|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-09-2008, 12:35 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
I am having problems with the search taking over my explorer and when I click on anything or even type in an address, it takes me through several other websites, then where it wants to. I also have something that keeps popping up on the left of the screen with its own search results, called ImSorry. HELP!
I've done the 5 steps above and here are my logs: PandaScan: Incident Status Location Adware:Adware/AVSystemCare Not disinfected C:\WINDOWS\system32\ddrawe.dll Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrDrive\QdrDrive9.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\hggefec.dll Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\system32\vtutr.dll Potentially unwanted tool:application/myglobalsearch Not disinfected c:\program files\MyGlobalSearch Adware:adware/outerinfo Not disinfected Windows Registry Adware:adware/savenow Not disinfected Windows Registry Adware:adware/seekmo Not disinfected Windows Registry Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp Adware:Adware/Yazzle Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp Adware:Adware/InternetSpeedMonitor Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP61.tmp Adware:Adware/InternetSpeedMonitor Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP64.tmp Adware:Adware/Maxifiles Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp Adware:Adware/Yazzle Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.advertising.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.trafficmp.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@ad.yieldmanager[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@atdmt[2].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@doubleclick[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@mediaplex[1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@server.iad.liveperson[1].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@statcounter[1].txt Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@statse.webtrendslive[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@tribalfusion[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@zedo[1].txt Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll Virus:Trj/Downloader.RUZ Disinfected C:\Documents and Settings\Adasha Knight\Local Settings\Temp\ismtpa8.exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\Common Files\Real\Update_OB\realsched.exe Virus:Generic Malware Disinfected C:\Program Files\DIGStream\digstream.exe Possible Virus. Not disinfected C:\Program Files\FaxTools\Install\Setup.exe Possible Virus. Not disinfected C:\Program Files\InstallShield Installation Information\{F45298E5-0083-426F-A668-1A2C5F04B8A0}\Setup.exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\ISM\Uninstall.exe Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrModule\QdrModule11 .exe Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrPack\QdrPack11.exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask.exe Virus:Trj/WinAble.A Disinfected C:\Program Files\Temporary\wininstall.exe Adware:Adware/Maxifiles Not disinfected C:\Program Files\WinAble\winable .exe Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\WinAble\winable.exe Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\hggefec.dll.bad Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\iifeecd.dll.bad Spyware:Spyware/Vundo Not disinfected C:\VundoFix Backups\vtutr.dll.bad Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\vtutr.exe.bad Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\b122.exe Adware:Adware/Yazzle Not disinfected C:\WINDOWS\mrofinu72.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\mrofinu72.exe.tmp Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\ntanayog.dll Virus:Trj/Sinowal.HM Disinfected C:\WINDOWS\system32\ntos.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\rutjgknp.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\vtutr.exe And here is my HIJACK this log: Logfile of HijackThis v1.99.1 Scan saved at 2:34:25 PM, on 1/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\QdrModule\QdrModule11 .exe C:\Program Files\QdrPack\QdrPack11.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Adasha Knight\Desktop\Adasha Knight.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe, O2 - BHO: {f4a12136-cd14-361a-d414-dd091ec260a0} - {0a062ce1-90dd-414d-a163-41dc63121a4f} - C:\WINDOWS\system32\bhxjtvbx.dll O2 - BHO: (no name) - {6E8989EE-BA6F-4FD5-BEC8-B16CD90BCD4E} - C:\WINDOWS\system32\vtutr.dll O2 - BHO: (no name) - {AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A} - C:\WINDOWS\system32\ddrawe.dll O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\hggefec.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe" O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe |
|
     |
| Sponsored Links |
|
01-14-2008, 01:31 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,484
OS: XP
|
Re: Posted Logs-need Spyware Removal Help
Hello and welcome to TSF
Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy here lately. If you are still having malware problems,follow instructions below. ------------------------------- You are using an outdated version of Hijackthis. Please uninstall from Add/Remove programs, and delete your current version. Next, download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Do not post that log, instead, do this next: ===================================================== Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
=============================== Logs Required C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt<---Attached |
|
|
|
|
01-15-2008, 07:19 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
Thanks for your help. Here is the main.txt file:
