|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
03-19-2008, 08:20 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 8
OS: win xp
|
Constant PopUps-Logs and details.
I'm new here so I apologize for any mistakes in the manner of requesting help, I'll do my best to keep it proper.
First I read that details are helpful so here goes (nearly a wall of text sorry  ):========================================== Recently I downloaded a .exe file believing it to have been an update for ActiveX. I was weary at first so I downloaded it and scanned it for viruses; the scan came back with nothing so I went ahead and loaded. The icon of the .exe file itself looked very similar to the Windows Media Player icon for on my Windows XP (not sure if it’s different on vista), so I figured it must be the real deal. After the load up happened the .exe file was completely removed (or relocated to god knows where on my drive) and was replaced with to shortcuts to web-pages. One of the shortcuts is entitled “Online Security Guide” and has a Blue Shield with a white exclamation (!) point in the center. The other is entitled “Security Troubleshooting” and has a green shield with a white question mark (?) in the center. There was also something entitled “Virus Heat 3.4” or something to that effect which I attempted to remove with the start menu uninstall option. Once the uninstall was complete however the Virus Heat icon was still in my task bar as well as it popping up frequently prompting me to download some other .exe file and pay for this as well as -various pop-ups. I ran complete scans using my antivirus program and ad-aware; the virus scan came back with nothing and ad-aware removed 61 objects none of them the item I loaded (like an idiot) as they are persisting. Now, the next day, the virus heat appears to have been removed as I no longer see it anywhere but the other items remain. Whatever is left has placed two icons in my mini-task bar (in my bottom right hand area near the clock menu) one is a yellow triangle with a black exclamation point in the center, the triangle is constantly flashing and popping a message up that says “System Alert: Malware threats” and then delivers a message of a threat in the system. The other icon is an icon the flashes between a blue shield with a white question mark in the center to a red shield with a white cross in the center. When I mouse over either of these icons it doesn’t give a title or any other information. Also the shortcuts on my desktop the green shield and the blue shield have regular icons under my start menu, all programs all the way at the top, they are links to “asafetyvalue.com/~~~etc~~~~” With whatever this thing is loaded on my drive I receive many many pop ups while not even on the internet alerting me of threats to my system and prompts for anti-virus packages as well as more prompts for .exe files (ask_install.exe). My conclusion is that I (idiotically) downloaded a program that isn’t a virus and isn’t considered adware or whatever but a real program designed to deliver numerous pop ups either trying to scare the user or annoying them enough to buy or download whatever in order to get the messages to stop popping up. This is my guess, but I am far from a computer wiz. Also as an additional note if it helps any it has changed my home page to ( hxxp://securitypills.com/) and all the messages that prompt me with warnings and such appear to be designed to look like they are from Microsoft but none of them have any indication that they are. Also on my web browser it has added a bar that reads “Security Toolbar 7.1” and has a red meter that says my protection is 4/10. ========================================= Here is the main log from the DSS scan: Deckard's System Scanner v20071014.68 Run by Owner on 2008-03-19 21:59:42 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 28: 2008-03-20 01:59:48 UTC - RP203 - Deckard's System Scanner Restore Point 27: 2008-03-20 01:50:44 UTC - RP202 - Software Distribution Service 3.0 26: 2008-03-17 21:52:14 UTC - RP201 - System Checkpoint 25: 2008-03-13 15:15:29 UTC - RP200 - System Checkpoint 24: 2008-03-12 05:01:58 UTC - RP199 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2007-12-24 02:59:56 UTC - RP176 - Software Distribution Service 3.0 Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-03-19 22:02:06 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\WLTRYSVC.EXE C:\WINDOWS\system32\BCMWLTRY.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\McAfee\McAfee AntiSpyware\MASSrv.exe C:\Program Files\McAfee.com\Agent\Mcdetect.exe C:\Program Files\McAfee.com\Agent\McTskshd.exe C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\explorer.exe C:\Program Files\NetProject\scit.exe C:\Program Files\NetProject\sbmntr.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\NetProject\scm.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\WLTRAY.EXE C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\McAfee\SpamKiller\MSKAgent.exe C:\Program Files\NetProject\sbsm.exe C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe C:\Program Files\McAfee\McAfee AntiSpyware\MASAlert.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\McAfee.com\Personal Firewall\MpfAgent.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\BigFix\BigFix.exe C:\Documents and Settings\Owner.Chi\Desktop\Comp Fix Programs\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\1205890806.dll O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - C:\Program Files\NetProject\sbmdl.dll O2 - BHO: (no name) - {A3F6EDE7-9C30-4495-8D6D-6850ADDA58E5} - C:\WINDOWS\system32\ddcabxv.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar3.dll O2 - BHO: (no name) - {CB797518-AC2E-41A1-AE37-E8B6EF71C8A9} - C:\WINDOWS\system32\ssqrr.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar3.dll O3 - Toolbar: Internet Service - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - C:\Program Files\NetProject\wamdl.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~3\masalert.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\porgabih.dll",setvm O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\NetProject\sbmntr.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iefixgate.com/redirect.php (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.Chi\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/downlo...OGAControl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: ddcabxv - C:\WINDOWS\system32\ddcabxv.dll (file missing) O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll (file missing) O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - C:\WINDOWS\system32\wcscqa.