe "cjnr4r41198495"=C:\WINDOWS\system32\cjnr4r41198495.exe "dior4f43929931"=C:\WINDOWS\system32\dior4f43929931.exe "mlsdf8h3548229"=C:\WINDOWS\system32\mlsdf8h3548229.exe "cjnr4r42264435"=C:\WINDOWS\system32\cjnr4r42264435.exe "nlkfev79403662"=C:\WINDOWS\system32\nlkfev79403662.exe "cjnr4r42273260"=C:\WINDOWS\system32\cjnr4r42273260.exe "sklrr7y4712878"=C:\WINDOWS\system32\sklrr7y4712878.exe "dior4f47934371"=C:\WINDOWS\system32\dior4f47934371.exe "sklrr7y9546028"=C:\WINDOWS\system32\sklrr7y9546028.exe "nlkfev79015397"=C:\WINDOWS\system32\nlkfev79015397.exe "sklrr7y5688178"=C:\WINDOWS\system32\sklrr7y5688178.exe "sklrr7y2715978"=C:\WINDOWS\system32\sklrr7y2715978.exe "cjnr4r46193640"=C:\WINDOWS\system32\cjnr4r46193640.exe "nlkfev77533962"=C:\WINDOWS\system32\nlkfev77533962.exe "sklrr7y6312728"=C:\WINDOWS\system32\sklrr7y6312728.exe "cjnr4r43337735"=C:\WINDOWS\system32\cjnr4r43337735.exe "sklrr7y8168548"=C:\WINDOWS\system32\sklrr7y8168548.exe "sklrr7y1871983"=C:\WINDOWS\system32\sklrr7y1871983.exe "sklrr7y7508933"=C:\WINDOWS\system32\sklrr7y7508933.exe "nlkfev71825087"=C:\WINDOWS\system32\nlkfev71825087.exe "nlkfev73246982"=C:\WINDOWS\system32\nlkfev73246982.exe "dior4f47282931"=C:\WINDOWS\system32\dior4f47282931.exe "nlkfev75326202"=C:\WINDOWS\system32\nlkfev75326202.exe "mlsdf8h8887034"=C:\WINDOWS\system32\mlsdf8h8887034.exe "dior4f43695691"=C:\WINDOWS\system32\dior4f43695691.exe "nlkfev74649652"=C:\WINDOWS\system32\nlkfev74649652.exe "cjnr4r44112275"=C:\WINDOWS\system32\cjnr4r44112275.exe "sklrr7y2746243"=C:\WINDOWS\system32\sklrr7y2746243.exe "mlsdf8h1076759"=C:\WINDOWS\system32\mlsdf8h1076759.exe "cjnr4r43726670"=C:\WINDOWS\system32\cjnr4r43726670.exe "mlsdf8h2532124"=C:\WINDOWS\system32\mlsdf8h2532124.exe "cjnr4r44741090"=C:\WINDOWS\system32\cjnr4r44741090.exe "mlsdf8h7618944"=C:\WINDOWS\system32\mlsdf8h7618944.exe "mlsdf8h8742639"=C:\WINDOWS\system32\mlsdf8h8742639.exe "cjnr4r43416115"=C:\WINDOWS\system32\cjnr4r43416115.exe "cjnr4r47649280"=C:\WINDOWS\system32\cjnr4r47649280.exe "sklrr7y3730863"=C:\WINDOWS\system32\sklrr7y3730863.exe "cjnr4r43236485"=C:\WINDOWS\system32\cjnr4r43236485.exe "dior4f49385346"=C:\WINDOWS\system32\dior4f49385346.exe "sklrr7y6004428"=C:\WINDOWS\system32\sklrr7y6004428.exe "sklrr7y996773"=C:\WINDOWS\system32\sklrr7y996773.exe "sklrr7y1053608"=C:\WINDOWS\system32\sklrr7y1053608.exe "mlsdf8h7611949"=C:\WINDOWS\system32\mlsdf8h7611949.exe "cjnr4r497715"=C:\WINDOWS\system32\cjnr4r497715.exe "A2E1F63A"=C:\WINDOWS\system32\nlkfev77134272.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04cg0ryk.dll] RUNDLL32.EXE 04cg0ryk.dll,b 12805156 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64 CHIC FAST TRAY] C:\Documents and Settings\All Users\Application Data\GLOBALDOG64CHIC\Hideamen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Biasheart] C:\DOCUME~1\User\APPLIC~1\antielse\Onlinebashwin.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU1] C:\Program Files\Common Files\VCClient\VCClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU2] C:\Program Files\Common Files\VCClient\VCMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\httskm] C:\WINDOWS\system32\httskm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsysupd] C:\windows\winsysupd.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7cc575c4-fb84-11d8-8e10-806d6172696f}] AutoRun\command- E:\Setup.exe *Newly Created Service* - GTNDIS5 *Newly Created Service* - RKPAVPROC -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.doubleclick.net 127.0.0.1 ad.preferances.com 127.0.0.1 ad.doubleclick.com 127.0.0.1 ads.web.aol.com 127.0.0.1 ad.doubleclick.net 127.0.0.1 ad.preferences.com 127.0.0.1 ad.washingtonpost.com 127.0.0.1 adpick.switchboard.com 127.0.0.1 ads.doubleclick.com 127.0.0.1 ads.infospace.com 687 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-01-19 13:33:54 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-20-2008, 04:29 AM
|
#2 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing "mm27nov[1].exe", and other
Hi,
Please move DSS to your desktop. Currently, it's in a temp folder: C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\AZGF9IJ2\dss[1].exe It will be deleted if a tool empties the temp folder. ______ Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
__________________
UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 01-20-2008 at 04:34 AM. |
|
|
|
|
01-20-2008, 07:42 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 6
OS: xp
|
Re: Need help removing "mm27nov[1].exe", and other
Hey, thanks for the quick reply
 everything seemed to go well with the scans, here are teh results (report.txt, main.txt)SDFix: Version 1.129 Run by Tomek on Sun 01/20/2008 at 09:00 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\Tomek\Desktop\SDFix Safe Mode: Checking Services: Name: FCI Network Monitor uaijiteb5ooyei Path: C:\WINDOWS\system32\svchost.exe:ext.exe C:\Program Files\Network Monitor\netmon.exe service C:\WINDOWS\system32\cjnr4r43236485.exe /service FCI - Deleted Network Monitor - Deleted uaijiteb5ooyei - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Service mp32 - Deleted after Reboot Service xpdx - Deleted after Reboot Normal Mode: Checking Files: Trojan Files Found: C:\344788~1 - Deleted C:\Program Files\Helper\superfinderusa.dll - Deleted C:\Program Files\Helper\superfindout.dll - Deleted C:\Program Files\Temporary\kernInstall.exe - Deleted C:\b?_log.txt - Deleted C:\WINDOWS\Uninst2.htm - Deleted C:\WINDOWS\Unist1.htm - Deleted C:\WINDOWS\system32\xpdx.sys - Deleted C:\WINDOWS\system32\dxdss.sys - Deleted Folder C:\Program Files\Helper - Removed Folder C:\Program Files\Network Monitor - Removed Folder C:\Program Files\Temporary - Removed Folder C:\Temp\abW9 - Removed Folder C:\WINDOWS\system32\f02WtR - Removed Folder C:\WINDOWS\system32\rMa17yy - Removed Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-20 09:29:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer" "C:\\Documents and Settings\\User\\Local Settings\\Temporary Internet Files\\Content.IE5\\K94TI1W3\\WoWMovieDownloader-EnUS[1].exe"="C:\\Documents and Settings\\User\\Local Settings\\Temporary Internet Files\\Content.IE5\\K94TI1W3\\WoWMovieDownloader-EnUS[1].exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\Warcraft III\\war3.exe"="C:\\Program Files\\Warcraft III\\war3.exe:*:Enabled:Warcraft III" "C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "C:\\Program Files\\World of Warcraft\\WoW-1.6.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.6.0.4500-to-1.6.1-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.0.4500-to-1.6.1-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.7.1.4695-to-1.8.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.7.1.4695-to-1.8.