|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
03-23-2008, 01:44 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Internet hijacked. Have followed five steps; need assurance
Running XP Home - SP2. IE.
Norton AntiVrus Ad-Aware 2007 Zonealarm Error Nuker I apologise if I have forgotten to provide all you need. A few days ago I started getting web adverts and messages every time I tried using the internet. Then Norton started blocking incoming viruses and found a couple already in the machine. I ran scans which failed to rectify problems. I downloaded AVG Anti-spyware, CCleaner Malwarebytes' Anti Malware and SUPERAntiSpyware [all free editions]. After trying them each as I downloaded them, I did a run of them all, back to back, in Safe mode. Still no luck. I have followed your suggested five steps and now need to know how to proceed. My 'hijack this' scan appeared to be clean before the scans. This is my scan from Panda - can I safely delete al these entries? And is there anything else I can do? Thanks for your time. Incident Status Location Dialer:dialer.asl Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D19781C5-2051-44F8-8445-DDC82933C191} Adware:adware/ist.yoursitebar Not disinfected Windows Registry Adware:adware/topconvert Not disinfected Windows Registry Adware:adware/ist.sidefind Not disinfected Windows Registry Adware:adware/ist.istbar Not disinfected Windows Registry Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael\Cookies\michael@belnk[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael\Cookies\michael@dist.belnk[2].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Michael\Cookies\michael@xiti[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Mum\Cookies\mum@ad.yieldmanager[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Mum\Cookies\mum@doubleclick[1].txt Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Mum\Cookies\mum@enhance[1].txt Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\Mum\Cookies\mum@goclick[2].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Rose\Cookies\rose@adopt.hbmediapro[2].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Rose\Cookies\rose@azjmp[2].txt Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Rose\Cookies\rose@cassava[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Rose\Cookies\rose@dist.belnk[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Rose\Cookies\rose@go[1].txt Spyware:Cookie/Screensavers Not disinfected C:\Documents and Settings\Rose\Cookies\rose@i.screensavers[1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Rose\Cookies\rose@media.adrevolver[5].txt Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Rose\Cookies\rose@winfixer[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Rose\Cookies\rose@xiti[1].txt Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Rose\Cookies\rose@xmts[2].txt Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00092986.TXT Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00092987.TXT Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00092988.TXT Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00092989.TXT Spyware:Cookie/Xmts Not disinfected C:\RECYCLER\NPROTECT\00093841.TXT Spyware:Cookie/Xmts Not disinfected C:\RECYCLER\NPROTECT\00093847.TXT Spyware:Cookie/Xmts Not disinfected C:\RECYCLER\NPROTECT\00093854.TXT Here is my hijackthis scan Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:22:54, on 23/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\GS30s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:80 O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\xuqpnpkj.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/tech...l/SymAData.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1128463012750 O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/sof...iveXPlugin.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GS30s - Unknown owner - C:\WINDOWS\SYSTEM32\GS30s.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 8502 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
03-26-2008, 10:39 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Hello and Welcome. Apologies for any delay in replying, but we have been rather busy lately.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. If you still require assistance for this issue, and since it has been a few days since you first posted, please do this, as requested in our pre-posting sticky at the top of the forum: Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
--------------------------------------------------------------------------------------------- Thank you.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 02:52 AM
|
#3 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
Hi Tetonbob
Thanks for helping me out. I have already deleted most of the files that the original scans highlighted, but it didn't fix the problem completely. I could not find the files marked just as registry. I since found a file in W:\System32 called 'lnebubbo' which I uploaded to virustotal and discovered that it was infected, though none of the protective programs I have were able to find the virus. I was able to delete it while in Safe Mode. I'm not receiving pop-ups any more, but my system is slow, due, I would imagine, to the number of programs I have running to keep me clean. My scans are attached. Any help will be gladly received, even if it is only to tell me what software I can get rid of. Deckard's System Scanner v20071014.68 Run by Mum on 2008-03-27 08:32:02 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 18: 2008-03-27 08:32:09 UTC - RP18 - Deckard's System Scanner Restore Point 17: 2008-03-26 11:43:57 UTC - RP17 - System Checkpoint 16: 2008-03-24 13:44:23 UTC - RP16 - System Checkpoint 15: 2008-03-23 00:29:41 UTC - RP15 - System Checkpoint 14: 2008-03-21 11:21:04 UTC - RP14 - Last known good configuration -- First Restore Point -- 1: 2008-03-21 11:20:28 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Mum.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:35:53, on 27/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\GS30s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Documents and Settings\Mum\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Mum.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:80 O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/tech...l/SymAData.