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\MASSrv.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\system32\WLTRYSVC.EXE -- End of file - 11946 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 MPFIREWL - c:\windows\system32\drivers\mpfirewall.sys <Not Verified; McAfee; McAfee Personal Firewall> R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.2.0.3) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.2.0.3> S3 gwiopm - c:\documents and settings\owner.chi\desktop\piu\piu perfect collection\perfect\perfect\gwiopm.sys (file missing) S3 STEAMDVR - c:\program files\steam\bin\x86\steamdvr.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys <Not Verified; America Online, Inc.; Wan Miniport (ATW)> S3 XTrapD12 - f:\gunz\xtrap\xtrapd12.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 McAfee AntiSpyware Service - "c:\progra~1\mcafee\mcafee antispyware\massrv.exe" <Not Verified; McAfee, Inc.; McAfee AntiSpyware> S2 MskService (McAfee SpamKiller Server) - c:\progra~1\mcafee\spamki~1\msksrvr.exe <Not Verified; McAfee Inc.; McAfee SpamKiller> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2006-03-08 15:32:49 362 --a------ C:\WINDOWS\Tasks\McAfee AntiSpyware.job -- Files created between 2008-02-19 and 2008-03-19 ----------------------------- 2008-03-19 21:28:28 0 d-------- C:\ie-spyad_zo 2008-03-19 21:19:59 0 d-------- C:\Program Files\SpywareBlaster 2008-03-19 19:23:07 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-03-19 19:23:05 0 d-------- C:\WINDOWS\LastGood 2008-03-18 21:40:16 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-18 21:40:11 0 d-------- C:\Program Files\VirusHeat 4.3 2008-03-18 21:40:06 0 d-------- C:\Program Files\Helper 2008-03-18 21:39:51 0 d-------- C:\Program Files\NetProject 2008-03-05 17:21:22 854727 --a------ C:\WINDOWS\system32\z4123xff -- Find3M Report --------------------------------------------------------------- 2008-03-19 20:31:52 0 d-------- C:\Program Files\Symantec AntiVirus 2008-03-19 20:31:16 0 d-------- C:\Program Files\QuickTime 2008-03-19 20:27:36 0 d-------- C:\Program Files\Messenger 2008-03-19 20:26:19 0 d-------- C:\Program Files\iTunes 2008-03-19 20:25:03 0 d-------- C:\Program Files\Google 2008-03-19 20:23:18 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-03-19 20:21:42 0 d-------- C:\Program Files\BigFix 2008-03-18 20:34:10 0 d-------- C:\Program Files\MangaViewer 2008-03-18 12:57:47 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> 2008-03-11 12:26:10 13312 --a-s---- C:\WINDOWS\system32\wcscqa.dll 2008-01-27 23:26:49 0 d-------- C:\Program Files\World of Warcraft -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}] 03/18/2008 09:40 PM 13312 --a------ C:\Program Files\Helper\1205890806.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}] 03/19/2008 05:37 PM 10240 --a------ C:\Program Files\NetProject\sbmdl.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3F6EDE7-9C30-4495-8D6D-6850ADDA58E5}] C:\WINDOWS\system32\ddcabxv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB797518-AC2E-41A1-AE37-E8B6EF71C8A9}] C:\WINDOWS\system32\ssqrr.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"= C:\Program Files\NetProject\wamdl.dll [03/18/2008 09:39 PM 75776] [-HKEY_CLASSES_ROOT\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [08/06/2005 12:56 AM] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 03:50 PM] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/03/2004 12:24 AM] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [11/05/2004 11:47 AM] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [11/05/2004 11:47 AM] "Reminder"="%WINDIR%\Creator\Remind_XP.exe" [] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [04/29/2005 01:05 AM] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [09/22/2005 07:29 PM] "MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [01/11/2006 01:05 PM] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [09/26/2005 02:26 PM] "MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [08/12/2005 05:16 PM] "MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [11/11/2005 06:00 PM] "_AntiSpyware"="c:\progra~1\mcafee\MCAFEE~3\masalert.exe" [11/18/2005 08:16 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [10/25/2006 07:58 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 10:36 AM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [12/11/2006 09:28 PM] "DllRunning"="C:\WINDOWS\system32\porgabih.dll" [] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [08/02/2005 10:00 PM] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [08/18/2005 01:50 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 07:24 PM] "McAfee QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [12/01/2005 07:01 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/10/2004 03:00 PM] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [06/12/2006 03:32 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ BigFix.lnk - C:\Program Files\BigFix\BigFix.exe [2/13/2006 9:05:37 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "some"=C:\Program Files\NetProject\scit.exe "start"=C:\Program Files\NetProject\sbmntr.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{9d19a1a9-3cdf-4f15-a5ca-ea3905febded}"= C:\WINDOWS\system32\wcscqa.dll [03/11/2008 12:26 PM 13312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{A3F6EDE7-9C30-4495-8D6D-6850ADDA58E5}"= C:\WINDOWS\system32\ddcabxv.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcabxv] ddcabxv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr] C:\WINDOWS\system32\ssqrr.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] AutoRun\command- F:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{672f740b-ae29-11da-bcef-806d6172696f}] AutoRun\command- D:\setupSNK.exe *Newly Created Service* - RKPAVPROC -- End of Deckard's System Scanner: finished at 2008-03-19 22:02:45 ------------ I Also have the Panda Log from the Panda Active Scan completed in Step 2 if this information is needed. Thanks in advance for any and all help, I really do appreciate it. Last edited by tetonbob; 03-24-2008 at 09:11 PM. Reason: munged live link to malware site, please don't post live links! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
03-21-2008, 02:26 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Hello and Welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please be patient with me during this time. |
|
|
|
|
03-21-2008, 04:04 PM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Hello plzhelpsadpanda. Yes, please post the Panda active scan log in your next reply. Thanks.
