|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-05-2008, 07:09 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
WIN32:TratBHO virus I can't get rid of it
I see that this is a fresh issue that is just a couple of threads up. I, too, have this problem. It is my first virus in quite a while and I am frustrated--having spent most of today and yesterday trying to exorcize it through various scans and virus software. I have Windows XP SP2 and run with Avast Antivirus. I also use Maxthon browser 99% of the time. I have the current version of HiJackThis and can post as needed no problem. Any help would be great. The virus keeps trying to open new web pages such as jokeroo.com, mediacent.net, storageprotector.com, etc. Thank you in advance for your help.
Drewboy70 |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-06-2008, 11:54 AM
|
#2 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
Here's the HijackThis Log:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:58:49 PM, on 2/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\LTMSG.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UTSCSI.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ceoexpress.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" MAGICJACK O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1197772738268 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1197775090562 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 9221 bytes ============================================= Heres the ComboFix log: ComboFix 08-02.05.3 - Owner 2008-02-06 13:25:19.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.605 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\gebcb.dll C:\WINDOWS\system32\mljjiii.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\tpBe12 C:\WINDOWS\system32\bcbeg.ini C:\WINDOWS\system32\bcbeg.ini2 C:\WINDOWS\system32\d1 C:\WINDOWS\system32\g9 C:\WINDOWS\system32\gebcb.dll C:\WINDOWS\system32\ineWc01 C:\WINDOWS\system32\j2 C:\WINDOWS\system32\mljjiii.dll C:\WINDOWS\system32\o9 C:\WINDOWS\system32\opnmjjh.dll C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\x1 C:\WINDOWS\uninst2.htm C:\WINDOWS\unist1.htm . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\core ((((((((((((((((((((((((( Files Created from 2008-01-06 to 2008-02-06 ))))))))))))))))))))))))))))))) . 2008-02-06 12:52 . 2004-08-04 02:56 388,608 --a------ C:\kmd.exe 2008-02-05 18:28 . 2008-02-05 18:28 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-04 19:00 . 2008-02-04 19:01 <DIR> d-------- C:\Documents and Settings\Owner\.housecall6.6 2008-02-04 15:40 . 2008-02-04 15:40 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-02-04 15:40 . 2008-02-04 15:40 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX 2008-01-26 21:14 . 2008-01-26 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Program Files\support.com 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Program Files\Common Files\SupportSoft 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Motive 2008-01-21 17:47 . 2008-02-03 15:33 <DIR> d-------- C:\WINDOWS\system32\ardCo17 2008-01-21 17:47 . 2008-01-21 17:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-01-14 21:25 . 2008-01-14 21:38 1,046 --a------ C:\net_save.dna 2008-01-06 15:40 . 2008-01-27 14:43 116 --a------ C:\WINDOWS\NeroDigital.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-05 04:04 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-01-27 02:43 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-01-21 22:48 --------- d-----w C:\Program Files\Maxthon 2008-01-21 22:47 --------- d-----w C:\Program Files\Maxthon2 2008-01-21 22:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-15 03:03 --------- d-----w C:\Program Files\PINs 2007-12-18 03:24 846,504 ----a-w C:\Documents and Settings\Owner\JNativeCpp.dll 2007-12-18 00:56 --------- d-----w C:\Documents and Settings\Owner\Application Data\InterVideo 2007-12-17 11:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\mjusbsp 2007-12-17 02:39 --------- d-----w C:\Program Files\HP 2007-12-17 01:53 --------- d-----w C:\Program Files\Folder Marker 2007-12-16 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\RoboForm 