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service" "C:\\Program Files\\Valve\\Steam\\SteamApps\\ilovepolishwomen\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\ilovepolishwomen\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\World of Warcraft\\WoW-1.5.1.4449-to-1.9.0.4937-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.5.1.4449-to-1.9.0.4937-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" "C:\\Documents and Settings\\User\\My Documents\\Tomek's Folder\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\User\\My Documents\\Tomek's Folder\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\Valve\\Steam\\SteamApps\\ilovepolishwomen\\day of defeat\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\ilovepolishwomen\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Valve\\Steam\\SteamApps\\matt23375\\half-life\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\matt23375\\half-life\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Diablo\\diablo.exe"="C:\\Program Files\\Diablo\\diablo.exe:*:Enabled:Diablo" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Documents and Settings\\User\\My Documents\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\User\\My Documents\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Documents and Settings\\Tomek\\.limewire\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Tomek\\.limewire\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Documents and Settings\\Tomek\\My Documents\\.limewire\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Tomek\\My Documents\\.limewire\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Documents and Settings\\Tomek\\My Documents\\LimeWire\\.limewire\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Tomek\\My Documents\\LimeWire\\.limewire\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Documents and Settings\\Tomek\\My Documents\\Tomeks Folder\\LimeWire\\.limewire\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Tomek\\My Documents\\Tomeks Folder\\LimeWire\\.limewire\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Common Files\\AOL\\1163036108\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1163036108\\ee\\aolsoftware.exe:*:Enabled:AOL Services" "C:\\Program Files\\Common Files\\AOL\\1163036108\\ee\\aim6.exe"="C:\\Program Files\\Common Files\\AOL\\1163036108\\ee\\aim6.exe:*:Enabled:AIM" "C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:svchost" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger" Remaining Files: --------------- File Backups: - C:\DOCUME~1\Tomek\Desktop\SDFix\backups\backups.zip Files with Hidden Attributes: Sun 26 Nov 2006 162 A..H. --- "C:\Program Files\QuickTime\~$qttask.exe" Sun 26 Nov 2006 162 A..H. --- "C:\Program Files\Symantec AntiVirus\~$VPTray.exe" Wed 13 Apr 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 26 Nov 2006 162 A..H. --- "C:\Program Files\Common Files\AOL\Launch\~$llaunch.exe" Sun 26 Nov 2006 162 A..H. --- "C:\Program Files\Java\jre1.5.0_06\bin\~$usched.exe" Thu 9 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~10C.tmp" Fri 17 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~11B.tmp" Tue 10 Apr 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~12.tmp" Fri 7 Sep 2007 215,040 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~15D.tmp" Fri 10 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~2C.tmp" Sun 22 Jul 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~40.tmp" Mon 13 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~5A.tmp" Mon 23 Jul 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~5C.tmp" Sun 2 Sep 2007 214,528 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~5F.tmp" Sat 21 Jul 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~641.tmp" Sat 7 Apr 2007 122,880 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~723.tmp" Sun 8 Apr 2007 122,880 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~8.tmp" Sun 19 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~832.tmp" Mon 20 Aug 2007 214,528 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~874.tmp" Sat 11 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~9.tmp" Tue 4 Sep 2007 214,528 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~A7.tmp" Mon 16 Jul 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~D0.tmp" Thu 16 Aug 2007 126,976 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~D3.tmp" Mon 9 Apr 2007 122,880 A..H. --- "C:\Deckard\System Scanner\backup\DOCUME~1\Tomek\LOCALS~1\Temp\~F.tmp" Finished! Deckard's System Scanner v20071014.68 Run by Tomek on 2008-01-20 09:35:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- Percentage of Memory in Use: 76% (more than 75%). Total Physical Memory: 255 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-01-20 09:36:42 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\explorer.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonNT.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\Common Files\AOL\1163036108\ee\aolsoftware.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Tomek\Desktop\dss[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.roadrunner.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: (no name) - {FC7FF7DC-C5F6-D3CA-D1F2-CD9E1FC437EB} - C:\WINDOWS\system32\iphttphl2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\Run: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\Run: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\Run: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\Run: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\Run: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\Run: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\Run: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\Run: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\Run: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\Run: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\Run: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\Run: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\Run: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\Run: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\Run: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\Run: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\Run: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\Run: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\Run: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\Run: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\Run: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\Run: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\Run: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\Run: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\Run: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\Run: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\Run: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\Run: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\Run: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\Run: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\Run: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\Run: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\Run: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\Run: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\Run: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\Run: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\Run: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\Run: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\Run: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\Run: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\Run: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\Run: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\Run: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\Run: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\Run: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\Run: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\Run: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\Run: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\Run: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\Run: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup O4 - HKLM\..\Run: [troy44] C:\WINDOWS\troy44.exe O4 - HKLM\..\Run: [Kernel32_sysdamper] C:\WINDOWS\system32\drivers\sysdamp.exe O4 - HKLM\..