Deckard's System Scanner v20071014.68 Run by Adasha Knight on 2008-01-15 21:12:42 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Adasha Knight.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:12:49 PM, on 1/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Adasha Knight\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Adasha Knight.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe, O2 - BHO: {f4a12136-cd14-361a-d414-dd091ec260a0} - {0a062ce1-90dd-414d-a163-41dc63121a4f} - C:\WINDOWS\system32\bhxjtvbx.dll O2 - BHO: (no name) - {AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A} - C:\WINDOWS\system32\ddrawe.dll O2 - BHO: (no name) - {C2C0197E-9505-42BD-BCA5-02FA2338AFA5} - C:\WINDOWS\system32\vtutr.dll O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\hggefec.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 3956 bytes -- Files created between 2007-12-15 and 2008-01-15 ----------------------------- 2008-01-15 21:10:50 0 d-------- C:\Program Files\Trend Micro 2008-01-09 14:31:18 0 d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30:48 0 d-------- C:\ie-spyad_zo 2008-01-09 11:50:03 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus> 2008-01-09 11:29:24 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-01-04 23:37:35 90176 --a------ C:\WINDOWS\system32\ntanayog.dll 2008-01-04 23:34:36 78912 --a------ C:\WINDOWS\system32\bhxjtvbx.dll 2008-01-04 23:31:34 78912 --a------ C:\WINDOWS\system32\jtsxmesu.dll 2008-01-04 23:29:43 74304 --a------ C:\WINDOWS\system32\rutjgknp.exe <Not Verified; ; DDC> 2007-12-28 03:21:02 341504 --a------ C:\WINDOWS\system32\vtutr.exe 2007-12-28 03:21:00 20111 --ahs---- C:\WINDOWS\system32\rtutv.ini2 2007-12-28 03:20:50 337920 --a------ C:\WINDOWS\system32\vtutr.dll 2007-12-27 22:30:37 0 d-------- C:\VundoFix Backups 2007-12-24 00:53:44 0 d-------- C:\WINDOWS\system32\?dobe 2007-12-23 12:40:57 0 d-------- C:\Program Files\AIMTunes 2007-12-23 10:48:03 0 d--hs---- C:\WINDOWS\system32\wsnpoem 2007-12-23 10:29:53 0 d-------- C:\Program Files\Common Files\T?sks 2007-12-23 02:24:23 0 d-------- C:\Program Files\WinAble 2007-12-23 02:24:23 0 d-------- C:\Program Files\Temporary 2007-12-23 02:21:12 2 --a------ C:\WINDOWS\system32\wapiicomsv.exe 2007-12-23 02:21:06 0 d-------- C:\WINDOWS\system32\W?nSxS 2007-12-23 02:20:58 39936 --a------ C:\WINDOWS\mrofinu72.exe 2007-12-23 02:20:42 40448 -----n--- C:\WINDOWS\system32\hggefec.dll -- Find3M Report --------------------------------------------------------------- 2008-01-15 21:07:16 0 --a------ C:\WINDOWS\TempFile 2008-01-09 13:15:31 0 d-------- C:\Program Files\Lexmark 1200 Series 2008-01-09 13:09:16 0 d-------- C:\Program Files\DIGStream 2007-12-24 01:03:11 0 d-------- C:\Program Files\Common Files 2007-12-24 00:51:38 0 d-------- C:\Program Files\QuickTime 2007-12-23 13:48:52 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-12-23 13:48:48 88 -r-hs---- C:\WINDOWS\system32\E8118B887A.sys 2007-12-23 12:42:58 0 d-------- C:\Program Files\AIM6 2007-12-23 11:08:13 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-12-23 10:29:53 0 d-------- C:\Program Files\Common Files\T?sks 2007-12-17 16:07:57 4 --a------ C:\WINDOWS\system32\2B8F1C 2007-12-06 17:43:50 0 d-------- C:\Program Files\LimeWire 2007-10-25 19:39:33 1156 --a------ C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0a062ce1-90dd-414d-a163-41dc63121a4f}] 01/04/2008 11:34 PM 78912 --a------ C:\WINDOWS\system32\bhxjtvbx.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2C0197E-9505-42BD-BCA5-02FA2338AFA5}] 12/28/2007 03:20 AM 337920 --a------ C:\WINDOWS\system32\vtutr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA4F0D8D-5F2B-4F16-838A-8D52249EAB21}] 12/23/2007 02:20 AM 40448 --------- C:\WINDOWS\system32\hggefec.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@"="" [] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [01/15/2008 09:06 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{CA4F0D8D-5F2B-4F16-838A-8D52249EAB21}"= C:\WINDOWS\system32\hggefec.dll [12/23/2007 02:20 AM 40448] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 09/07/2004 06:08 PM 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtutr -- End of Deckard's System Scanner: finished at 2008-01-15 21:13:47 ------------ |
|
|
|
|
01-16-2008, 05:30 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,484
OS: XP
|
Re: Posted Logs-need Spyware Removal Help
Hello again
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ========================== Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.Its important that you follow this through until i give you the all clear,a lack of symptoms does not mean the infection is not present. =========================== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ========================== Turn on Windows Firewall 1. Click Start, click Run, type Firewall.cpl, and then click OK. 2. On the General tab, click On (recommended), and then click OK. ========================= P2P P2P - I see you have P2P software LimeWire 4.14.12 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. ========================== Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs: J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 11 Leave Java(TM) SE Runtime Environment 6 Update 1 installed Viewpoint Manager<---This program is used to update the Viewpoint Media Player. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc. Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 WinAble<---Known to install malware Reboot when all have been removed =========================== Download Combofix from any of the links below, and save it to your desktop. Link 1 Link 2 Link 3 **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- 1. Disconnect from the internet. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on ComboFix.exe & follow the prompts. When finished, it will produce a report for you at C:\ComboFix.txt. I'll need to see that in your next reply, along with a new HijackThis log. ============================ Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ============================ Reconnect to the internet and post the required logs ============================ Logs Required C:\Combofix.txt Hijackthis log Any reason why you do not have any antivirus protection installed, for this reason stay Off the internet as much as possible until we can install some antivirus protection. |
|
|
|
|
01-17-2008, 08:18 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
Geez! When I tried to remove Winable, it kept freezing my computer. I had to go into the C: drive and search for all files with that in it, then delete those, then go to add/remove and remove it from there. It was very stubborn!
Here is the log.txt: ComboFix 08-01-09.2 - Adasha Knight 2008-01-17 19:05:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.734 [GMT -6:00] Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Adasha Knight\My Documents\CROSOF~1 C:\Program Files\Common Files\Real\Update_OB\realsched .exe C:\Program Files\Common Files\tsks~1 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\QuickTime\qttask .exe C:\Program Files\QuickTime\qttask .exe C:\Program Files\QuickTime\qttask .exe C:\Program Files\Temporary C:\WINDOWS\mrofinu72.exe C:\WINDOWS\system32\bhxjtvbx.dll C:\WINDOWS\system32\ddrawe.dll C:\WINDOWS\system32\dobe~1 C:\WINDOWS\system32\drivers\qlgojmza.dat C:\WINDOWS\system32\goyanatn.ini C:\WINDOWS\system32\hggefec.dll C:\WINDOWS\system32\jtsxmesu.dll C:\WINDOWS\system32\ntanayog.dll C:\WINDOWS\system32\rtutv.ini C:\WINDOWS\system32\rtutv.ini2 C:\WINDOWS\system32\rutjgknp.exe C:\WINDOWS\system32\vtutr.dll C:\WINDOWS\system32\vtutr.exe C:\WINDOWS\system32\wapiicomsv.exe C:\WINDOWS\system32\wnsxs~1 C:\WINDOWS\system32\wsnpoem C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wsnpoem\audio.dll.cla C:\WINDOWS\system32\wsnpoem\video.dll Code:
<pre> C:\Program Files\Common Files\Real\Update_OB\realsched .exe ---> QooBox C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe ---> ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe ---> jusched.exe C:\Program Files\QuickTime\qttask .exe ---> qttask.exe </pre> . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_KMNFBMDR -------\DomainService -------\kmnfbmdr ((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))) . 2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo 2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard 2008-01-04 23:31 . 2008-01-04 23:31 294 --ahs---- C:\WINDOWS\system32\cdsjfwqt.ini 2007-12-27 22:30 . 2007-12-27 22:30 <DIR> d-------- C:\VundoFix Backups 2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes 2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico 2007-12-23 02:20 . 2007-12-24 00:50 382,464 --a------ C:\WINDOWS\mrofinu72.exe.tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime 2008-01-16 13:49 --------- d-----w C:\Program Files\Java 2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series 2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream 2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6 2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire 2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT 2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi 2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe 2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08] . Contents of the 'Scheduled Tasks' folder "2007-09-14 23:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 19:23:49 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-17 19:28:19 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-18 01:28:14 . 2007-07-12 03:53:47 --- E O F --- Here is the HIJACK: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:17:42 PM, on 1/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 4002 bytes Thanks again!!! |
|
|
|
|
01-18-2008, 12:04 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,484
OS: XP
|
Re: Posted Logs-need Spyware Removal Help
Hello again
Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========================= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%. =========================== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========================== Logs Required C:\Combofix.txt Kaspersky scan report Hijackthis log |
|
|
|
|
|
01-19-2008, 09:15 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
Combofix Log:
ComboFix 08-01-09.2 - Adasha Knight 2008-01-19 8:34:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.752 [GMT -6:00] Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt * Created a new restore point FILE C:\WINDOWS\mrofinu72.exe.tmp C:\WINDOWS\system32\cdsjfwqt.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\VundoFix Backups C:\VundoFix Backups\addmorefiles.txt C:\VundoFix Backups\hggefec.dll.bad C:\VundoFix Backups\iifeecd.dll.bad C:\VundoFix Backups\rtutv.ini.bad C:\VundoFix Backups\rtutv.ini2.bad C:\VundoFix Backups\vtutr.dll.bad C:\VundoFix Backups\vtutr.exe.bad C:\WINDOWS\mrofinu72.exe.tmp C:\WINDOWS\system32\cdsjfwqt.ini . ((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 ))))))))))))))))))))))))))))))) . 2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo 2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard 2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes 2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime 2008-01-16 13:49 --------- d-----w C:\Program Files\Java 2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series 2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream 2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6 2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire 2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT 2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi 2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe 2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg . ((((((((((((((((((((((((((((( snapshot@2008-01-17_19.27.42.48 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-18 01:02:56 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-19 14:33:58 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-18 01:02:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-19 14:33:58 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-18 01:02:58 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat + 2008-01-19 14:34:00 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat - 2008-01-18 01:02:58 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-19 14:34:01 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-18 01:02:59 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT + 2008-01-19 14:34:01 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT - 2008-01-18 01:02:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-19 14:34:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08] . Contents of the 'Scheduled Tasks' folder "2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-19 08:43:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-19 8:47:12 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-19 14:47:08 ComboFix2.txt 2008-01-18 01:28:19 . 2007-07-12 03:53:47 --- E O F --- Kaspersky Log: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, January 19, 2008 11:12:43 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/01/2008 Kaspersky Anti-Virus database records: 523769 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 71496 Number of viruses found: 19 Number of infected objects: 189 Number of suspicious objects: 0 Duration of the scan process: 01:59:02 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\Documents and Settings\Adasha Knight\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll Infected: Trojan.Win32.BHO.abo skipped C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\ntuser.dat Object is locked skipped C:\Documents and Settings\Adasha Knight\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\Intel\Wireless\Bin\ifrmewrk.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\Java\jre1.6.0_01\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\VundoFix Backups\hggefec.