Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Re: Posted Logs-need Spyware Removal Help
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 01-09-2008, 01:35 PM   #1 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
I am having problems with the search taking over my explorer and when I click on anything or even type in an address, it takes me through several other websites, then where it wants to. I also have something that keeps popping up on the left of the screen with its own search results, called ImSorry. HELP!
I've done the 5 steps above and here are my logs:

PandaScan:

Incident Status Location

Adware:Adware/AVSystemCare Not disinfected C:\WINDOWS\system32\ddrawe.dll
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrDrive\QdrDrive9.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\hggefec.dll
Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\system32\vtutr.dll
Potentially unwanted tool:application/myglobalsearch Not disinfected c:\program files\MyGlobalSearch
Adware:adware/outerinfo Not disinfected Windows Registry
Adware:adware/savenow Not disinfected Windows Registry
Adware:adware/seekmo Not disinfected Windows Registry
Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp
Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp
Adware:Adware/Yazzle Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp
Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp
Adware:Adware/PurityScan Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP61.tmp
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP64.tmp
Adware:Adware/Maxifiles Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp
Adware:Adware/Yazzle Not disinfected C:\Deckard\System Scanner\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Adasha Knight\Application Data\Mozilla\Firefox\Profiles\mgyhbhe9.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@ad.yieldmanager[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@mediaplex[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@server.iad.liveperson[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@statcounter[1].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@statse.webtrendslive[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@tribalfusion[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Adasha Knight\Cookies\adasha knight@zedo[1].txt
Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll
Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll
Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll
Adware:Adware/AVSystemCare Not disinfected C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll
Virus:Trj/Downloader.RUZ Disinfected C:\Documents and Settings\Adasha Knight\Local Settings\Temp\ismtpa8.exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Virus:Generic Malware Disinfected C:\Program Files\DIGStream\digstream.exe
Possible Virus. Not disinfected C:\Program Files\FaxTools\Install\Setup.exe
Possible Virus. Not disinfected C:\Program Files\InstallShield Installation Information\{F45298E5-0083-426F-A668-1A2C5F04B8A0}\Setup.exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\ISM\Uninstall.exe
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrModule\QdrModule11 .exe
Adware:Adware/InternetSpeedMonitor Not disinfected C:\Program Files\QdrPack\QdrPack11.exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask .exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\QuickTime\qttask.exe
Virus:Trj/WinAble.A Disinfected C:\Program Files\Temporary\wininstall.exe
Adware:Adware/Maxifiles Not disinfected C:\Program Files\WinAble\winable .exe
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\WinAble\winable.exe
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\hggefec.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\iifeecd.dll.bad
Spyware:Spyware/Vundo Not disinfected C:\VundoFix Backups\vtutr.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\vtutr.exe.bad
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\b122.exe
Adware:Adware/Yazzle Not disinfected C:\WINDOWS\mrofinu72.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\mrofinu72.exe.tmp
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\ntanayog.dll
Virus:Trj/Sinowal.HM Disinfected C:\WINDOWS\system32\ntos.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\rutjgknp.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\vtutr.exe
And here is my HIJACK this log:
Logfile of HijackThis v1.99.1
Scan saved at 2:34:25 PM, on 1/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\QdrModule\QdrModule11 .exe
C:\Program Files\QdrPack\QdrPack11.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Adasha Knight\Desktop\Adasha Knight.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: {f4a12136-cd14-361a-d414-dd091ec260a0} - {0a062ce1-90dd-414d-a163-41dc63121a4f} - C:\WINDOWS\system32\bhxjtvbx.dll
O2 - BHO: (no name) - {6E8989EE-BA6F-4FD5-BEC8-B16CD90BCD4E} - C:\WINDOWS\system32\vtutr.dll
O2 - BHO: (no name) - {AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A} - C:\WINDOWS\system32\ddrawe.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\hggefec.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe"
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 01-14-2008, 02:31 PM   #2 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Posted Logs-need Spyware Removal Help
Hello and welcome to TSF


Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy here lately. If you are still having malware problems,follow instructions below.