I notice that you have a corporate edition of McAfee AV. Is this your work computer? Please let me know. Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Download SDFix and Save it to your Desktop. Double-click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please reboot your computer in Safe Mode by doing the following:
Open the extracted SDFix folder and double-click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Post that log in your next reply. ------------------------------------------------------ Please visit this webpage for instructions on downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. It's a simple procedure that will only take a few moments of your time. When the tool is finished, it will produce a log for you. Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. If you have any questions along the way...STOP and ask them before proceeding. ------------------------------------------------------ Next, download HijackThis and Save it to your Desktop. Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the HijackThis log here. Do not fix anything in HijackThis since they may be harmless. ------------------------------------------------------ Please post the following in your next reply: Report.txt C:\ComboFix.txt new HijackThis log Panda scan log |
|
|
|
|
03-23-2008, 04:03 PM
|
#4 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 8
OS: win xp
|
Re: Constant PopUps-Logs and details.
Thank you for your initial response, I apoligize for my tardiness, I was unable to connect to the net over the weekend.
No this isn't a work issued computer, it is the laptop that I purchased when I began school. The McAfee account however hasn't been updated since the initial alotted time, so I'm not sure how much use it is. I am currently using the school's anti-virus program "Symantec Antivirus." Here is the PandaScanLog: Incident Status Location Adware:adware/safetybar Not disinfected c:\documents and settings\all users\desktop\Online Security Guide.url Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\LocalService\Cookies\owner@winantispyware[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\LocalService\Cookies\owner@winantivirus[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\LocalService\Cookies\owner@www.winantivirus[1].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@888[1].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@adopt.hbmediapro[1].txt Spyware:Cookie/AdvancedCleaner Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@advancedcleaner[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@advertising[1].txt Spyware:Cookie/AntiSpyKit Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@antispykit[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@atwola[1].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@azjmp[1].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@bluestreak[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@bs.serving-sys[1].txt Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@burstnet[2].txt Spyware:Cookie/Barelylegal Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@c.fsx[1].txt Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@cassava[1].txt Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@ccbill[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@cgi-bin[5].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@com[2].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@did-it[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@doubleclick[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@drivecleaner[2].txt Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@entrepreneur[2].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@errorsafe[2].txt Spyware:Cookie/Powerscan Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@gammae[2].txt Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@gostats[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@go[1].txt Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@kinghost[1].txt Spyware:Cookie/Twain-Tech Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@master.mx-targeting[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@mediaplex[2].txt Spyware:Cookie/Lop Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@mp3search[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@serving-sys[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@stats.drivecleaner[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@systemdoctor[1].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@target[2].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@toplist[2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@tribalfusion[2].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@winantivirus[2].txt Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.burstbeacon[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.drivecleaner[2].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.errorsafe[1].txt Spyware:Cookie/Freehqvideos Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.freehqvideos[1].txt Spyware:Cookie/Mp3s Hits Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.mp3shits[2].txt Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.myaffiliateprogram[2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.systemdoctor[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www.winantiviruspro[2].