2007-12-16 21:33 --------- d-----w C:\Program Files\Siber Systems 2007-12-16 21:06 43,696 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2007-12-16 21:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Corel 2007-12-16 20:13 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-12-16 20:07 --------- d-----w C:\Program Files\Common Files\Ahead 2007-12-16 20:07 --------- d-----w C:\Program Files\Ahead 2007-12-16 20:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-16 20:06 --------- d-----w C:\Program Files\CyberLink DVD Solution 2007-12-16 20:06 --------- d-----w C:\Program Files\CyberLink 2007-12-16 20:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2007-12-16 19:20 --------- d-----w C:\Program Files\Real Estate ToolKit 2007-12-16 19:15 --------- d-----w C:\Program Files\Common Files\Borland Shared 2007-12-16 19:13 --------- d-----w C:\Program Files\Corel 2007-12-16 18:52 --------- d-----w C:\Program Files\GPLGS 2007-12-16 18:51 --------- d-----w C:\Program Files\Acro Software 2007-12-16 18:48 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 2007-12-16 18:13 --------- d-----w C:\Program Files\Moffsoft Calculator 2 2007-12-16 18:12 --------- d-----w C:\Program Files\MWSnap 2007-12-16 18:11 --------- d-----w C:\Program Files\Microsoft Calculator Plus 2007-12-16 17:49 3,884 ----a-w C:\WINDOWS\viassary-hp.reg 2007-12-16 09:08 --------- d-----w C:\Program Files\MSBuild 2007-12-16 09:02 --------- d-----w C:\Program Files\Reference Assemblies 2007-12-16 08:59 --------- d-----w C:\Program Files\MSXML 6.0 2007-12-16 08:58 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-12-16 06:34 --------- d-----w C:\Program Files\MSXML 4.0 2007-12-16 04:11 --------- d-----w C:\Program Files\Alwil Software 2007-12-16 04:06 28,256 ----a-w C:\WINDOWS\system32\drivers\MxlW2k.sys 2007-12-16 04:06 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-16 04:04 --------- d-----w C:\Program Files\IntelliMover Data Transfer Demo 2007-12-16 04:03 --------- d-----w C:\Program Files\MSN Encarta Plus 2007-12-16 03:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-12-16 03:41 --------- d-----w C:\Program Files\Easy Internet signup 2007-12-16 03:34 4,306 --sha-r C:\WINDOWS\system32\drivers\HP_DW146A-ABA A405N_YC_Pavi_QMXK411_E41NAheBLU4_4_IGamila Giovani Neon series_SMICRO-STAR INTERNATIONAL CO., LTD_V030_B3.08_T040225_WXH1_L409_M504_J80_7Intel_8Celeron_92.7_111063044_N10EC8139_P_Z11C1044C_K_A808624C5.MRK 2007-12-16 03:29 --------- d-----w C:\Program Files\ArcSoft 2007-12-16 03:28 --------- d-----w C:\Program Files\Multimedia Card Reader 2004-10-01 20:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93494523-F115-4A39-A415-BFCDEFBBD3B4}] C:\Program Files\NetMeeting\povedaqaC:\DOCUME~1\Owner\LOCALS~1\Temp\CEMG555077.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B645A20B-C57E-46CE-97CF-F9AFB1C607AB}] C:\Program Files\NetMeeting\povedaqaC:\WINDOWS\system32\o9\parreo83122.exe.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RecordNow!"="" [] "NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360] "cdloader"="C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" [2007-09-21 14:31 54616] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 15:51 118784] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328] "KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 22:02 61440] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 10:01 110592] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-10-10 23:58 151597] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992] "VTTimer"="VTTimer.exe" [] "LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 20:11 139264] "mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 18:37 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912] "QuickFinder Scheduler"="C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" [2001-10-02 01:36 77887] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 09:25 1397760] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 15:55 155648] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 10:20:40 233472] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 06:49:48 57344] Updates from HP.lnk - C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe [2003-10-11 00:26:40 16384] S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15] S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15] . Contents of the 'Scheduled Tasks' folder "2008-01-17 02:44:08 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1197859269.job" - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1197859269 "2007-12-16 18:58:08 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job" - c:\Program Files\Microsoft IntelliType Pro\itype.