-------------------------------

You are using an outdated version of Hijackthis. Please uninstall from Add/Remove programs, and delete your current version.

Next, download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Do not post that log, instead, do this next:

=====================================================

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
  1. Close all applications and windows.
  2. Double-click on dss.exe to run it, and follow the prompts.
  3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
  4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.
  5. Please attach extra.txt to your post.
To attach a file to a new post, simply
  1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
  2. copy and paste the following into the "Upload File from your Computer" box:
    C:\Deckard\System Scanner\extra.txt
  3. Click Upload.
What DSS will do:
  • create a new System Restore point in Windows XP and Vista.
  • clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

===============================
Logs Required
C:\Deckard\System Scanner\main.txt
C:\Deckard\System Scanner\extra.txt<---Attached
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-15-2008, 08:19 PM   #3 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
Thanks for your help. Here is the main.txt file:

Deckard's System Scanner v20071014.68
Run by Adasha Knight on 2008-01-15 21:12:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Adasha Knight.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:12:49 PM, on 1/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Adasha Knight\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Adasha Knight.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: {f4a12136-cd14-361a-d414-dd091ec260a0} - {0a062ce1-90dd-414d-a163-41dc63121a4f} - C:\WINDOWS\system32\bhxjtvbx.dll
O2 - BHO: (no name) - {AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A} - C:\WINDOWS\system32\ddrawe.dll
O2 - BHO: (no name) - {C2C0197E-9505-42BD-BCA5-02FA2338AFA5} - C:\WINDOWS\system32\vtutr.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\hggefec.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 3956 bytes

-- Files created between 2007-12-15 and 2008-01-15 -----------------------------

2008-01-15 21:10:50 0 d-------- C:\Program Files\Trend Micro
2008-01-09 14:31:18 0 d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30:48 0 d-------- C:\ie-spyad_zo
2008-01-09 11:50:03 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2008-01-09 11:29:24 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-04 23:37:35 90176 --a------ C:\WINDOWS\system32\ntanayog.dll
2008-01-04 23:34:36 78912 --a------ C:\WINDOWS\system32\bhxjtvbx.dll
2008-01-04 23:31:34 78912 --a------ C:\WINDOWS\system32\jtsxmesu.dll
2008-01-04 23:29:43 74304 --a------ C:\WINDOWS\system32\rutjgknp.exe <Not Verified; ; DDC>
2007-12-28 03:21:02 341504 --a------ C:\WINDOWS\system32\vtutr.exe
2007-12-28 03:21:00 20111 --ahs---- C:\WINDOWS\system32\rtutv.ini2
2007-12-28 03:20:50 337920 --a------ C:\WINDOWS\system32\vtutr.dll
2007-12-27 22:30:37 0 d-------- C:\VundoFix Backups
2007-12-24 00:53:44 0 d-------- C:\WINDOWS\system32\?dobe
2007-12-23 12:40:57 0 d-------- C:\Program Files\AIMTunes
2007-12-23 10:48:03 0 d--hs---- C:\WINDOWS\system32\wsnpoem
2007-12-23 10:29:53 0 d-------- C:\Program Files\Common Files\T?sks
2007-12-23 02:24:23 0 d-------- C:\Program Files\WinAble
2007-12-23 02:24:23 0 d-------- C:\Program Files\Temporary
2007-12-23 02:21:12 2 --a------ C:\WINDOWS\system32\wapiicomsv.exe
2007-12-23 02:21:06 0 d-------- C:\WINDOWS\system32\W?nSxS
2007-12-23 02:20:58 39936 --a------ C:\WINDOWS\mrofinu72.exe
2007-12-23 02:20:42 40448 -----n--- C:\WINDOWS\system32\hggefec.dll