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www1.addfreestats[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www2.addfreestats[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www3.addfreestats[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@www6.addfreestats[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@xiti[1].txt Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Owner.Chi\Cookies\owner@yadro[1].txt Adware:Adware/ErrClean Not disinfected C:\Documents and Settings\Owner.Chi\Local Settings\Temporary Internet Files\Content.IE5\458BCJ43\setup_en[1].exe Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.047 Potentially unwanted tool:Application/VirusHeat Not disinfected C:\Program Files\VirusHeat 4.3\VirusHeat 4.3.exe Here is the the Report.txt: SDFix: Version 1.160 Run by Owner on Sun 03/23/2008 at 05:07 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default IE HomePage Rebooting Checking Files : Trojan Files Found: C:\Documents and Settings\All Users\Desktop\Online Security Guide.url - Deleted C:\Documents and Settings\All Users\Start Menu\Online Security Guide.url - Deleted C:\Documents and Settings\All Users\Desktop\Security Troubleshooting.url - Deleted C:\Documents and Settings\All Users\Start Menu\Security Troubleshooting.url - Deleted C:\Program Files\Helper\1205890806.dll - Deleted C:\Program Files\NetProject\ot.ico - Deleted C:\Program Files\NetProject\sbmdl.dll - Deleted C:\Program Files\NetProject\sbmntr.exe - Deleted C:\Program Files\NetProject\sbsm.exe - Deleted C:\Program Files\NetProject\sbun.exe - Deleted C:\Program Files\NetProject\scit.exe - Deleted C:\Program Files\NetProject\scm.exe - Deleted C:\Program Files\NetProject\scu.exe - Deleted C:\Program Files\NetProject\ts.ico - Deleted C:\Program Files\NetProject\wamdl.dll - Deleted C:\Program Files\NetProject\waun.exe - Deleted Folder C:\Program Files\Helper - Removed Folder C:\Program Files\NetProject - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-23 17:19:12 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\24\xe1\21] "DisplayName"="\xacd0\x219\xacd0\x219\1" "DeviceDesc"="\xacd0\x219\xacd0\x219\1" "ProviderName"="\xfed4\21\xee18\x7c90\xff44\21\b" "MFG"="\x54c" "ReinstallString"="C:\WINDOWS\System32\ReinstallBackups\\xe114\21\x80\xc010\DriverFiles\.INF" "DeviceInstanceIds"=str(7):"d:\i386\apps\app22467\sbdrv\smbus\smbusati.inf" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe:*:Enabled:AOLTsMon" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe:*:Enabled:AOLTopSpeed" "C:\\Program Files\\Common Files\\AOL\\1139879672\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1139879672\\EE\\AOLServiceHost.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe:*:Enabled:AOL" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "F:\\Program Files\\AIM\\aim.exe"="F:\\Program Files\\AIM\\aim.exe:*:Disabled:AOL Instant Messenger" "C:\\Program Files\\Turbine\\Dungeons & Dragons Online - Stormreach\\dndclient.exe"="C:\\Program Files\\Turbine\\Dungeons & Dragons Online - Stormreach\\dndclient.exe:*:Enabled:dndclient" "C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"="C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe:*:Enabled:PlayOnline Viewer" "C:\\Program Files\\Steam\\SteamApps\\bedecker\\red orchestra\\System\\RedOrchestra.exe"="C:\\Program Files\\Steam\\SteamApps\\bedecker\\red orchestra\\System\\RedOrchestra.exe:*:Disabled:RedOrchestra" "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Documents and Settings\\Owner.Chi\\My Documents\\WoW-1.11.1.5462-to-0.11.2.5464-enUS-downloader.exe"="C:\\Documents and Settings\\Owner.Chi\\My Documents\\WoW-1.11.1.5462-to-0.11.2.5464-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Documents and Settings\\Owner.Chi\\My Documents\\WoW-1.11.2.5464-to-0.12.0.5496-enUS-downloader.exe"="C:\\Documents and Settings\\Owner.Chi\\My Documents\\WoW-1.11.2.5464-to-0.12.0.5496-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.12.0.5537-to-0.12.0.5561-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.12.0.5537-to-0.12.0.5561-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"="C:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe:*:Enabled:BF1942" "C:\\Program Files\\America's Army\\System\\ArmyOps.exe"="C:\\Program Files\\America's Army\\System\\ArmyOps.exe:*:Enabled:ArmyOps" "F:\\Gunz\\GunzLauncher.exe"="F:\\Gunz\\GunzLauncher.exe:*:Enabled:GunzLauncher" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC" "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Documents and Settings\\Owner.Chi\\My Documents\\My Videos\\WowExpansionMaster_1024_2100_B_English.avi-downloader.exe"="C:\\Documents and Settings\\Owner.Chi\\My Documents\\My Videos\\WowExpansionMaster_1024_2100_B_English.avi-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo" "C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Disabled:LimeWire swarmed installer" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe:*:Enabled:Blizzard Downloader" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Wed 28 Feb 2007 1,158,372 A.SH. --- "C:\WINDOWS\system32\rrqss.tmp" Wed 28 Feb 2007 1,157,212 A.SH. --- "C:\WINDOWS\system32\rrqss.bak1" Thu 1 Mar 2007 1,156,098 A.SH. --- "C:\WINDOWS\system32\rrqss.bak2" Tue 16 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Tue 29 Aug 2006 2,188 A.SH. --- "C:\Documents and Settings\Owner.Chi\Application Data\Roxio\Dragon\DiscInfoCache\PHILIPS__DVD+-RW_SDVD8441_PA48_300_DICV018_DRGV20100BC.TMP" Finished! I have a question before I do the combofix, on the windows page for downloads of the recovery packs I only see the options for Home or Professional ( I have starter pack 2). But when I check the properties for my comp it lists my computer as a Media Center Edition, would I have to go else where for the recovery pack for this edition or would either one work? Again I apologize for my tardy response time, but I will now be able to check back on a frequent basis. Again thank you for the help so far and any additional help, it really is very much appreciated. |
|
|
|
|
03-24-2008, 04:06 AM
|
#5 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Hello again, plzhelpsadpanda.