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-06 13:47:43 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\UTSCSI.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup . ************************************************************************** . Completion time: 2008-02-06 13:50:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-06 18:49:59 . 2008-01-09 09:05:09 --- E O F --- |
|
|
|
|
02-06-2008, 01:58 PM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Please do this:
Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-06-2008, 03:05 PM
|
#4 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
Deckard's System Scanner v20071014.68
Run by Owner on 2008-02-06 16:50:15 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 114: 2008-02-06 21:50:22 UTC - RP181 - Deckard's System Scanner Restore Point 113: 2008-02-06 18:17:38 UTC - RP180 - ComboFix created restore point 112: 2008-02-06 13:44:14 UTC - RP179 - System Checkpoint 111: 2008-02-05 09:40:43 UTC - RP178 - System Checkpoint 110: 2008-02-04 09:08:41 UTC - RP177 - System Checkpoint -- First Restore Point -- 1: 2008-02-03 08:15:47 UTC - RP68 - Installed Windows XP KB873339. Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Owner.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:51:29 PM, on 2/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\LTMSG.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UTSCSI.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\HPZipm12.exe C:\Documents and Settings\Owner\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ceoexpress.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: (no name) - {93494523-F115-4A39-A415-BFCDEFBBD3B4} - C:\Program Files\NetMeeting\povedaqaC:\DOCUME~1\Owner\LOCALS~1\Temp\CEMG555077.exe.dll (file missing) O2 - BHO: (no name) - {B645A20B-C57E-46CE-97CF-F9AFB1C607AB} - C:\Program Files\NetMeeting\povedaqaC:\WINDOWS\system32\o9\parreo83122.exe.dll (file missing) O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" MAGICJACK O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1197772738268 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1197775090562 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 9816 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> R3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt> S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 UTSCSI (CLCV0) - c:\windows\system32\utscsi.exe <Not Verified; ; UTSCSI Application> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-01-16 21:44:08 344 --a------ C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1197859269.job 2007-12-16 13:58:08 300 --ah----- C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job -- Files created between 2008-01-06 and 2008-02-06 ----------------------------- 2008-02-06 13:17:04 68096 --a------ C:\WINDOWS\system32\zip.exe 2008-02-06 13:17:04 98816 --a------ C:\WINDOWS\system32\sed.exe 2008-02-06 13:17:04 80412 --a------ C:\WINDOWS\system32\grep.exe 2008-02-06 13:17:04 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-02-06 02:25:27 0 dr-h----- C:\Documents and Settings\Owner\Recent 2008-02-05 18:28:45 0 d-------- C:\Program Files\Trend Micro 2008-02-04 19:00:31 0 d-------- C:\Documents and Settings\Owner\.housecall6.6 2008-02-04 15:40:41 0 d--hs---- C:\WINDOWS\ftpcache 2008-01-26 21:14:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-21 17:48:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Motive 2008-01-21 17:48:07 0 d-------- C:\Program Files\support.com 2008-01-21 17:48:07 0 d-------- C:\Program Files\Common Files\SupportSoft 