\RunServices: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\RunServices: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\RunServices: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\RunServices: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\RunServices: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\RunServices: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\RunServices: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\RunServices: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\RunServices: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\RunServices: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\RunServices: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\RunServices: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\RunServices: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\RunServices: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\RunServices: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\RunServices: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\RunServices: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\RunServices: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\RunServices: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\RunServices: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\RunServices: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\RunServices: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\RunServices: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\RunServices: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\RunServices: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\RunServices: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\RunServices: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\RunServices: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\RunServices: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\RunServices: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\RunServices: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\RunServices: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\RunServices: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\RunServices: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\RunServices: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\RunServices: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\RunServices: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\RunServices: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\RunServices: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\RunServices: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\RunServices: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\RunServices: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\RunServices: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\RunServices: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\RunServices: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\RunServices: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\RunServices: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\RunServices: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\RunServices: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\RunServices: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\RunServices: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\RunServices: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\nwprovau.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1200715576843 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1200715543375 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonNT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE O23 - Service: Microsoft NAT Service (MSNAT) - Unknown owner - C:\WINDOWS\system32\msnat.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe -- End of file - 15481 bytes -- Files created between 2007-12-20 and 2008-01-20 ----------------------------- 2008-01-20 08:59:22 0 d-------- C:\WINDOWS\ERUNT 2008-01-18 23:00:18 0 d-------- C:\Program Files\SpywareBlaster 2008-01-18 21 05 0 d-------- C:\WINDOWS\system32\ActiveScan2008-01-18 15:33:43 10624 --a------ C:\WINDOWS\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> 2008-01-18 15:33:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-01-18 15:33:33 0 d-------- C:\Documents and Settings\Tomek\Application Data\PrevxCSI 2008-01-15 14:37:33 258127 --a------ C:\WINDOWS\system32\sysdamp.exe 2008-01-15 14:37:19 212008 --a------ C:\WINDOWS\system32\iphttphl2.dll 2008-01-15 14:37:19 58880 --a------ C:\uxgq.exe 2008-01-15 14:36:04 0 d-------- C:\WINDOWS\system32\edcA17 2008-01-11 17:54:34 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor 2008-01-11 16:49:21 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll 2008-01-11 16:49:21 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> 2008-01-01 20:28:14 0 d-------- C:\WINDOWS\system32\ardCo17 -- Find3M Report --------------------------------------------------------------- 2008-01-20 09:25:26 0 d-------- C:\Program Files\Symantec AntiVirus 2008-01-18 22:14:57 0 d-------- C:\Program Files\Google 2008-01-18 22:12:07 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-18 22:09:21 0 d-------- C:\Program Files\AIM6 2008-01-18 20:59:45 0 d-------- C:\Program Files\Viewpoint 2008-01-11 17:54:50 0 d--h----- C:\Program Files\InstallShield Installation Information -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC7FF7DC-C5F6-D3CA-D1F2-CD9E1FC437EB}] 01/15/2008 02:37 PM 212008 --a------ C:\WINDOWS\system32\iphttphl2.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 02:18 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/24/2006 02:24 AM] "HostManager"="C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe" [05/09/2006 07:24 PM] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [02/17/2006 11:59 AM] "cjnr4r42986185"="C:\WINDOWS\system32\cjnr4r42986185.exe" [] "nlkfev76087652"="C:\WINDOWS\system32\nlkfev76087652.exe" [] "cjnr4r42192690"="C:\WINDOWS\system32\cjnr4r42192690.exe" [] "cjnr4r43639770"="C:\WINDOWS\system32\cjnr4r43639770.exe" [] "nlkfev72724542"="C:\WINDOWS\system32\nlkfev72724542.exe" [] "cjnr4r476025"="C:\WINDOWS\system32\cjnr4r476025.exe" [] "cjnr4r47663240"="C:\WINDOWS\system32\cjnr4r47663240.exe" [] "cjnr4r41198495"="C:\WINDOWS\system32\cjnr4r41198495.exe" [] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "dior4f43929931"="C:\WINDOWS\system32\dior4f43929931.exe" [] "mlsdf8h3548229"="C:\WINDOWS\system32\mlsdf8h3548229.exe" [] "cjnr4r42264435"="C:\WINDOWS\system32\cjnr4r42264435.exe" [] "nlkfev79403662"="C:\WINDOWS\system32\nlkfev79403662.exe" [] "cjnr4r42273260"="C:\WINDOWS\system32\cjnr4r42273260.exe" [] "sklrr7y4712878"="C:\WINDOWS\system32\sklrr7y4712878.exe" [] "dior4f47934371"="C:\WINDOWS\system32\dior4f47934371.exe" [] "sklrr7y9546028"="C:\WINDOWS\system32\sklrr7y9546028.exe" [] "nlkfev79015397"="C:\WINDOWS\system32\nlkfev79015397.exe" [] "sklrr7y5688178"="C:\WINDOWS\system32\sklrr7y5688178.exe" [] "sklrr7y2715978"="C:\WINDOWS\system32\sklrr7y2715978.exe" [] "cjnr4r46193640"="C:\WINDOWS\system32\cjnr4r46193640.exe" [] "nlkfev77533962"="C:\WINDOWS\system32\nlkfev77533962.exe" [] "sklrr7y6312728"="C:\WINDOWS\system32\sklrr7y6312728.exe" [] "cjnr4r43337735"="C:\WINDOWS\system32\cjnr4r43337735.exe" [] "sklrr7y8168548"="C:\WINDOWS\system32\sklrr7y8168548.exe" [] "sklrr7y1871983"="C:\WINDOWS\system32\sklrr7y1871983.exe" [] "sklrr7y7508933"="C:\WINDOWS\system32\sklrr7y7508933.exe" [] "nlkfev71825087"="C:\WINDOWS\system32\nlkfev71825087.exe" [] "nlkfev73246982"="C:\WINDOWS\system32\nlkfev73246982.exe" [] "dior4f47282931"="C:\WINDOWS\system32\dior4f47282931.exe" [] "nlkfev75326202"="C:\WINDOWS\system32\nlkfev75326202.exe" [] "mlsdf8h8887034"="C:\WINDOWS\system32\mlsdf8h8887034.exe" [] "dior4f43695691"="C:\WINDOWS\system32\dior4f43695691.exe" [] "nlkfev74649652"="C:\WINDOWS\system32\nlkfev74649652.exe" [] "cjnr4r44112275"="C:\WINDOWS\system32\cjnr4r44112275.exe" [] "sklrr7y2746243"="C:\WINDOWS\system32\sklrr7y2746243.exe" [] "mlsdf8h1076759"="C:\WINDOWS\system32\mlsdf8h1076759.exe" [] "cjnr4r43726670"="C:\WINDOWS\system32\cjnr4r43726670.exe" [] "mlsdf8h2532124"="C:\WINDOWS\system32\mlsdf8h2532124.exe" [] "cjnr4r44741090"="C:\WINDOWS\system32\cjnr4r44741090.exe" [] "mlsdf8h7618944"="C:\WINDOWS\system32\mlsdf8h7618944.exe" [] "mlsdf8h8742639"="C:\WINDOWS\system32\mlsdf8h8742639.exe" [] "cjnr4r43416115"="C:\WINDOWS\system32\cjnr4r43416115.exe" [] "cjnr4r47649280"="C:\WINDOWS\system32\cjnr4r47649280.exe" [] "sklrr7y3730863"="C:\WINDOWS\system32\sklrr7y3730863.exe" [] "cjnr4r43236485"="C:\WINDOWS\system32\cjnr4r43236485.exe" [] "dior4f49385346"="C:\WINDOWS\system32\dior4f49385346.exe" [] "sklrr7y6004428"="C:\WINDOWS\system32\sklrr7y6004428.exe" [] "sklrr7y996773"="C:\WINDOWS\system32\sklrr7y996773.exe" [] "sklrr7y1053608"="C:\WINDOWS\system32\sklrr7y1053608.exe" [] "mlsdf8h7611949"="C:\WINDOWS\system32\mlsdf8h7611949.exe" [] "cjnr4r497715"="C:\WINDOWS\system32\cjnr4r497715.exe" [] "A2E1F63A"="C:\WINDOWS\system32\nlkfev77134272.exe" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 01:03 PM] "SNM"="C:\Program Files\SpyNoMore\SNM.exe" [] "troy44"="C:\WINDOWS\troy44.exe" [] "Kernel32_sysdamper"="C:\WINDOWS\system32\drivers\sysdamp.