Quote:
------------------------------------------------------ Media Center is based on XP Pro SP2. Please choose that recovery pack and continue with the instructions given previously in Post #3. Then, do the following: ------------------------------------------------------ Please go to: VirusTotal
|
|
|
|
|
|
03-24-2008, 07:01 AM
|
#6 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 8
OS: win xp
|
Re: Constant PopUps-Logs and details.
Thank you for the response about the RecoveryPack question Chemist.
Here is the ComboFix Log: ComboFix 08-03-23.2 - Owner 2008-03-24 8:32:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.408 [GMT -4:00] Running from: C:\Documents and Settings\Owner.Chi\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner.Chi\Application Data\macromedia\Flash Player\#SharedObjects\FLFHZJ8G\www.broadcaster.com C:\Documents and Settings\Owner.Chi\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Owner.Chi\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Program Files\VirusHeat 4.3 C:\Program Files\VirusHeat 4.3\vht.dat C:\Program Files\VirusHeat 4.3\VirusHeat 4.3.exe C:\WINDOWS\system32\mcrh.tmp D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 ))))))))))))))))))))))))))))))) . 2008-03-23 17:02 . 2008-03-23 17:03 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-23 16:43 . 2008-03-23 17:28 <DIR> d-------- C:\SDFix 2008-03-19 21:59 . 2008-03-19 21:59 <DIR> d-------- C:\Deckard 2008-03-19 21:28 . 2008-03-19 21:28 <DIR> d-------- C:\ie-spyad_zo 2008-03-19 21:19 . 2008-03-19 21:22 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-19 19:23 . 2008-03-19 21:00 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-19 19:23 . 2008-03-19 19:36 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-19 19:23 . 2008-03-19 19:36 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-19 19:23 . 2008-03-19 19:36 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-18 21:40 . 2008-03-18 21:42 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-10 14:50 . 2008-03-19 18:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-10 14:50 . 2008-03-10 14:50 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-05 17:21 . 2008-03-05 17:21 854,727 --a------ C:\WINDOWS\system32\z4123xff . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-24 12:14 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-03-20 00:31 --------- d-----w C:\Program Files\QuickTime 2008-03-20 00:26 --------- d-----w C:\Program Files\iTunes 2008-03-20 00:25 --------- d-----w C:\Program Files\Google 2008-03-20 00:23 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-20 00:21 --------- d-----w C:\Program Files\BigFix 2008-03-19 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-03-19 00:34 --------- d-----w C:\Program Files\MangaViewer 2008-03-18 16:57 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-03-18 16:57 249,856 ------w C:\WINDOWS\Setup1.exe 2008-03-11 16:26 13,312 --s-a-w C:\WINDOWS\system32\wcscqa.dll 2008-01-28 03:26 --------- d-----w C:\Program Files\World of Warcraft 2007-03-01 00:33 1,157,212 --sha-w C:\WINDOWS\system32\rrqss.bak1 2007-03-02 00:26 1,156,098 --sha-w C:\WINDOWS\system32\rrqss.bak2 2007-03-02 00:59 1,156,600 --sh--w C:\WINDOWS\system32\rrqss.ini2 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB797518-AC2E-41A1-AE37-E8B6EF71C8A9}] C:\WINDOWS\system32\ssqrr.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"= "C:\Program Files\NetProject\wamdl.dll" [ ] [HKEY_CLASSES_ROOT\clsid\{db9fba9d-ab1b-4cc6-9745-f3b549d64e40}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"= C:\Program Files\NetProject\wamdl.dll [ ] [HKEY_CLASSES_ROOT\clsid\{db9fba9d-ab1b-4cc6-9745-f3b549d64e40}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208] "McAfee QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [2005-12-01 07:01 110592] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 15:32 700416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 15:50 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 00:24 32768] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 11:47 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 11:47 688218] "Reminder"="%WINDIR%\Creator\Remind_XP.exe" [ ] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-29 01:05 344064] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29 303104] "MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05 212992] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 14:26 110592] "MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 17:16 1121792] "MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 18:00 1005096] "_AntiSpyware"="c:\progra~1\mcafee\MCAFEE~3\masalert.exe" [2005-11-18 20:16 327680] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36 256576] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-12-11 21:28 185896] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-08-02 22:00 67184] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-08-18 13:50 120640] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{9d19a1a9-3cdf-4f15-a5ca-ea3905febded}"= C:\WINDOWS\system32\wcscqa.dll [2008-03-11 12:26 13312] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcabxv] ddcabxv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr] C:\WINDOWS\system32\ssqrr.