2008-01-21 17:47:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-01-21 17:47:52 0 d-------- C:\WINDOWS\system32\ardCo17 -- Find3M Report --------------------------------------------------------------- 2008-02-04 23:04:55 0 d-------- C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-02-03 11:56:20 0 d-------- C:\Program Files\Common Files 2008-01-26 21:43:16 0 d-------- C:\Program Files\Microsoft ActiveSync 2008-01-21 17:48:00 0 d-------- C:\Program Files\Maxthon 2008-01-21 17:47:59 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe 2008-01-21 17:47:14 0 d-------- C:\Program Files\Maxthon2 2008-01-14 22:03:15 0 d-------- C:\Program Files\PINs 2007-12-19 12:27:19 0 d-------- C:\Documents and Settings\Owner\Application Data\Macromedia 2007-12-17 19:56:02 0 d-------- C:\Documents and Settings\Owner\Application Data\InterVideo 2007-12-17 06:00:45 0 d-------- C:\Documents and Settings\Owner\Application Data\mjusbsp 2007-12-17 05:59:31 45056 --a------ C:\WINDOWS\system32\UTSCSI.EXE <Not Verified; ; UTSCSI Application> 2007-12-16 21:42:02 29234 --a------ C:\WINDOWS\hpoins03.dat 2007-12-16 21:39:17 0 d-------- C:\Program Files\HP 2007-12-16 20:53:54 0 d-------- C:\Program Files\Folder Marker 2007-12-16 19:49:41 0 d-------- C:\Documents and Settings\Owner\Application Data\Real 2007-12-16 16:33:44 0 d-------- C:\Program Files\Siber Systems 2007-12-16 16  38 43696 --a------ C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT2007-12-16 16:05:54 61678 --a------ C:\Documents and Settings\Owner\Application Data\PFP100JPR.{PB 2007-12-16 16:05:54 12358 --a------ C:\Documents and Settings\Owner\Application Data\PFP100JCM.{PB 2007-12-16 16:05:51 0 d-------- C:\Documents and Settings\Owner\Application Data\Corel 2007-12-16 15:13:09 0 d-------- C:\Program Files\Common Files\LightScribe 2007-12-16 15:07:50 0 d-------- C:\Program Files\Ahead 2007-12-16 15:07:26 0 d-------- C:\Program Files\Common Files\Ahead 2007-12-16 15 22 0 d-------- C:\Program Files\CyberLink2007-12-16 15 18 0 d--h----- C:\Program Files\InstallShield Installation Information2007-12-16 15 18 0 d-------- C:\Program Files\CyberLink DVD Solution2007-12-16 14:20:24 0 d-------- C:\Program Files\Real Estate ToolKit 2007-12-16 14:15:25 0 d-------- C:\Program Files\Common Files\Borland Shared 2007-12-16 14:13:38 0 d-------- C:\Program Files\Corel 2007-12-16 13:52:35 0 d-------- C:\Program Files\GPLGS 2007-12-16 13:51:48 0 d-------- C:\Program Files\Acro Software 2007-12-16 13:48:35 0 d-------- C:\Program Files\Microsoft IntelliType Pro 2007-12-16 13:13:51 0 d-------- C:\Program Files\Moffsoft Calculator 2 2007-12-16 13:12:07 0 d-------- C:\Program Files\MWSnap 2007-12-16 13:11:01 0 d-------- C:\Program Files\Microsoft Calculator Plus 2007-12-16 12:49:23 3884 --a------ C:\WINDOWS\viassary-hp.reg 2007-12-16 04:08:42 0 d-------- C:\Program Files\MSBuild 2007-12-16 04:02:08 0 d-------- C:\Program Files\Reference Assemblies 2007-12-16 03:59:41 0 d-------- C:\Program Files\MSXML 6.0 2007-12-16 03:58:43 0 d-------- C:\Program Files\Windows Media Connect 2 2007-12-16 01:58:29 0 d-------- C:\Program Files\Messenger 2007-12-16 01:34:50 0 d-------- C:\Program Files\MSXML 4.0 2007-12-16 00:08:51 0 d-------- C:\Program Files\Movie Maker 2007-12-16 00:05:49 0 d-------- C:\Program Files\Windows NT 2007-12-15 23:11:33 0 d-------- C:\Program Files\Alwil Software 2007-12-15 23 24 0 d-------- C:\Program Files\Common Files\Adobe2007-12-15 23:04:08 0 d-------- C:\Program Files\IntelliMover Data Transfer Demo 2007-12-15 23:03:39 0 d-------- C:\Program Files\MSN Encarta Plus 2007-12-15 22:41:28 0 d-------- C:\Program Files\Easy Internet signup 2007-12-15 22:29:44 0 d-------- C:\Program Files\ArcSoft 2007-12-15 22:28:49 0 d-------- C:\Program Files\Multimedia Card Reader -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93494523-F115-4A39-A415-BFCDEFBBD3B4}] C:\Program Files\NetMeeting\povedaqaC:\DOCUME~1\Owner\LOCALS~1\Temp\CEMG555077.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B645A20B-C57E-46CE-97CF-F9AFB1C607AB}] C:\Program Files\NetMeeting\povedaqaC:\WINDOWS\system32\o9\parreo83122.exe.