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/01/2006 01:32 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/20/2007 04:45 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "cjnr4r42986185"=C:\WINDOWS\system32\cjnr4r42986185.exe "nlkfev76087652"=C:\WINDOWS\system32\nlkfev76087652.exe "cjnr4r42192690"=C:\WINDOWS\system32\cjnr4r42192690.exe "cjnr4r43639770"=C:\WINDOWS\system32\cjnr4r43639770.exe "nlkfev72724542"=C:\WINDOWS\system32\nlkfev72724542.exe "cjnr4r476025"=C:\WINDOWS\system32\cjnr4r476025.exe "cjnr4r47663240"=C:\WINDOWS\system32\cjnr4r47663240.exe "cjnr4r41198495"=C:\WINDOWS\system32\cjnr4r41198495.exe "dior4f43929931"=C:\WINDOWS\system32\dior4f43929931.exe "mlsdf8h3548229"=C:\WINDOWS\system32\mlsdf8h3548229.exe "cjnr4r42264435"=C:\WINDOWS\system32\cjnr4r42264435.exe "nlkfev79403662"=C:\WINDOWS\system32\nlkfev79403662.exe "cjnr4r42273260"=C:\WINDOWS\system32\cjnr4r42273260.exe "sklrr7y4712878"=C:\WINDOWS\system32\sklrr7y4712878.exe "dior4f47934371"=C:\WINDOWS\system32\dior4f47934371.exe "sklrr7y9546028"=C:\WINDOWS\system32\sklrr7y9546028.exe "nlkfev79015397"=C:\WINDOWS\system32\nlkfev79015397.exe "sklrr7y5688178"=C:\WINDOWS\system32\sklrr7y5688178.exe "sklrr7y2715978"=C:\WINDOWS\system32\sklrr7y2715978.exe "cjnr4r46193640"=C:\WINDOWS\system32\cjnr4r46193640.exe "nlkfev77533962"=C:\WINDOWS\system32\nlkfev77533962.exe "sklrr7y6312728"=C:\WINDOWS\system32\sklrr7y6312728.exe "cjnr4r43337735"=C:\WINDOWS\system32\cjnr4r43337735.exe "sklrr7y8168548"=C:\WINDOWS\system32\sklrr7y8168548.exe "sklrr7y1871983"=C:\WINDOWS\system32\sklrr7y1871983.exe "sklrr7y7508933"=C:\WINDOWS\system32\sklrr7y7508933.exe "nlkfev71825087"=C:\WINDOWS\system32\nlkfev71825087.exe "nlkfev73246982"=C:\WINDOWS\system32\nlkfev73246982.exe "dior4f47282931"=C:\WINDOWS\system32\dior4f47282931.exe "nlkfev75326202"=C:\WINDOWS\system32\nlkfev75326202.exe "mlsdf8h8887034"=C:\WINDOWS\system32\mlsdf8h8887034.exe "dior4f43695691"=C:\WINDOWS\system32\dior4f43695691.exe "nlkfev74649652"=C:\WINDOWS\system32\nlkfev74649652.exe "cjnr4r44112275"=C:\WINDOWS\system32\cjnr4r44112275.exe "sklrr7y2746243"=C:\WINDOWS\system32\sklrr7y2746243.exe "mlsdf8h1076759"=C:\WINDOWS\system32\mlsdf8h1076759.exe "cjnr4r43726670"=C:\WINDOWS\system32\cjnr4r43726670.exe "mlsdf8h2532124"=C:\WINDOWS\system32\mlsdf8h2532124.exe "cjnr4r44741090"=C:\WINDOWS\system32\cjnr4r44741090.exe "mlsdf8h7618944"=C:\WINDOWS\system32\mlsdf8h7618944.exe "mlsdf8h8742639"=C:\WINDOWS\system32\mlsdf8h8742639.exe "cjnr4r43416115"=C:\WINDOWS\system32\cjnr4r43416115.exe "cjnr4r47649280"=C:\WINDOWS\system32\cjnr4r47649280.exe "sklrr7y3730863"=C:\WINDOWS\system32\sklrr7y3730863.exe "cjnr4r43236485"=C:\WINDOWS\system32\cjnr4r43236485.exe "dior4f49385346"=C:\WINDOWS\system32\dior4f49385346.exe "sklrr7y6004428"=C:\WINDOWS\system32\sklrr7y6004428.exe "sklrr7y996773"=C:\WINDOWS\system32\sklrr7y996773.exe "sklrr7y1053608"=C:\WINDOWS\system32\sklrr7y1053608.exe "mlsdf8h7611949"=C:\WINDOWS\system32\mlsdf8h7611949.exe "cjnr4r497715"=C:\WINDOWS\system32\cjnr4r497715.exe "A2E1F63A"=C:\WINDOWS\system32\nlkfev77134272.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04cg0ryk.dll] RUNDLL32.EXE 04cg0ryk.dll,b 12805156 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64 CHIC FAST TRAY] C:\Documents and Settings\All Users\Application Data\GLOBALDOG64CHIC\Hideamen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Biasheart] C:\DOCUME~1\User\APPLIC~1\antielse\Onlinebashwin.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU1] C:\Program Files\Common Files\VCClient\VCClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU2] C:\Program Files\Common Files\VCClient\VCMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\httskm] C:\WINDOWS\system32\httskm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsysupd] C:\windows\winsysupd.exe *Newly Created Service* - GTNDIS5 *Newly Created Service* - MP32 *Newly Created Service* - XPDX -- End of Deckard's System Scanner: finished at 2008-01-20 09:37:52 ------------ |
|
|
|
|
01-21-2008, 12:40 AM
|
#4 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing "mm27nov[1].exe", and other
Hi,
*Uninstall the items in bold if found: Internet Explorer Secure Bar Safety Alert 2006 Messenger Service *A few optionals that I would recommend be uninstalled. LimeWire 4.14.10 This program is very likely the reason your system is infested with malware. Even when a program like this is not infected itself, it will still bring malware into your system because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. I recommend that you remove this program from your system. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". In 2006, this may change, read Viewpoint to Plunge Into Adware. *Click Start > Control Panel > Add or Remove Programs and uninstall the items I listed in bold if found. Delete the following folders if you uninstalled their corresponding programs: C:\Program Files\Viewpoint C:\Program Files\LimeWire C:\Documents and Settings\Tomek\.limewire ________ Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold. O2 - BHO: (no name) - {FC7FF7DC-C5F6-D3CA-D1F2-CD9E1FC437EB} - C:\WINDOWS\system32\iphttphl2.dll O4 - HKLM\..\Run: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\Run: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\Run: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\Run: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\Run: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\Run: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\Run: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\Run: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\Run: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\Run: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\Run: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\Run: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\Run: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\Run: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\Run: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\Run: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\Run: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\Run: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\Run: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\Run: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\Run: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\Run: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\Run: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\Run: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\Run: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\Run: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\Run: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\Run: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\Run: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\Run: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\Run: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\Run: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\Run: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\Run: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\Run: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\Run: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\Run: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\Run: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\Run: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\Run: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\Run: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\Run: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\Run: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\Run: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\Run: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\Run: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\Run: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\Run: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\Run: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\Run: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\Run: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe O4 - HKLM\..