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-01-25 18:26] S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 15:10] S3 gwiopm;gwiopm;C:\Documents and Settings\Owner.Chi\Desktop\PIU\PIU Perfect Collection\perfect\perfect\gwiopm.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\LaunchU3.exe . Contents of the 'Scheduled Tasks' folder "2006-03-08 19:32:49 C:\WINDOWS\Tasks\McAfee AntiSpyware.job" - c:\progra~1\mcafee\MCAFEE~3\MASCon.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 08:35:17 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-24 8:36:22 ComboFix-quarantined-files.txt 2008-03-24 12:36:06 . 2008-03-12 05:03:50 --- E O F --- Here is the Hijackthis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:45:02 AM, on 3/24/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe c:\progra~1\mcafee\mcafee antispyware\massrv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\WLTRAY.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\progra~1\mcafee\MCAFEE~3\masalert.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\BigFix\BigFix.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Owner.Chi\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {CB797518-AC2E-41A1-AE37-E8B6EF71C8A9} - C:\WINDOWS\system32\ssqrr.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Internet Service - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - C:\Program Files\NetProject\wamdl.dll (file missing) O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~3\masalert.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.Chi\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: ddcabxv - ddcabxv.dll (file missing) O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll (file missing) O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - C:\WINDOWS\system32\wcscqa.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 9907 bytes Here is the Results from the VirusTotal Scan: Antivirus Version Last Update Result AhnLab-V3 2008.3.22.1 2008.03.24 - AntiVir 7.6.0.75 2008.03.23 - Authentium 4.93.8 2008.03.22 - Avast 4.7.1098.0 2008.03.24 - AVG 7.5.0.516 2008.03.23 - BitDefender 7.2 2008.03.24 - CAT-QuickHeal 9.50 2008.03.21 - ClamAV 0.92.1 2008.03.24 - DrWeb 4.44.0.09170 2008.03.24 - eSafe 7.0.15.0 2008.03.18 - eTrust-Vet 31.3.5633 2008.03.21 - Ewido 4.0 2008.03.24 - F-Prot 4.4.2.54 2008.03.23 - F-Secure 6.70.13260.0 2008.03.24 - FileAdvisor 1 2008.03.24 - Fortinet 3.14.0.0 2008.03.24 - Ikarus T3.1.1.20 2008.03.24 - Kaspersky 7.0.0.125 2008.03.24 - McAfee 5257 2008.03.21 - Microsoft 1.3301 2008.03.24 - NOD32v2 2968 2008.03.24 - Norman 5.80.02 2008.03.20 - Panda 9.0.0.4 2008.03.23 - Prevx1 V2 2008.03.24 - Rising 20.37.02.00 2008.03.24 - Sophos 4.27.0 2008.03.24 - Sunbelt 3.0.978.0 2008.03.18 - Symantec 10 2008.03.24 - TheHacker 6.2.92.252 2008.03.22 - VBA32 3.12.6.3 2008.03.21 - VirusBuster 4.3.26:9 2008.03.23 - Webwasher-Gateway 6.6.2 2008.03.24 - Additional information File size: 854727 bytes MD5: 4621b1be497edd5de91b9663cc38338a SHA1: 17ff0dc6845b2365a0914d8a2f7ad32b4e23471f PEiD: - |
|
|
|
|
03-24-2008, 03:21 PM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Hello plzhelpsadpanda.
Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Did you try to uninstall all McAfee programs? You can do it using the following uninstaller: Please download the McAfee Removal Tool MCPR.exe and Save it to your Desktop.
1. Close any open browsers. 2. Open Notepad and copy/paste the text in the codebox below into it: Code:
Folder::
C:\Program Files\Common Files\Totem Shared
C:\Documents and Settings\All Users\Application Data\Viewpoint
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB797518-AC2E-41A1-AE37-E8B6EF71C8A9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
[-HKEY_CLASSES_ROOT\clsid\{db9fba9d-ab1b-4cc6-9745-f3b549d64e40}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{9d19a1a9-3cdf-4f15-a5ca-ea3905febded}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcabxv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrr]
File::
C:\WINDOWS\system32\wcscqa.dll
C:\WINDOWS\system32\rrqss.bak1
C:\WINDOWS\system32\rrqss.bak2
C:\WINDOWS\system32\rrqss.ini2
 Referring to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you. Please post C:\ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log |
|
|
|
|
03-24-2008, 04:51 PM
|
#8 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 8
OS: win xp
|
Re: Constant PopUps-Logs and details.