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [05/07/1998 06:04 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 03:51 PM] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [10/07/2002 09:23 AM] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [05/23/2003 04:55 AM] "KBD"="C:\HP\KBD\KBD.EXE" [02/11/2003 10:02 PM] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 10:01 AM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/10/2003 11:58 PM] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [09/13/2002 11:42 PM] "VTTimer"="VTTimer.exe" [] "LTMSG"="LTMSG.exe" [07/14/2003 07:52 PM C:\WINDOWS\ltmsg.exe] "PS2"="C:\WINDOWS\system32\ps2.exe" [10/16/2002 06:57 PM] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [08/14/2003 08:11 PM] "mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [07/23/2003 06:37 PM] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 08:00 AM] "AlcxMonitor"="ALCXMNTR.EXE" [09/07/2004 01:47 PM C:\WINDOWS\ALCXMNTR.EXE] "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [11/21/2006 05:08 PM] "QuickFinder Scheduler"="C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" [10/02/2001 01:36 AM] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [12/08/2003 05:35 PM] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [07/08/2005 09:25 AM] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 03:55 PM] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [06/26/2003 06:50 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RecordNow!"="" [] "NVIEW"="nview.dll,nViewLoadHook" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM] "cdloader"="C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" [09/21/2007 02:31 PM] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [06/22/2003 11:25 PM] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [10/14/2003 12:24:52 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [7/7/2003 10:20:40 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [7/30/2003 6:49:48 AM] Updates from HP.lnk - C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe [10/11/2003 12:26:40 AM] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-02-06 16:52:40 ------------ ======================================= Thank you! I've attached the extra.txt file as directed. |
|
|
|
|
02-06-2008, 05:30 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Thanks. I need a bit more info, please.
Please go to: VirusTotal
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-06-2008, 06:11 PM
|
#6 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
File cdloader2.exe_ received on 02.07.2008 02
23 (CET)Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) Loading server information... Your file is queued in position: 2. Estimated start time is between 41 and 59 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.2.6.10 2008.02.05 - AntiVir 7.6.0.62 2008.02.06 - Authentium 4.93.8 2008.02.06 - Avast 4.7.1098.0 2008.02.06 - AVG 7.5.0.516 2008.02.06 - BitDefender 7.2 2008.02.07 - CAT-QuickHeal 9.00 2008.02.04 - ClamAV 0.92 2008.02.07 - DrWeb 4.44.0.09170 2008.02.06 - eSafe 7.0.15.0 2008.01.28 - eTrust-Vet 31.3.5512 2008.02.05 - Ewido 4.0 2008.02.06 - FileAdvisor 1 2008.02.07 - Fortinet 3.14.0.0 2008.02.06 - F-Prot 4.4.2.54 2008.02.06 - F-Secure 6.70.13260.0 2008.02.07 - Ikarus T3.1.1.20 2008.02.07 - Kaspersky 7.0.0.125 2008.02.07 - McAfee 5224 2008.02.06 - Microsoft 1.3204 2008.02.06 - NOD32v2 2854 2008.02.06 - Norman 5.80.02 2008.02.06 - Panda 9.0.0.4 2008.02.06 - Prevx1 V2 2008.02.07 - Rising 20.29.22.00 2008.01.30 - Sophos 4.26.0 2008.02.07 - Sunbelt 2.2.907.0 2008.02.07 - Symantec 10 2008.02.07 - TheHacker 6.2.9.211 2008.02.06 - VBA32 3.12.6.0 2008.02.07 - VirusBuster 4.3.26:9 2008.02.06 - Webwasher-Gateway 6.6.2 2008.02.06 - Additional information File size: 54616 bytes MD5: 4d21432c5d457ae436ad7654e3d9b361 SHA1: a94296bcfef3620d3b924113181145ee480a6b5e PEiD: Armadillo v1.71 ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. =============================== THANK YOU! |
|
|
|
|
02-06-2008, 06:19 PM
|
#7 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Do you happen to know what that file is for? I can't seem to find enough information about it.
Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
02-06-2008, 06:28 PM
|
#8 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
ComboFix 08-02.05.3 - Owner 2008-02-06 20:23:49.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.521 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 ))))))))))))))))))))))))))))))) . 2008-02-06 16:49 . 2008-02-06 16:49 <DIR> d-------- C:\Deckard 2008-02-06 13:16 . 2004-08-04 02:56 388,608 --a------ C:\kmd.exe 2008-02-05 18:28 . 2008-02-05 18:28 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-04 19:00 . 2008-02-04 19:01 <DIR> d-------- C:\Documents and Settings\Owner\.housecall6.6 2008-02-04 15:40 . 2008-02-04 15:40 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-02-04 15:40 . 2008-02-04 15:40 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX 2008-01-26 21:14 . 2008-01-26 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Program Files\support.com 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Program Files\Common Files\SupportSoft 2008-01-21 17:48 . 2008-01-21 17:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Motive 2008-01-21 17:47 . 2008-02-03 15:33 <DIR> d-------- C:\WINDOWS\system32\ardCo17 2008-01-21 17:47 . 2008-01-21 17:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-01-14 21:25 . 2008-01-14 21:38 1,046 --a------ C:\net_save.dna . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-05 04:04 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2008-01-27 02:43 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-01-21 22:48 --------- d-----w C:\Program Files\Maxthon 2008-01-21 22:47 --------- d-----w C:\Program Files\Maxthon2 2008-01-21 22:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-15 03:03 --------- d-----w C:\Program Files\PINs 2007-12-18 03:24 846,504 ----a-w C:\Documents and Settings\Owner\JNativeCpp.dll 2007-12-18 00:56 --------- d-----w C:\Documents and Settings\Owner\Application Data\InterVideo 2007-12-17 11:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\mjusbsp 2007-12-17 10:59 45,056 ----a-w C:\WINDOWS\system32\UTSCSI.EXE 2007-12-17 02:39 --------- d-----w C:\Program Files\HP 2007-12-17 01:53 --------- d-----w C:\Program Files\Folder Marker 2007-12-16 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\RoboForm 2007-12-16 21:33 --------- d-----w C:\Program Files\Siber Systems 2007-12-16 21:06 43,696 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2007-12-16 21:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Corel 2007-12-16 20:13 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-12-16 20:07 --------- d-----w C:\Program Files\Common Files\Ahead 2007-12-16 20:07 --------- d-----w C:\Program Files\Ahead 2007-12-16 20:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-16 20:06 --------- d-----w C:\Program Files\CyberLink DVD Solution 2007-12-16 20:06 --------- d-----w C:\Program Files\CyberLink 2007-12-16 20:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2007-12-16 19:20 --------- d-----w C:\Program Files\Real Estate ToolKit 2007-12-16 19:15 --------- d-----w C:\Program Files\Common Files\Borland Shared 2007-12-16 19:13 --------- d-----w C:\Program Files\Corel 2007-12-16 18:52 --------- d-----w C:\Program Files\GPLGS 2007-12-16 18:51 --------- d-----w C:\Program Files\Acro Software 2007-12-16 18:48 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 2007-12-16 18:13 --------- d-----w C:\Program Files\Moffsoft Calculator 2 2007-12-16 18:12 --------- d-----w C:\Program Files\MWSnap 2007-12-16 18:11 --------- d-----w C:\Program Files\Microsoft Calculator Plus 2007-12-16 17:49 3,884 ----a-w C:\WINDOWS\viassary-hp.reg 2007-12-16 09:08 --------- d-----w C:\Program Files\MSBuild 2007-12-16 09:02 --------- d-----w C:\Program Files\Reference Assemblies 2007-12-16 08:59 --------- d-----w C:\Program Files\MSXML 6.0 2007-12-16 08:58 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-12-16 06:34 --------- d-----w C:\Program Files\MSXML 4.0 2007-12-16 04:11 --------- d-----w C:\Program Files\Alwil Software 2007-12-16 04:06 28,256 ----a-w C:\WINDOWS\system32\drivers\MxlW2k.sys 2007-12-16 04:06 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-16 04:04 --------- d-----w C:\Program Files\IntelliMover Data Transfer Demo 2007-12-16 04:03 --------- d-----w C:\Program Files\MSN Encarta Plus 2007-12-16 03:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-12-16 03:41 --------- d-----w C:\Program Files\Easy Internet signup 2007-12-16 03:34 4,306 --sha-r C:\WINDOWS\system32\drivers\HP_DW146A-ABA A405N_YC_Pavi_QMXK411_E41NAheBLU4_4_IGamila Giovani Neon series_SMICRO-STAR INTERNATIONAL CO., LTD_V030_B3.08_T040225_WXH1_L409_M504_J80_7Intel_8Celeron_92.7_111063044_N10EC8139_P_Z11C1044C_K_A808624C5.MRK 2007-12-16 03:29 --------- d-----w C:\Program Files\ArcSoft 2007-12-16 03:28 --------- d-----w C:\Program Files\Multimedia Card Reader 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll 2004-10-01 20:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . - Unable to find Resource table header in file. ---- Directory of C:\WINDOWS\system32\ardCo17 ---- ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93494523-F115-4A39-A415-BFCDEFBBD3B4}] C:\Program Files\NetMeeting\povedaqaC:\DOCUME~1\Owner\LOCALS~1\Temp\CEMG555077.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B645A20B-C57E-46CE-97CF-F9AFB1C607AB}] C:\Program Files\NetMeeting\povedaqaC:\WINDOWS\system32\o9\parreo83122.exe.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RecordNow!"="" [] "NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360] "cdloader"="C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" [2007-09-21 14:31 54616] "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2003-06-22 23:25 24576] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 15:51 118784] "CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23 90112] "HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 04:55 483328] "KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 22:02 61440] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 10:01 110592] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-10-10 23:58 151597] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 23:42 212992] "VTTimer"="VTTimer.exe" [] "LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 18:57 81920] "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-14 20:11 139264] "mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 18:37 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912] "QuickFinder Scheduler"="C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" [2001-10-02 01:36 77887] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 09:25 1397760] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 15:55 155648] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 00:24:52 557056] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-07-07 10:20:40 233472] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 06:49:48 57344] Updates from HP.lnk - C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe [2003-10-11 00:26:40 16384] S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15] S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15] . Contents of the 'Scheduled Tasks' folder "2008-01-17 02:44:08 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1197859269.job" - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1197859269 "2007-12-16 18:58:08 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job" - c:\Program Files\Microsoft IntelliType Pro\itype.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-06 20:26:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-06 20:27:53 ComboFix-quarantined-files.txt 2008-02-07 01:27:36 ComboFix2.txt 2008-02-06 18:50:16 . 2008-01-09 09:05:09 --- E O F --- |
|
|
|
|
02-06-2008, 06:34 PM
|
#9 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Logs are great, but I also need answers to questions.
Do you know what that file is for? I can't find enough information about it. It's in your startups. C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe Locate the file, right click, check properties, look for a version tab, company name, any sort of identifying information.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-06-2008, 06:46 PM
|
#10 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
The file is for Magicjack. It is a softphone device that allows you to attach an analog phone into the PC so you can have a traditional-style phone system in your house without any monthly charge. More info at Magicjack.com
I've attached a jpg of the folder where cdloader2.exe is located for your info. Thanks! |
|
|
|
|
02-06-2008, 06:59 PM
|
#11 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Thanks very much. I can add this information to some databases we use.