\Run: [troy44] C:\WINDOWS\troy44.exe O4 - HKLM\..\Run: [Kernel32_sysdamper] C:\WINDOWS\system32\drivers\sysdamp.exe O4 - HKLM\..\RunServices: [cjnr4r42986185] C:\WINDOWS\system32\cjnr4r42986185.exe O4 - HKLM\..\RunServices: [nlkfev76087652] C:\WINDOWS\system32\nlkfev76087652.exe O4 - HKLM\..\RunServices: [cjnr4r42192690] C:\WINDOWS\system32\cjnr4r42192690.exe O4 - HKLM\..\RunServices: [cjnr4r43639770] C:\WINDOWS\system32\cjnr4r43639770.exe O4 - HKLM\..\RunServices: [nlkfev72724542] C:\WINDOWS\system32\nlkfev72724542.exe O4 - HKLM\..\RunServices: [cjnr4r476025] C:\WINDOWS\system32\cjnr4r476025.exe O4 - HKLM\..\RunServices: [cjnr4r47663240] C:\WINDOWS\system32\cjnr4r47663240.exe O4 - HKLM\..\RunServices: [cjnr4r41198495] C:\WINDOWS\system32\cjnr4r41198495.exe O4 - HKLM\..\RunServices: [dior4f43929931] C:\WINDOWS\system32\dior4f43929931.exe O4 - HKLM\..\RunServices: [mlsdf8h3548229] C:\WINDOWS\system32\mlsdf8h3548229.exe O4 - HKLM\..\RunServices: [cjnr4r42264435] C:\WINDOWS\system32\cjnr4r42264435.exe O4 - HKLM\..\RunServices: [nlkfev79403662] C:\WINDOWS\system32\nlkfev79403662.exe O4 - HKLM\..\RunServices: [cjnr4r42273260] C:\WINDOWS\system32\cjnr4r42273260.exe O4 - HKLM\..\RunServices: [sklrr7y4712878] C:\WINDOWS\system32\sklrr7y4712878.exe O4 - HKLM\..\RunServices: [dior4f47934371] C:\WINDOWS\system32\dior4f47934371.exe O4 - HKLM\..\RunServices: [sklrr7y9546028] C:\WINDOWS\system32\sklrr7y9546028.exe O4 - HKLM\..\RunServices: [nlkfev79015397] C:\WINDOWS\system32\nlkfev79015397.exe O4 - HKLM\..\RunServices: [sklrr7y5688178] C:\WINDOWS\system32\sklrr7y5688178.exe O4 - HKLM\..\RunServices: [sklrr7y2715978] C:\WINDOWS\system32\sklrr7y2715978.exe O4 - HKLM\..\RunServices: [cjnr4r46193640] C:\WINDOWS\system32\cjnr4r46193640.exe O4 - HKLM\..\RunServices: [nlkfev77533962] C:\WINDOWS\system32\nlkfev77533962.exe O4 - HKLM\..\RunServices: [sklrr7y6312728] C:\WINDOWS\system32\sklrr7y6312728.exe O4 - HKLM\..\RunServices: [cjnr4r43337735] C:\WINDOWS\system32\cjnr4r43337735.exe O4 - HKLM\..\RunServices: [sklrr7y8168548] C:\WINDOWS\system32\sklrr7y8168548.exe O4 - HKLM\..\RunServices: [sklrr7y1871983] C:\WINDOWS\system32\sklrr7y1871983.exe O4 - HKLM\..\RunServices: [sklrr7y7508933] C:\WINDOWS\system32\sklrr7y7508933.exe O4 - HKLM\..\RunServices: [nlkfev71825087] C:\WINDOWS\system32\nlkfev71825087.exe O4 - HKLM\..\RunServices: [nlkfev73246982] C:\WINDOWS\system32\nlkfev73246982.exe O4 - HKLM\..\RunServices: [dior4f47282931] C:\WINDOWS\system32\dior4f47282931.exe O4 - HKLM\..\RunServices: [nlkfev75326202] C:\WINDOWS\system32\nlkfev75326202.exe O4 - HKLM\..\RunServices: [mlsdf8h8887034] C:\WINDOWS\system32\mlsdf8h8887034.exe O4 - HKLM\..\RunServices: [dior4f43695691] C:\WINDOWS\system32\dior4f43695691.exe O4 - HKLM\..\RunServices: [nlkfev74649652] C:\WINDOWS\system32\nlkfev74649652.exe O4 - HKLM\..\RunServices: [cjnr4r44112275] C:\WINDOWS\system32\cjnr4r44112275.exe O4 - HKLM\..\RunServices: [sklrr7y2746243] C:\WINDOWS\system32\sklrr7y2746243.exe O4 - HKLM\..\RunServices: [mlsdf8h1076759] C:\WINDOWS\system32\mlsdf8h1076759.exe O4 - HKLM\..\RunServices: [cjnr4r43726670] C:\WINDOWS\system32\cjnr4r43726670.exe O4 - HKLM\..\RunServices: [mlsdf8h2532124] C:\WINDOWS\system32\mlsdf8h2532124.exe O4 - HKLM\..\RunServices: [cjnr4r44741090] C:\WINDOWS\system32\cjnr4r44741090.exe O4 - HKLM\..\RunServices: [mlsdf8h7618944] C:\WINDOWS\system32\mlsdf8h7618944.exe O4 - HKLM\..\RunServices: [mlsdf8h8742639] C:\WINDOWS\system32\mlsdf8h8742639.exe O4 - HKLM\..\RunServices: [cjnr4r43416115] C:\WINDOWS\system32\cjnr4r43416115.exe O4 - HKLM\..\RunServices: [cjnr4r47649280] C:\WINDOWS\system32\cjnr4r47649280.exe O4 - HKLM\..\RunServices: [sklrr7y3730863] C:\WINDOWS\system32\sklrr7y3730863.exe O4 - HKLM\..\RunServices: [cjnr4r43236485] C:\WINDOWS\system32\cjnr4r43236485.exe O4 - HKLM\..\RunServices: [dior4f49385346] C:\WINDOWS\system32\dior4f49385346.exe O4 - HKLM\..\RunServices: [sklrr7y6004428] C:\WINDOWS\system32\sklrr7y6004428.exe O4 - HKLM\..\RunServices: [sklrr7y996773] C:\WINDOWS\system32\sklrr7y996773.exe O4 - HKLM\..\RunServices: [sklrr7y1053608] C:\WINDOWS\system32\sklrr7y1053608.exe O4 - HKLM\..\RunServices: [mlsdf8h7611949] C:\WINDOWS\system32\mlsdf8h7611949.exe O4 - HKLM\..\RunServices: [cjnr4r497715] C:\WINDOWS\system32\cjnr4r497715.exe O4 - HKLM\..\RunServices: [A2E1F63A] C:\WINDOWS\system32\nlkfev77134272.exe Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis. ________ Open notepad. Copy and paste the text inside the Code Box below into Notepad Choose File > Save As and under "Save as type", choose "All Files". Type fix.bat in the File name and save it to your desktop. Code:
@echo off if [%1]==[2B] goto 2B copy /y %systemdrive%\SDFix\catchme.exe %windir%>nul attrib -s -h -r %systemdrive%\SDFix\apps copy /y %systemdrive%\SDFix\apps\swreg.exe %windir%>nul copy /y %systemdrive%\SDFix\apps\swsc.exe %windir%>nul for %%g in ( "C:\WINDOWS\system32\msnat.exe" "C:\windows\winsysupd.exe" "C:\WINDOWS\system32\httskm.exe" "C:\WINDOWS\system32\sysdamp.exe" "C:\WINDOWS\system32\iphttphl2.dll" "C:\uxgq.exe" "C:\WINDOWS\system32\xpdx.sys" "C:\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp" ) do ( catchme -k %%g )>nul for %%g in ( "C:\WINDOWS\system32\edcA17" "C:\WINDOWS\system32\ardCo17" "C:\Documents and Settings\All Users\Application Data\GLOBALDOG64CHIC" "C:\DOCUME~1\User\APPLIC~1\antielse" "C:\Program Files\webHancer" "C:\Program Files\Video ActiveX Access" ) do ( rd /s/q %%g )>nul for %%g in ( "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04cg0ryk.dll" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64 CHIC FAST TRAY" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Biasheart" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsysupd" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent" "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\httskm" ) do ( swreg delete %%g /f )>nul swreg add "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices" swreg add "hklm\software\microsoft\windows\currentversion\runonce" /v "Kill" /d ""%comspec%" /c %~s0 2B" pause "%systemdrive%\SDFix\apps\restartit!.exe" /reboot exit :2B for %%g in ( "C:\WINDOWS\system32\msnat.exe" "C:\windows\winsysupd.exe" "C:\WINDOWS\system32\httskm.exe" "C:\WINDOWS\system32\sysdamp.exe" "C:\WINDOWS\system32\iphttphl2.dll" "C:\uxgq.exe" "C:\WINDOWS\system32\xpdx.sys" "C:\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp" ) do ( del /a/f/q %%g )>nul swsc stop xpdx>nul swsc stop MSNAT>nul swsc stop mp32>nul swsc delete xpdx>nul swsc delete MSNAT>nul swsc delete mp32>nul pause exit _________ Download ATF Cleaner by Atribune Important: Make sure all your browsers are closed before running ATF Cleaner..