Here is the Combo Fix Log:
ComboFix 08-03-23.2 - Owner 2008-03-24 18:42:08.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.540 [GMT -4:00] Running from: C:\Documents and Settings\Owner.Chi\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner.Chi\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\wcscqa.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Program Files\Common Files\Totem Shared C:\Program Files\Common Files\Totem Shared\Update\Bpk.dll.137 C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.051 C:\Program Files\Common Files\Totem Shared\Update\FavoriteLinks.dll.073 C:\Program Files\Common Files\Totem Shared\Update\FreeSamples.dll.045 C:\Program Files\Common Files\Totem Shared\Update\msvcr70.dll.010 C:\Program Files\Common Files\Totem Shared\Update\Music.dll.026 C:\Program Files\Common Files\Totem Shared\Update\Network.dll.065 C:\Program Files\Common Files\Totem Shared\Update\System.dll.091 C:\Program Files\Common Files\Totem Shared\Update\Update.dll.069 C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.077 C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.047 C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\wcscqa.dll . ((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 ))))))))))))))))))))))))))))))) . 2008-03-23 17:02 . 2008-03-23 17:03 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-23 16:43 . 2008-03-23 17:28 <DIR> d-------- C:\SDFix 2008-03-19 21:59 . 2008-03-19 21:59 <DIR> d-------- C:\Deckard 2008-03-19 21:28 . 2008-03-19 21:28 <DIR> d-------- C:\ie-spyad_zo 2008-03-19 21:19 . 2008-03-19 21:22 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-19 19:23 . 2008-03-19 21:00 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-19 19:23 . 2008-03-19 19:36 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-19 19:23 . 2008-03-19 19:36 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-19 19:23 . 2008-03-19 19:36 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-18 21:40 . 2008-03-18 21:42 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-10 14:50 . 2008-03-24 09:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-10 14:50 . 2008-03-10 14:50 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-05 17:21 . 2008-03-05 17:21 854,727 --a------ C:\WINDOWS\system32\z4123xff . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-24 22:37 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-03-24 12:38 --------- d-----w C:\Program Files\MSN Encarta Plus 2008-03-20 00:31 --------- d-----w C:\Program Files\QuickTime 2008-03-20 00:26 --------- d-----w C:\Program Files\iTunes 2008-03-20 00:25 --------- d-----w C:\Program Files\Google 2008-03-20 00:23 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-20 00:21 --------- d-----w C:\Program Files\BigFix 2008-03-19 00:34 --------- d-----w C:\Program Files\MangaViewer 2008-03-18 16:57 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-03-18 16:57 249,856 ------w C:\WINDOWS\Setup1.exe 2008-01-28 03:26 --------- d-----w C:\Program Files\World of Warcraft . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208] "McAfee QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [ ] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 15:32 700416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 15:50 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 00:24 32768] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 11:47 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 11:47 688218] "Reminder"="%WINDIR%\Creator\Remind_XP.exe" [ ] "Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-29 01:05 344064] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36 256576] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-12-11 21:28 185896] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-08-02 22:00 67184] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-08-18 13:50 120640] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-01-25 18:26] S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 15:10] S3 gwiopm;gwiopm;C:\Documents and Settings\Owner.Chi\Desktop\PIU\PIU Perfect Collection\perfect\perfect\gwiopm.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\LaunchU3.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-24 18:45:18 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-24 18:46:07 ComboFix-quarantined-files.txt 2008-03-24 22:45:52 ComboFix2.txt 2008-03-24 12:36:23 . 2008-03-12 05:03:50 --- E O F --- And here is the Hijackthis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:48:43 PM, on 3/24/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Owner.Chi\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.Chi\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7314 bytes |
|
|
|
|
03-24-2008, 08:12 PM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Hello again, plzhelpsadpanda.
Your logs show 2 files missing: C:\WINDOWS\system32\WLTRAY %WINDIR%\SMINST\RECGUARD.EXE Any idea where they went? Have any of those been mentioned at Windows startup? It's OK if you don't know. ------------------------------------------------------ I see you have P2P software ( Limewire, BitTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized Please remember to close all other windows, including browsers then click Fix checked. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
03-25-2008, 09:10 AM
|
#10 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 8
OS: win xp
|
Re: Constant PopUps-Logs and details.