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked O2 - BHO: (no name) - {93494523-F115-4A39-A415-BFCDEFBBD3B4} - C:\Program Files\NetMeeting\povedaqaC:\DOCUME~1\Owner\LOCALS~1\Temp\CEMG555077.exe.dll (file missing) O2 - BHO: (no name) - {B645A20B-C57E-46CE-97CF-F9AFB1C607AB} - C:\Program Files\NetMeeting\povedaqaC:\WINDOWS\system32\o9\parreo83122.exe.dll (file missing) Close HijackThis now. --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
--------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-06-2008, 10:55 PM
|
#12 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT Thursday, February 07, 2008 12:48:39 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 7/02/2008 Kaspersky Anti-Virus database records: 552818 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 115211 Number of viruses found: 4 Number of infected objects: 14 Number of suspicious objects: 0 Duration of the scan process: 02:50:11 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\Downloads\AGSetup0609.exe/trickler3202_bic_audiogalaxydt.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped C:\Documents and Settings\Owner\Desktop\Downloads\AGSetup0609.exe/fsg-ag.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped C:\Documents and Settings\Owner\Desktop\Downloads\AGSetup0609.exe Vise: infected - 2 skipped C:\Documents and Settings\Owner\Desktop\SpyWare Tools\l2mfix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\hpcmerr.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\chandir.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\chandir.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\chn.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\chn.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\D0000000.FCS Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\inuse.txt Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\L0000002.FCS Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\main.log Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_die.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_die.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_ext.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_ext.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\storydb.dat Object is locked skipped C:\Program Files\Updates from HP\137903\Users\Default\Data\storydb.idx Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\opnmjjh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.giq skipped C:\QooBox\Quarantine\catchme2008-02-06_134700.51.zip/gebcb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-02-06_134700.51.zip/mljjiii.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.giq skipped C:\QooBox\Quarantine\catchme2008-02-06_134700.51.zip ZIP: infected - 2 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP180\A0021967.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.giq skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP180\A0021971.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP180\A0021972.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.giq skipped C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP184\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{3E35AB34-9B66-405B-8FCD-2BDBAF1FAA9D}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_588.dat Object is locked skipped C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped K:\Downloaded Software\AGSetup0609.exe/trickler3202_bic_audiogalaxydt.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped K:\Downloaded Software\AGSetup0609.exe/fsg-ag.exe Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped K:\Downloaded Software\AGSetup0609.exe Vise: infected - 2 skipped K:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. |
|
|
|
|
02-07-2008, 12:14 AM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Also post the new HijackThis log as requested.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-07-2008, 03:34 PM
|
#14 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:33:58 PM, on 2/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\LTMSG.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UTSCSI.EXE C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\PINs\PINs.exe C:\Program Files\Maxthon\Maxthon.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ceoexpress.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" MAGICJACK O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1197772738268 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1197775090562 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 9933 bytes |
|
|
|
|
02-07-2008, 05:42 PM
|
#15 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
Your logs appear clean.You should be good to go. We still have a few items to address.
These can be deleted. They are identified as trickler/gain/gator adware "C:\Documents and Settings\Owner\Desktop\Downloads\AGSetup0609.exe" "K:\Downloaded Software\AGSetup0609.exe" Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-11-2008, 10:46 AM
|
#16 (permalink) |
|
Registered User
Join Date: Feb 2008
Location: Michigan
Posts: 11
OS: XP SP3
|
Re: WIN32:TratBHO virus I can't get rid of it
Thanks so much for your help. Everything seems to have cleared up. However, I do have one more question. You sent me to secunia.com/software_inspector/ to inspect my software updates to ensure the most secure software versions were installed on my PC. It suggested that I update certain software, which I did. It had me update RealPlayer (which I rarely use) and when it updated it tried to insert a BHO. I clicked "allow" instead of "cancel" by mistake. Is this something I should concern myself with?
Other than that I AM EXTREMELY GRATEFUL!!! Drewboy70 |
|
|
|
|
02-11-2008, 10:54 AM
|
#17 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
If you rarely use Real Player, you can uninstall it.
As far as it's BHO, that should be fine. If you want to disable it, you can do so through IE7 controls. Tools > Manage Add-ons > Enable or Disable Add-ons Scroll to the Browser Helper object for Real, and select the Disable radio button, then click OK. Does that help?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-11-2008, 11:10 AM
|
#19 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: WIN32:TratBHO virus I can't get rid of it
You're quite welcome for the help.
Happy Computing, and Safe Surfing to you! 
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