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\VundoFix Backups\iifeecd.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\VundoFix Backups\vtutr.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\qlgojmza.dat.vir Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\hggefec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ntanayog.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\QooBox\Quarantine\C\WINDOWS\system32\rutjgknp.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat Infected: Rootkit.Win32.Agent.tw skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat.1 Infected: Rootkit.Win32.Agent.tw skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/ddrawe.dll Infected: Trojan.Win32.BHO.abo skipped C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip ZIP: infected - 3 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP202\A0122962.exe Infected: Trojan-Spy.Win32.BZub.buz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP207\A0127193.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128187.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128197.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128199.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128200.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129202.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129206.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129207.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129212.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130192.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130203.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130208.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130213.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130214.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130215.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130217.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130222.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130404.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130408.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130409.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130436.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130437.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130438.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130440.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130441.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130442.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130443.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130444.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130445.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130449.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130451.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130454.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130455.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130460.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130471.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130480.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130483.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130485.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130494.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130497.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130505.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130507.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130515.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130516.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130574.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130576.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130582.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131579.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131581.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131589.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131591.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131598.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131599.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131614.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132613.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132625.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132626.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132642.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132643.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132652.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132654.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132693.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132694.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132701.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132705.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132706.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132714.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132716.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132737.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132738.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132747.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133748.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133756.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133757.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133764.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133766.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133774.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133775.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133779.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133780.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133842.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133844.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133847.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133849.exe Infected: Trojan.Win32.Agent.crf skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133850.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133855.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133860.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133862.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133872.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134870.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134879.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134891.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134892.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135004.