Please do an online scan with Kaspersky WebScanner Warning: If you had kaspersky online scanner installed before 10-5-2007, please uninstall it as kaspersky released a new version. Previous version had a serious flaw which could result in a buffer overflow. You will be promted to install an ActiveX component from Kaspersky, Click Yes.
On your next reply, please include a
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 01-21-2008 at 12:43 AM. |
|
|
|
|
01-21-2008, 11:31 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 6
OS: xp
|
Re: Need help removing "mm27nov[1].exe", and other
that scan took FOREVER
 enjoy the results : Deckard's System Scanner v20071014.68 Run by Tomek on 2008-01-21 13:27:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 255 MiB (512 MiB recommended). -- HijackThis (run as Tomek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:28:15 PM, on 1/21/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Tomek\Desktop\dss[1].exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Tomek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1200715576843 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1200715543375 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing) O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing) O23 - Service: Microsoft NAT Service (MSNAT) - Unknown owner - C:\WINDOWS\system32\msnat.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe -- End of file - 6879 bytes -- Files created between 2007-12-21 and 2008-01-21 ----------------------------- 2008-01-21 10:57:31 0 d-------- C:\WINDOWS\network diagnostic 2008-01-21 10:33:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-01-21 10:33:14 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-01-21 10:30:29 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-01-21 10:11:54 0 d-------- C:\Program Files\Trend Micro 2008-01-21 03:23:07 0 d-------- C:\WINDOWS\LastGood 2008-01-20 08:59:22 0 d-------- C:\WINDOWS\ERUNT 2008-01-18 23:00:18 0 d-------- C:\Program Files\SpywareBlaster 2008-01-18 21 05 0 d-------- C:\WINDOWS\system32\ActiveScan2008-01-18 15:33:43 10624 --a------ C:\WINDOWS\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> 2008-01-18 15:33:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-01-18 15:33:33 0 d-------- C:\Documents and Settings\Tomek\Application Data\PrevxCSI 2008-01-15 14:37:33 258127 --a------ C:\WINDOWS\system32\sysdamp.exe 2008-01-15 14:37:19 212008 --a------ C:\WINDOWS\system32\iphttphl2.dll 2008-01-15 14:37:19 58880 --a------ C:\uxgq.exe 2008-01-11 17:54:34 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor 2008-01-11 16:49:21 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll 2008-01-11 16:49:21 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> -- Find3M Report --------------------------------------------------------------- 2008-01-21 03:19:48 0 d-------- C:\Program Files\Symantec AntiVirus 2008-01-18 22:14:57 0 d-------- C:\Program Files\Google 2008-01-18 22:12:07 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-18 22:09:21 0 d-------- C:\Program Files\AIM6 2008-01-11 17:54:50 0 d--h----- C:\Program Files\InstallShield Installation Information -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 02:18 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/24/2006 02:24 AM] "HostManager"="C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe" [05/09/2006 07:24 PM] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [02/17/2006 11:59 AM] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 01:03 PM] "SNM"="C:\Program Files\SpyNoMore\SNM.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/01/2006 01:32 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/20/2007 04:45 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "NoIE4StubProcessing"=C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04cg0ryk.dll] RUNDLL32.EXE 04cg0ryk.dll,b 12805156 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64 CHIC FAST TRAY] C:\Documents and Settings\All Users\Application Data\GLOBALDOG64CHIC\Hideamen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Biasheart] C:\DOCUME~1\User\APPLIC~1\antielse\Onlinebashwin.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU1] C:\Program Files\Common Files\VCClient\VCClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CU2] C:\Program Files\Common Files\VCClient\VCMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\httskm] C:\WINDOWS\system32\httskm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsysupd] C:\windows\winsysupd.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7cc575c4-fb84-11d8-8e10-806d6172696f}] AutoRun\command- E:\Setup.exe -- End of Deckard's System Scanner: finished at 2008-01-21 13:29:15 ------------ ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, January 21, 2008 1:27:09 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 21/01/2008 Kaspersky Anti-Virus database records: 525858 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 47176 Number of viruses found: 21 Number of infected objects: 64 Number of suspicious objects: 0 Duration of the scan process: 02:32:31 Infected Object Name / Virus Name / Last Action C:\b4f34c86f2e97bf4073d548811\$shtdwn$.req Object is locked skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\2314.exe/data0006 Infected: Trojan-Downloader.Win32.VB.bsp skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\2314.exe NSIS: infected - 1 skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp Infected: not-a-virus:FraudTool.Win32.WorldSecurityOnline.b skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\Setup195.exe/data0002 Infected: Trojan-Clicker.Win32.VB.yh skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\Setup195.exe/data0008 Infected: Trojan-Clicker.Win32.VB.vx skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\Setup195.exe/data0009 Infected: Trojan-Clicker.Win32.VB.vx skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\Setup195.exe NSIS: infected - 3 skipped C:\Deckard\System Scanner\20080120093548\backup\DOCUME~1\Tomek\LOCALS~1\Temp\T0CHD001.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.ac skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4e93f84c40d87eb0a0f40e2ce3baf518_59456d19-97de-47a6-8e6d-1def9f39cf8e Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640000.VBN Infected: Trojan-Downloader.Win32.VB.bwb skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640002.VBN Infected: Trojan-Downloader.Win32.Small.hkt skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640004.VBN Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640006.VBN Infected: Trojan-Downloader.Win32.VB.bwb skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640008.VBN Infected: Trojan.Win32.Agent.djz skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C64000A.VBN Infected: Trojan-Downloader.Win32.Small.hhp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C64000C.VBN Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C64000E.VBN Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640010.VBN Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040004.VBN/vmain.class Infected: Exploit.Java.Gimsh.b skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040004.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040004.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040005.VBN/vmain.class Infected: Exploit.Java.Gimsh.b skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040005.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040005.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040006.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040007.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040008.VBN/b122.exe Infected: Trojan-Downloader.Win32.Agent.haq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040008.