-- Find3M Report ---------------------------------------------------------------

2008-01-15 21:07:16 0 --a------ C:\WINDOWS\TempFile
2008-01-09 13:15:31 0 d-------- C:\Program Files\Lexmark 1200 Series
2008-01-09 13:09:16 0 d-------- C:\Program Files\DIGStream
2007-12-24 01:03:11 0 d-------- C:\Program Files\Common Files
2007-12-24 00:51:38 0 d-------- C:\Program Files\QuickTime
2007-12-23 13:48:52 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-12-23 13:48:48 88 -r-hs---- C:\WINDOWS\system32\E8118B887A.sys
2007-12-23 12:42:58 0 d-------- C:\Program Files\AIM6
2007-12-23 11:08:13 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-23 10:29:53 0 d-------- C:\Program Files\Common Files\T?sks
2007-12-17 16:07:57 4 --a------ C:\WINDOWS\system32\2B8F1C
2007-12-06 17:43:50 0 d-------- C:\Program Files\LimeWire
2007-10-25 19:39:33 1156 --a------ C:\WINDOWS\mozver.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0a062ce1-90dd-414d-a163-41dc63121a4f}]
01/04/2008 11:34 PM 78912 --a------ C:\WINDOWS\system32\bhxjtvbx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AFEAE967-F3A6-48FD-ACCA-A28E1CB1B48A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2C0197E-9505-42BD-BCA5-02FA2338AFA5}]
12/28/2007 03:20 AM 337920 --a------ C:\WINDOWS\system32\vtutr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA4F0D8D-5F2B-4F16-838A-8D52249EAB21}]
12/23/2007 02:20 AM 40448 --------- C:\WINDOWS\system32\hggefec.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [01/15/2008 09:06 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{CA4F0D8D-5F2B-4F16-838A-8D52249EAB21}"= C:\WINDOWS\system32\hggefec.dll [12/23/2007 02:20 AM 40448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 09/07/2004 06:08 PM 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\vtutr




-- End of Deckard's System Scanner: finished at 2008-01-15 21:13:47 ------------
Attached Files
File Type: txt extra.txt (17.5 KB, 2 views)
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-16-2008, 06:30 AM   #4 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Posted Logs-need Spyware Removal Help
Hello again

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

==========================

Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.Its important that you follow this through until i give you the all clear,a lack of symptoms does not mean the infection is not present.

===========================

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

==========================

Turn on Windows Firewall

1. Click Start, click Run, type Firewall.cpl, and then click OK.
2. On the General tab, click On (recommended), and then click OK.

=========================

P2P

P2P - I see you have P2P software LimeWire 4.14.12 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.


==========================

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:

J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 11

Leave Java(TM) SE Runtime Environment 6 Update 1 installed

Viewpoint Manager<---This program is used to update the Viewpoint Media Player. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.

Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

WinAble<---Known to install malware

Reboot when all have been removed

===========================

Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Disconnect from the internet.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you at C:\ComboFix.txt. I'll need to see that in your next reply, along with a new HijackThis log.


============================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

============================

Reconnect to the internet and post the required logs

============================
Logs Required
C:\Combofix.txt
Hijackthis log

Any reason why you do not have any antivirus protection installed, for this reason stay Off the internet as much as possible until we can install some antivirus protection.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-17-2008, 09:18 PM   #5 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
Geez! When I tried to remove Winable, it kept freezing my computer. I had to go into the C: drive and search for all files with that in it, then delete those, then go to add/remove and remove it from there. It was very stubborn!

Here is the log.txt:

ComboFix 08-01-09.2 - Adasha Knight 2008-01-17 19:05:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.734 [GMT -6:00]
Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adasha Knight\My Documents\CROSOF~1
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Common Files\tsks~1
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\Temporary
C:\WINDOWS\mrofinu72.exe
C:\WINDOWS\system32\bhxjtvbx.dll
C:\WINDOWS\system32\ddrawe.dll
C:\WINDOWS\system32\dobe~1
C:\WINDOWS\system32\drivers\qlgojmza.dat
C:\WINDOWS\system32\goyanatn.ini
C:\WINDOWS\system32\hggefec.dll
C:\WINDOWS\system32\jtsxmesu.dll
C:\WINDOWS\system32\ntanayog.dll
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\system32\rutjgknp.exe
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\vtutr.exe
C:\WINDOWS\system32\wapiicomsv.exe
C:\WINDOWS\system32\wnsxs~1
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\audio.dll.cla
C:\WINDOWS\system32\wsnpoem\video.dll