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135007.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135032.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135034.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135035.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135044.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135045.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135157.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135161.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135163.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135164.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135174.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135175.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135177.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135202.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135203.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135206.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135210.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135212.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135213.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135214.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135216.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135218.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135220.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135222.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135225.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135226.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135227.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135238.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135249.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135250.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP216\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1156E72B-E402-4BA0-8419-512B234A630A}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\TempFile Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Hijack This Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:13:39 AM, on 1/19/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 4110 bytes |
|
|
|
|
01-20-2008, 06:46 AM
|
#8 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
Here is the COMBOFIX log:
ComboFix 08-01-20.1 - Adasha Knight 2008-01-20 8:02:13.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.729 [GMT -6:00] Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll C:\Program Files\Common Files\Real\Update_OB\realsched.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Program Files\Common Files\Real\Update_OB\realsched.exe ----- Unknown downloads made by BITS: ---- http://80.93.48.74 . ((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 ))))))))))))))))))))))))))))))) . 2008-01-20 08:00 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-19 08:54 . 2008-01-19 08:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-01-19 08:54 . 2008-01-19 08:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo 2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes 2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime 2008-01-16 13:49 --------- d-----w C:\Program Files\Java 2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series 2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream 2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6 2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire 2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT 2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi 2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe 2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08] . Contents of the 'Scheduled Tasks' folder "2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-20 08:10:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-20 8:13:10 - machine was rebooted [Adasha Knight] ComboFix-quarantined-files.txt 2008-01-20 14:12:59 ComboFix2.txt 2008-01-19 14:47:13 . 2007-07-12 03:53:47 --- E O F --- Here is the HIJACKTHIS log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:43, on 2008-01-20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 3791 bytes |
|
|
|
|
01-20-2008, 04:16 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
CFRC Log:
WinXP_EN_HOM_BF.EXE [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons Avast Virus Log (I think): 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll.vir\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll.vir\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll.vir\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll.vir\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135438.dll\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135439.dll\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135440.dll\[UPX]" file. 2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135441.dll\[UPX]" file. 2008-01-20 17:42 Adasha Knight 916 Sign of "Win32:CTX" has been found in "C:\WINDOWS\system32\ActiveScan\pskavs.dll" file. |
|
|
|
|
01-20-2008, 05:42 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,484
OS: XP
|
Re: Posted Logs-need Spyware Removal Help
Hello again
You downloaded the wrong version for your system, this is the one that you should have downloaded Here . Remove/Delete the previous version you downloaded, then delete this folder in blue. C:\CMDCONS ----------------------------- Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log. ============ Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Log Required CF_RC.txt Hijackthis log Last edited by TheBruce1; 01-20-2008 at 05:50 PM. |
|
|
|
|
01-20-2008, 06:37 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP
|
Re: Posted Logs-need Spyware Removal Help
CFRC:
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons HIJACKTHIS: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:37, on 2008-01-20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 5143 bytes |
|
|
|
|
01-21-2008, 07:59 AM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,484
OS: XP
|
Re: Posted Logs-need Spyware Removal Help
Well done,your logs are clean.
Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ================= Clear IE6 cookies *Open IE and click Tools *Click on Internet Options *Click on General Tab *Click on Delte Temp Files & Cookies buttons. Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. Only install one of the above -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware AVG Antispyware Free Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more,as we may mark this as resolved,thanks. |
|
|
|
| Thread Tools | |
|
|