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040008.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040009.VBN/b122.exe Infected: Trojan-Downloader.Win32.Agent.haq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040009.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E040009.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000A.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000B.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000C.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000D.VBN Infected: Trojan-Downloader.Win32.Small.hqc skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000E.VBN/b151.exe Infected: Trojan-Downloader.Win32.Agent.fjn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000E.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000E.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000F.VBN/b151.exe Infected: Trojan-Downloader.Win32.Agent.fjn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000F.VBN ZIP: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E04000F.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-27406485-77501b9c.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-27406485-77501b9c.zip ZIP: infected - 1 skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-4b6298a9-203caaad.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-4b6298a9-203caaad.zip ZIP: infected - 1 skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-50316a3b-3cf763ff.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-50316a3b-3cf763ff.zip ZIP: infected - 1 skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-74249065-2c6607c4.zip/HiPointInstallShieldRT.class Infected: Trojan-Downloader.Java.OpenConnection.ap skipped C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-74249065-2c6607c4.zip ZIP: infected - 1 skipped C:\Documents and Settings\Tomek\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Tomek\Desktop\SDFix\backups\backups.zip/backups/superfinderusa.dll Infected: not-a-virus:AdWare.Win32.BHO.rh skipped C:\Documents and Settings\Tomek\Desktop\SDFix\backups\backups.zip ZIP: infected - 1 skipped C:\Documents and Settings\Tomek\Desktop\SDFix\backups\catchme.zip/xpdx.sys Infected: Rootkit.Win32.Agent.th skipped C:\Documents and Settings\Tomek\Desktop\SDFix\backups\catchme.zip/dxdss.sys Infected: Trojan.Win32.Pakes.bxx skipped C:\Documents and Settings\Tomek\Desktop\SDFix\backups\catchme.zip ZIP: infected - 2 skipped C:\Documents and Settings\Tomek\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped C:\Documents and Settings\Tomek\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Tomek\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Tomek\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\2314.exe/data0006 Infected: Trojan-Downloader.Win32.VB.ceh skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\2314.exe NSIS: infected - 1 skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\EJFO6KUQ\zgshj[1].htm Infected: Trojan.Win32.Pakes.bxx skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\KP6FOLMB\lsegihwln[1].txt Infected: Trojan-Downloader.Win32.Agent.hrb skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\go2314.exe/data0006 Infected: Trojan-Downloader.Win32.VB.ceh skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\go2314.exe NSIS: infected - 1 skipped C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\loadadv601.exe Infected: Trojan-Downloader.Win32.Agent.hmq skipped C:\Documents and Settings\Tomek\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Tomek\NTUSER.DAT.LOG Object is locked skipped C:\Program Files\Audible\Bin\Debug.log Object is locked skipped C:\Program Files\Audible\Bin\Update.log Object is locked skipped C:\Program Files\Audible\Programs\Downloads\aasubsschedule.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{6EE07641-B84A-4650-B794-4C88B6AEBA4D}\RP283\A0061952.dll Infected: not-a-virus:AdWare.Win32.BHO.rh skipped C:\System Volume Information\_restore{6EE07641-B84A-4650-B794-4C88B6AEBA4D}\RP283\A0061961.dll Infected: not-a-virus:AdWare.Win32.BHO.rh skipped C:\System Volume Information\_restore{6EE07641-B84A-4650-B794-4C88B6AEBA4D}\RP286\change.log Object is locked skipped C:\uxgq.exe Infected: Trojan.Win32.Pakes.bxx skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edbtmp.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{16F55347-EE27-41E9-809F-976335325F38}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
01-22-2008, 03:48 AM
|
#6 (permalink) | ||
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing "mm27nov[1].exe", and other
Hi,
Quote:
Quote:
=========== Open notepad. Copy and paste the text inside the Code Box below into Notepad Choose File > Save As and under "Save as type", choose "All Files". Type fix2.bat in the File name and save it to your desktop. Code:
@echo off if [%1]==[2B] goto 2B copy /y "%userprofile%\desktop\SDFix\catchme.exe" %windir%>nul attrib -s -h -r "%userprofile%\desktop\SDFix\apps" copy /y "%userprofile%\desktop\SDFix\apps\swreg.exe" %windir%>nul copy /y "%userprofile%\desktop\SDFix\apps\swsc.exe" %windir%>nul for %%g in ( "C:\WINDOWS\system32\msnat.exe" "C:\windows\winsysupd.exe" "C:\WINDOWS\system32\httskm.exe" "C:\WINDOWS\system32\sysdamp.exe" "C:\WINDOWS\system32\iphttphl2.dll" "C:\uxgq.exe" "C:\WINDOWS\system32\xpdx.sys" "C:\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp" ) do ( catchme -k %%g )>nul for %%g in ( "HKLM\software\microsoft\shared tools\msconfig\startupreg\winsysupd" "HKLM\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion" "HKLM\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent" "HKLM\software\microsoft\shared tools\msconfig\startupreg\httskm" "HKLM\software\microsoft\shared tools\msconfig\startupreg\CU2" "HKLM\software\microsoft\shared tools\msconfig\startupreg\CU1" "HKLM\software\microsoft\shared tools\msconfig\startupreg\Biasheart" "HKLM\software\microsoft\shared tools\msconfig\startupreg\64 CHIC FAST TRAY" "HKLM\software\microsoft\shared tools\msconfig\startupreg\04cg0ryk.dll" ) do ( swreg delete %%g /f )>nul swreg delete "HKLM\software\microsoft\windows\currentversion\runonce" /v NoIE4StubProcessing>nul swreg add "HKLM\software\microsoft\windows\currentversion\runservices" swreg add "hklm\software\microsoft\windows\currentversion\runonce" /v "Kill" /d ""%comspec%" /c %~s0 2B" pause "%userprofile%\desktop\SDFix\apps\restartit!.exe" /reboot exit :2B for %%g in ( "C:\WINDOWS\system32\msnat.exe" "C:\windows\winsysupd.exe" "C:\WINDOWS\system32\httskm.exe" "C:\WINDOWS\system32\sysdamp.exe" "C:\WINDOWS\system32\iphttphl2.dll" "C:\uxgq.exe" "C:\WINDOWS\system32\xpdx.sys" "C:\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp" "C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-27406485-77501b9c.zip" "C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-4b6298a9-203caaad.zip" "C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-50316a3b-3cf763ff.zip" "C:\Documents and Settings\Tomek\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nRT.jar-74249065-2c6607c4.zip" "C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\2314.exe" "C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\EJFO6KUQ\zgshj[1].htm" "C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\Content.IE5\KP6FOLMB\lsegihwln[1].txt" "C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\go2314.exe" "C:\Documents and Settings\Tomek\Local Settings\Temporary Internet Files\loadadv601.exe" ) do ( del /a/f/q %%g )>nul swsc stop xpdx>nul swsc stop MSNAT>nul swsc stop mp32>nul swsc delete xpdx>nul swsc delete MSNAT>nul swsc delete mp32>nul pause exit _______ Your Java is out of date.... Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components.