Code:
 <pre>
C:\Program Files\Common Files\Real\Update_OB\realsched .exe ---> QooBox
C:\Program Files\Intel\Wireless\Bin\ifrmewrk .exe ---> ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe ---> jusched.exe
C:\Program Files\QuickTime\qttask    .exe ---> qttask.exe
</pre>
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_KMNFBMDR
-------\DomainService
-------\kmnfbmdr


((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))
.

2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo
2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard
2008-01-04 23:31 . 2008-01-04 23:31 294 --ahs---- C:\WINDOWS\system32\cdsjfwqt.ini
2007-12-27 22:30 . 2007-12-27 22:30 <DIR> d-------- C:\VundoFix Backups
2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes
2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico
2007-12-23 02:20 . 2007-12-24 00:50 382,464 --a------ C:\WINDOWS\mrofinu72.exe.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime
2008-01-16 13:49 --------- d-----w C:\Program Files\Java
2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream
2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6
2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire
2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT
2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi
2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe
2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08]

.
Contents of the 'Scheduled Tasks' folder
"2007-09-14 23:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-17 19:23:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-17 19:28:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-18 01:28:14
.
2007-07-12 03:53:47 --- E O F ---


Here is the HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:42 PM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 4002 bytes


Thanks again!!!
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-18-2008, 01:04 PM   #6 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Posted Logs-need Spyware Removal Help
Hello again

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
KillAll::

File::
C:\WINDOWS\system32\cdsjfwqt.ini
C:\WINDOWS\mrofinu72.exe.tmp

Folder::
C:\VundoFix Backups
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========================

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

===========================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========================
Logs Required
C:\Combofix.txt
Kaspersky scan report
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-19-2008, 10:15 AM   #7 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
Combofix Log:

ComboFix 08-01-09.2 - Adasha Knight 2008-01-19 8:34:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.752 [GMT -6:00]
Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\cdsjfwqt.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\hggefec.dll.bad
C:\VundoFix Backups\iifeecd.dll.bad
C:\VundoFix Backups\rtutv.ini.bad
C:\VundoFix Backups\rtutv.ini2.bad
C:\VundoFix Backups\vtutr.dll.bad
C:\VundoFix Backups\vtutr.exe.bad
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\cdsjfwqt.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-17 19:01 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo
2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-08 21:01 . 2008-01-08 21:01 <DIR> d-------- C:\Deckard
2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes
2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime
2008-01-16 13:49 --------- d-----w C:\Program Files\Java
2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream
2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6
2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire
2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT
2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi
2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe
2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg
.

((((((((((((((((((((((((((((( snapshot@2008-01-17_19.27.42.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-18 01:02:56 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 14:33:58 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-18 01:02:56 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 14:33:58 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-18 01:02:58 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-19 14:34:00 4,329,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-18 01:02:58 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 14:34:01 348,160 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-18 01:02:59 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-19 14:34:01 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-18 01:02:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 14:34:02 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 08:43:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 8:47:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-19 14:47:08
ComboFix2.txt 2008-01-18 01:28:19
.
2007-07-12 03:53:47 --- E O F ---


Kaspersky Log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, January 19, 2008 11:12:43 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/01/2008
Kaspersky Anti-Virus database records: 523769
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 71496
Number of viruses found: 19
Number of infected objects: 189
Number of suspicious objects: 0
Duration of the scan process: 01:59:02

Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1221.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP1238.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP2.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP5C.tmp Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP67.tmp Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\Deckard\System Scanner\20080115211241\backup\DOCUME~1\ADASHA~1\LOCALS~1\Temp\TMP75.tmp Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\Documents and Settings\Adasha Knight\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll Infected: Trojan.Win32.BHO.abo skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\ntuser.dat Object is locked skipped
C:\Documents and Settings\Adasha Knight\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Intel\Wireless\Bin\ifrmewrk.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Java\jre1.6.0_01\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\VundoFix Backups\hggefec.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\VundoFix Backups\iifeecd.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\VundoFix Backups\vtutr.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\mrofinu72.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\qlgojmza.dat.vir Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hggefec.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ntanayog.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rutjgknp.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutr.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat Infected: Rootkit.Win32.Agent.tw skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/qlgojmza.dat.1 Infected: Rootkit.Win32.Agent.tw skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip/ddrawe.dll Infected: Trojan.Win32.BHO.abo skipped
C:\QooBox\Quarantine\catchme2008-01-17_192302.32.zip ZIP: infected - 3 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP202\A0122962.exe Infected: Trojan-Spy.Win32.BZub.buz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP207\A0127193.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128187.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128197.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128199.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0128200.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129191.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129202.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129206.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129207.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0129212.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130189.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130190.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130192.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130196.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130197.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130198.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130203.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130205.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130208.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130213.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130214.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130215.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130217.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130222.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130404.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130408.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130409.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130436.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130437.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130438.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130440.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130441.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130442.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130443.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130444.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130445.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130449.exe Infected: Trojan-Downloader.Win32.PurityScan.fe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130451.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130454.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130455.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130460.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130471.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130480.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gl skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130483.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130485.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130494.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130497.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130505.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130507.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130515.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP208\A0130516.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130574.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130576.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0130582.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131579.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131581.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131589.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131591.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131598.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131599.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0131614.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132612.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP209\A0132613.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132625.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132626.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132642.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132643.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132652.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132654.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132693.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132694.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132701.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132705.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132706.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132714.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132716.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132737.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132738.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0132747.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133746.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP210\A0133748.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133756.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133757.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133764.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP211\A0133766.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133774.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133775.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133779.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133780.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133842.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133844.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133847.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133849.exe Infected: Trojan.Win32.Agent.crf skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133850.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133855.exe Infected: Trojan-Spy.Win32.Zbot.mt skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133860.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133862.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0133872.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134870.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134871.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134879.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134891.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP212\A0134892.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135004.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135007.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135032.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135034.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135035.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135044.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP213\A0135045.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135157.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135161.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135163.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135164.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135174.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135175.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135177.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135193.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135194.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135195.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135202.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135203.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135206.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP214\A0135210.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135212.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135213.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135214.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135216.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135218.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135220.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135222.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135225.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135226.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135227.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135238.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135249.exe Infected: Trojan-Downloader.Win32.Adload.ni skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP215\A0135250.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP216\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1156E72B-E402-4BA0-8419-512B234A630A}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TempFile Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Hijack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:39 AM, on 1/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://games.pogo.com/online2/pogo/b...ploader_v6.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 4110 bytes
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-20-2008, 07:46 AM   #8 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
Here is the COMBOFIX log:

ComboFix 08-01-20.1 - Adasha Knight 2008-01-20 8:02:13.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.729 [GMT -6:00]
Running from: C:\Documents and Settings\Adasha Knight\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adasha Knight\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll
C:\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

----- Unknown downloads made by BITS: ----
http://80.93.48.74

.
((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))
.