Here is the Kaspersky Scan Log:
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, March 25, 2008 10:38:55 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 25/03/2008 Kaspersky Anti-Virus database records: 660927 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 59704 Number of viruses found: 11 Number of infected objects: 47 Number of suspicious objects: 0 Duration of the scan process: 01:31:54 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner.Chi\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Temp\~DF869E.tmp Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Temp\~DF86A9.tmp Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner.Chi\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner.Chi\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner.Chi\ntuser.dat.LOG Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific_UK.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Gateway_Specific_Vista.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Microsoft_Security.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Microsoft_Security_UK.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Other.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Urgent.dat Object is locked skipped C:\Program Files\BigFix\__Data\Gateway\__Local\Tmp\Welcome.dat Object is locked skipped C:\QooBox\Quarantine\C\Program Files\VirusHeat 4.3\VirusHeat 4.3.exe.vir Infected: not-a-virus:FraudTool.Win32.VirusProtectPro.x skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wcscqa.dll.vir Infected: not-virus:Hoax.Win32.Agent.aw skipped C:\SDFix\backups\backups.zip/backups/1205890806.dll Infected: not-a-virus:AdWare.Win32.E404.s skipped C:\SDFix\backups\backups.zip/backups/sbmdl.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\SDFix\backups\backups.zip/backups/sbmntr.exe Infected: Trojan-Downloader.Win32.Zlob.jlq skipped C:\SDFix\backups\backups.zip/backups/sbsm.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\SDFix\backups\backups.zip/backups/sbun.exe Infected: Trojan-Downloader.Win32.Zlob.jlp skipped C:\SDFix\backups\backups.zip/backups/scm.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\SDFix\backups\backups.zip/backups/scu.exe Infected: Trojan-Downloader.Win32.Zlob.jpd skipped C:\SDFix\backups\backups.zip/backups/wamdl.dll Infected: not-virus:Hoax.Win32.Gavec.ak skipped C:\SDFix\backups\backups.zip/backups/waun.exe Infected: Trojan-Downloader.Win32.Zlob.jpe skipped C:\SDFix\backups\backups.zip ZIP: infected - 9 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069516.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069517.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069520.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069535.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069536.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP201\A0069537.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069686.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069687.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069688.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069705.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069706.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069707.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069722.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069723.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069724.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069736.dll Infected: not-a-virus:AdWare.Win32.E404.s skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069738.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069739.exe Infected: Trojan-Downloader.Win32.Zlob.jlq skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069740.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069741.exe Infected: Trojan-Downloader.Win32.Zlob.jlp skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069743.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069744.exe Infected: Trojan-Downloader.Win32.Zlob.jpd skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069746.dll Infected: not-virus:Hoax.Win32.Gavec.ak skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069747.exe Infected: Trojan-Downloader.Win32.Zlob.jpe skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069758.dll Infected: not-a-virus:AdWare.Win32.E404.s skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069760.dll Infected: Trojan-Downloader.Win32.Zlob.jlm skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069761.exe Infected: Trojan-Downloader.Win32.Zlob.jlq skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069762.exe Infected: Trojan-Downloader.Win32.Zlob.jln skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069763.exe Infected: Trojan-Downloader.Win32.Zlob.jlp skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069765.exe Infected: Trojan-Downloader.Win32.Zlob.jpf skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069766.exe Infected: Trojan-Downloader.Win32.Zlob.jpd skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069769.dll Infected: not-virus:Hoax.Win32.Gavec.ak skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP203\A0069770.exe Infected: Trojan-Downloader.Win32.Zlob.jpe skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP204\A0069921.exe Infected: not-a-virus:FraudTool.Win32.VirusProtectPro.x skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP205\A0070264.dll Infected: not-virus:Hoax.Win32.Agent.aw skipped C:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP207\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_AC97 Soft Data Fax Modem with SmartCP.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{12FCE2DD-A796-49B2-A568-FB608366AD25}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\_restore{A0427B73-25B8-43D0-92D4-F22E7758340C}\RP207\change.log Object is locked skipped Scan process completed. Here is the new Hijackthis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:41:18 AM, on 3/25/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Documents and Settings\Owner.Chi\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM\aim.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.Chi\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7579 bytes When I ran the initial hijack this and had to check those entries if they existed, I ended up having to check all 4 of them, not sure if you needed to know but yeah. As far as the p2p programs go, I honestly downloaded those roughly 6 or so months ago, used each program once and didn't like them so I uninstalled both using the Add/Remove programs option roughly 2-3 days after the initial download and installation of the program. I'm surprised they are still there, I haven't reinstalled them or anything since I removed them. Is there any other method of removing them that I don't know about? Because I double checked in the Add/Remove Programs list and both aren't showing in there???? The System itself is working good. All the obvious malware with the pop ups and such have ceased, as well the flashing shield icon in the corner which constantly informed of viruses and to buy a program, thank you for everything so far! Last edited by plzhelpsadpanda; 03-25-2008 at 09:12 AM. |
|
|
|
|
03-25-2008, 12:38 PM
|
#11 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,627
OS: XP SP3
|
Re: Constant PopUps-Logs and details.
Congratulations. Well done! Your logs appear clean. You should be good to go.
Your DSS log showed 2 firewalls enabled when you first posted: Quote:
------------------------------------------------------ Quote:
------------------------------------------------------ Please re-enable any antivirus or antispyware programs disabled earlier if you haven't already. Delete the following folder in blue: C:\SDFix As far as those infected objects listed in the Kaspersky log, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now. Go to Start>>Run>> and Copy/Paste the following single line command into the Run box and click OK combofix /uThis will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
||
|
|
|
| Thread Tools | |
|
|