On your next reply, please include a
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 01-22-2008 at 03:53 AM. |
||
|
|
|
|
01-22-2008, 08:00 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 6
OS: xp
|
Re: Need help removing "mm27nov[1].exe", and other
hey hey,
im pretty sure teh fix2.dat program failed again cuz after it re-booted itself, teh window showed taht if failed to find a series of files otherwise teh system seems to be working pretty well, no more constant nortifications from norton, the only problem ive been having is my connection to the internet, it disconnects fairly often and it often takes a while for the wireless adapter to find a network address, i guessing its just teh adapter though, anyways heres teh latest dss log (sorry about my crappy spelling): Deckard's System Scanner v20071014.68 Run by Tomek on 2008-01-22 21:46:41 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 255 MiB (512 MiB recommended). -- HijackThis (run as Tomek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:47:18 PM, on 1/22/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Common Files\AOL\1163036108\ee\aolsoftware.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Tomek\Desktop\dss[1].exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Tomek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm?rev=10300 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\RunOnce: [SWHelper] "C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1011016 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1200715576843 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1200715543375 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing) O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe -- End of file - 6870 bytes -- Files created between 2007-12-22 and 2008-01-22 ----------------------------- 2008-01-22 21:41:26 0 d-------- C:\Program Files\Sun 2008-01-22 16:04:44 0 d-------- C:\Program Files\Common Files\Java 2008-01-22 15:31:15 40960 --a------ C:\WINDOWS\swsc.exe 2008-01-22 15:31:14 139776 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-01-21 10:57:31 0 d-------- C:\WINDOWS\network diagnostic 2008-01-21 10:33:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-01-21 10:33:14 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-01-21 10:30:29 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-01-21 10:11:54 0 d-------- C:\Program Files\Trend Micro 2008-01-20 08:59:22 0 d-------- C:\WINDOWS\ERUNT 2008-01-18 23:00:18 0 d-------- C:\Program Files\SpywareBlaster 2008-01-18 21 05 0 d-------- C:\WINDOWS\system32\ActiveScan2008-01-18 15:33:43 10624 --a------ C:\WINDOWS\system32\drivers\pxark.sys <Not Verified; ; Prevx CSI> 2008-01-18 15:33:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-01-18 15:33:33 0 d-------- C:\Documents and Settings\Tomek\Application Data\PrevxCSI 2008-01-11 17:54:34 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor 2008-01-11 16:49:21 94208 --a------ C:\WINDOWS\system32\GTW32N50.dll 2008-01-11 16:49:21 15872 --a------ C:\WINDOWS\system32\GTNDIS5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> -- Find3M Report --------------------------------------------------------------- 2008-01-22 21:40:43 0 d-------- C:\Program Files\Java 2008-01-22 16:04:44 0 d-------- C:\Program Files\Common Files 2008-01-22 15:37:29 0 d-------- C:\Program Files\Symantec AntiVirus 2008-01-18 22:14:57 0 d-------- C:\Program Files\Google 2008-01-18 22:12:07 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-18 22:09:21 0 d-------- C:\Program Files\AIM6 2008-01-11 17:54:50 0 d--h----- C:\Program Files\InstallShield Installation Information -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/12/2004 02:18 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/24/2006 02:24 AM] "HostManager"="C:\Program Files\Common Files\AOL\1163036108\ee\AOLSoftware.exe" [05/09/2006 07:24 PM] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [02/17/2006 11:59 AM] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM] "SNM"="C:\Program Files\SpyNoMore\SNM.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [12/14/2007 03:42 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/01/2006 01:32 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/20/2007 04:45 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "SWHelper"="C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1011016 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] @= C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe -- End of Deckard's System Scanner: finished at 2008-01-22 21:47:59 ------------ |
|
|
|
|
01-23-2008, 02:51 AM
|
#8 (permalink) | |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing "mm27nov[1].exe", and other
Hi,
Quote:
Do you see a file called catchme.log in your desktop? If there's one, please post the contents.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
|
01-23-2008, 11:49 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 6
OS: xp
|
Re: Need help removing "mm27nov[1].exe", and other
heh well thats good news i guess
read file error: C:\WINDOWS\system32\msnat.exe, The system cannot find the file specified. read file error: C:\windows\winsysupd.exe, The system cannot find the file specified. read file error: C:\WINDOWS\system32\httskm.exe, The system cannot find the file specified. file zipped: C:\WINDOWS\system32\sysdamp.exe -> catchme.zip -> sysdamp.exe ( 258127 bytes ) PE file "C:\WINDOWS\system32\sysdamp.exe" killed successfully file zipped: C:\WINDOWS\system32\iphttphl2.dll -> catchme.zip -> iphttphl2.dll ( 212008 bytes ) PE file "C:\WINDOWS\system32\iphttphl2.dll" killed successfully file zipped: C:\uxgq.exe -> catchme.zip -> uxgq.exe ( 58880 bytes ) PE file "C:\uxgq.exe" killed successfully read file error: C:\WINDOWS\system32\xpdx.sys, The system cannot find the file specified. read file error: C:\DOCUME~1\Tomek\LOCALS~1\Temp\laf9B.tmp, The system cannot find the file specified. |
|
|
|
|
01-24-2008, 02:04 AM
|
#10 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing "mm27nov[1].exe", and other
Hi,
Open notepad. Copy and paste the text inside the Code Box below into Notepad Choose File > Save As and under "Save as type", choose "All Files". Type cleanup.bat in the File name and save it to your desktop. Code:
@echo off rd /s/q "%userprofile%\desktop\SDFix" for %%g in ( %windir%\catchme.exe %windir%\swreg.exe %windir%\swsc.exe "%userprofile%\desktop\catchme.*" ) do ( del /a/f/q %%g ) ( echo.REGEDIT4&echo. echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced] echo."hidden"=dword:00000002 echo."hidefileext"=dword:00000001 echo."showsuperhidden"=dword:00000000 )>rehide.reg regedit /s rehide.reg del rehide.reg del %0 ______ Congratulations! Your log looks clean! This is a good time to clear your existing system restore points and establish a new clean restore point:
Here are some free programs I recommend that could help you improve your pc's security. Firewall Application - Although Windows Xp comes with a firewall, you should not rely on it because the Windows Firewall can only filter incoming data; outgoing traffic is not controlled, meaning that malware/viruses that are present in your computer can access the internet with no restrictions. There are several other Firewall that can protect you better by filtering incoming and outgoing data. Make sure you get only one of these. » Comodo » Kerio MVPS Hosts File ~You can download it from here ~I highly recommend this hosts file. You can learn more about this here IESpyAds ~Instructions on downloading and using it here Note: This only works for Internet Explorer. Install SpyWare Blaster ~You can download it from here ~You can read the tutorial on how to use Spyware Blaster here Install WinPatrol ~You can download it from here ~You can get some information about how WinPatrol works here Note: Make sure you update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. Please check out Tony Klein's article "How did I get infected in the first place?" Happy safe surfing! Note: Please respond to this thread one last time so I could close it.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
| Thread Tools | |
|
|