2008-01-20 08:00 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-19 08:54 . 2008-01-19 08:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-19 08:54 . 2008-01-19 08:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-15 21:10 . 2008-01-15 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-09 14:31 . 2008-01-09 14:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-09 14:30 . 2008-01-09 14:30 <DIR> d-------- C:\ie-spyad_zo
2008-01-09 11:50 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-09 11:29 . 2008-01-09 13:47 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-09 11:29 . 2008-01-09 11:29 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-09 11:29 . 2008-01-09 11:29 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-09 11:29 . 2008-01-09 11:29 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-23 12:40 . 2008-01-05 14:23 <DIR> d-------- C:\Program Files\AIMTunes
2007-12-23 12:27 . 2007-12-23 12:27 4,286 --a------ C:\WINDOWS\system32\MobileSidewalk.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 01:22 --------- d-----w C:\Program Files\QuickTime
2008-01-16 13:49 --------- d-----w C:\Program Files\Java
2008-01-09 19:15 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-01-09 19:09 --------- d-----w C:\Program Files\DIGStream
2007-12-23 18:42 --------- d-----w C:\Program Files\AIM6
2007-12-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-06 23:43 --------- d-----w C:\Program Files\LimeWire
2007-09-23 16:03 25,336 ----a-w C:\Documents and Settings\Adasha Knight\Application Data\GDIPFONTCACHEV1.DAT
2007-09-09 16:35 14,738 ----a-w C:\Program Files\videodownloader-1.1.1-fx.xpi
2007-01-19 04:36 722,176 ----a-w C:\Documents and Settings\Adasha Knight\gotomypc_428.exe
2006-06-25 02:14 5,244 ----a-w C:\Program Files\me 06 (84 x 114).jpg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-01-17 18:40 385024]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2008-01-17 18:40 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-08 18:04 4898816]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 19:17 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 18:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 20:08]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 00:29:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 08:10:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-20 8:13:10 - machine was rebooted [Adasha Knight]
ComboFix-quarantined-files.txt 2008-01-20 14:12:59
ComboFix2.txt 2008-01-19 14:47:13
.
2007-07-12 03:53:47 --- E O F ---


Here is the HIJACKTHIS log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:43, on 2008-01-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 3791 bytes
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-20-2008, 05:16 PM   #9 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
CFRC Log:

WinXP_EN_HOM_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons


Avast Virus Log (I think):
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-221922-851.dll.vir\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071206-222313-289.dll.vir\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071212-231333-851.dll.vir\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\QooBox\Quarantine\C\Documents and Settings\Adasha Knight\Desktop\backups\backup-20071215-131912-475.dll.vir\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135438.dll\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135439.dll\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135440.dll\[UPX]" file.
2008-01-20 17:13 Adasha Knight 916 Sign of "Win32:BHO-KD [Trj]" has been found in "C:\System Volume Information\_restore{4F2609FC-A0E0-46AA-AA58-A536B0A3FF8C}\RP218\A0135441.dll\[UPX]" file.
2008-01-20 17:42 Adasha Knight 916 Sign of "Win32:CTX" has been found in "C:\WINDOWS\system32\ActiveScan\pskavs.dll" file.
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-20-2008, 06:42 PM   #10 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Posted Logs-need Spyware Removal Help
Hello again

You downloaded the wrong version for your system, this is the one that you should have downloaded Here .

Remove/Delete the previous version you downloaded, then delete this folder in blue.

C:\CMDCONS

-----------------------------

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

============

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

=========
Log Required
CF_RC.txt
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
Last edited by TheBruce1; 01-20-2008 at 06:50 PM.
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-20-2008, 07:37 PM   #11 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
CFRC:

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons


HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:37, on 2008-01-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189315894890
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dotphoto.com/ImageUploader4.cab
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 5143 bytes
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 08:59 AM   #12 (permalink)
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Posted Logs-need Spyware Removal Help
Well done,your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=================

Clear IE6 cookies

*Open IE and click Tools
*Click on Internet Options
*Click on General Tab
*Click on Delte Temp Files & Cookies buttons.


Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

Only install one of the above

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
AVG Antispyware Free
Ad-Aware
Spybot S&D
Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
Download Spyware Guard to catch and block spyware before it can execute.

------------------------------------------------------------------

IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List.

Download and installation instructions for IE-Spyad™ Here

-----------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Also, please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more,as we may mark this as resolved,thanks.
__________________
Member of ASAP since 2007
Member of UNITE since 2008

**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 01-21-2008, 09:38 AM   #13 (permalink)
Registered User
 
adasha's Avatar
 
Join Date: Jan 2008
Location: Texas
Posts: 12
OS: Windows XP


Re: Posted Logs-need Spyware Removal Help
Thank you VERY VERY MUCH!!!!

My next project will be my kids' computer, which is even worse than mine...
adasha is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 07:39 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85