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1128463012750 O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/sof...iveXPlugin.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GS30s - Unknown owner - C:\WINDOWS\SYSTEM32\GS30s.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9323 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080313-122459-462 O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe backup-20080313-124414-886 O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab backup-20080313-124415-566 O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab backup-20080313-165559-691 O16 - DPF: {101DE947-EE92-43C2-90AE-00888991EE2E} (TNSClicker.Clicker) - http://www.shopandscan.com/TNSClicker.CAB backup-20080313-165600-753 O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/appl...orLauncher.cab backup-20080320-233552-531 O4 - HKLM\..\Run: [18801b4d] rundll32.exe "C:\WINDOWS\system32\ruhjjfqs.dll",b backup-20080320-233552-717 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\ivcvoiup.dll",s backup-20080320-233652-850 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\ivcvoiup.dll",s backup-20080320-233734-101 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\ivcvoiup.dll",s backup-20080320-233759-134 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\ivcvoiup.dll",s backup-20080321-223922-883 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\kyboknid.dll",s backup-20080322-234549-451 O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll backup-20080322-234550-209 O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') backup-20080322-234550-237 O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') backup-20080322-234550-282 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\xuqpnpkj.dll",s backup-20080322-234550-395 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') backup-20080322-234550-436 O15 - Trusted Zone: http://opac.ni-libraries.net backup-20080322-234550-501 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') backup-20080322-234550-502 O4 - HKLM\..\Run: [18801b4d] rundll32.exe "C:\WINDOWS\system32\smigkofe.dll",b backup-20080322-234550-567 O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB backup-20080322-234550-573 O15 - Trusted Zone: http://www.ni-libraries.net backup-20080322-234553-839 O16 - DPF: {5BDDFD2D-49C7-4FE3-94DD-5077CA9EC361} (PCName Control) - http://opac.ni-libraries.net/vps2.6/header/pcname.cab backup-20080322-234554-829 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe backup-20080322-234641-632 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\xuqpnpkj.dll",s backup-20080323-121720-677 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\xuqpnpkj.dll",s backup-20080323-235550-148 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\lnebubbo.dll",s backup-20080323-235550-878 O4 - HKLM\..\Run: [18801b4d] rundll32.exe "C:\WINDOWS\system32\knadptgy.dll",b backup-20080325-172541-247 O2 - BHO: (no name) - {5D8C31EC-6FB6-4218-93BE-B05BC39271A3} - (no file) backup-20080325-172541-570 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) backup-20080325-172541-790 O2 - BHO: (no name) - {6F4D9FE4-5098-46F2-840A-5A741BC60EA4} - (no file) backup-20080325-172541-965 O2 - BHO: (no name) - {baaeb99f-46cc-4a7e-b2f5-7047a14496d0} - (no file) backup-20080325-211522-996 O4 - HKLM\..\Run: [BM1bb328d1] Rundll32.exe "C:\WINDOWS\system32\lnebubbo.dll",s -- File Associations ----------------------------------------------------------- .js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe,2 .js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1" .reg - regfile - shell\open\command - regedit.exe"%1" %* .scr - scrfile - shell\open\command - "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 GS30d - c:\windows\system32\drivers\gs30d.sys R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.9) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9> R2 ousbehci (%OWC_USBEHCD.DeviceDesc%) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver> R3 ousb2hub (OrangeWare USB 2.0 Root Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver> R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> S0 ElbyVCD - c:\windows\system32\drivers\elbyvcd.sys (file missing) S3 DNINDIS5 (DNINDIS5 NDIS Protocol Driver) - c:\program files\belkin\belkin 802.11g wireless pci card configuration utility\dnindis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 GS30s - gs30s.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-03-26 20:31:16 418 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{E40E5818-8915-48C6-9C3D-FEF75462E5F3}.job 2008-03-26 16:00:00 390 --ah----- C:\WINDOWS\Tasks\{6432DEDB-2D91-45EF-B96F-A5E7ADC27416}_FAMILYPC_Mum.job 2008-03-21 22:04:00 526 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mum.job 2008-03-21 17:21:16 386 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job 2008-03-20 16:15:06 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-03-13 09:00:01 390 --ah----- C:\WINDOWS\Tasks\{3BDFA095-FAFA-44C3-B579-CCDFAA8C3E2C}_FAMILYPC_Mum.job 2008-03-07 23:08:50 390 --ah----- C:\WINDOWS\Tasks\{2421ACDB-E6ED-4D7D-AECF-CD6093BB0D6D}_FAMILYPC_Mum.job -- Files created between 2008-02-27 and 2008-03-27 ----------------------------- 2008-03-25 18:03:27 0 d-------- C:\kav 2008-03-24 13:13:06 0 dr-h----- C:\Documents and Settings\Mum\Recent 2008-03-24 12:52:31 0 d-------- C:\VundoFix Backups 2008-03-23 23:11:11 90176 -----n--- C:\WINDOWS\system32\knadptgy.dll 2008-03-23 18:49:24 0 d-------- C:\ie-spyad_zo 2008-03-23 17:55:35 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-23 17:54:43 0 d-------- C:\Program Files\SpywareBlaster 2008-03-23 12:40:18 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-03-23 00:12:59 0 d-------- C:\Documents and Settings\Mum\Application Data\Malwarebytes 2008-03-23 00:12:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-03-23 00:12:38 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-22 23:07:30 92224 --a------ C:\WINDOWS\system32\xuqpnpkj.dll 2008-03-22 16:29:32 0 d-------- C:\Program Files\Error Nuker 2008-03-21 23:25:10 255115 --ahs---- C:\WINDOWS\system32\jjkkj.ini2 2008-03-20 23:18:44 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-20 23:18:18 0 d-------- C:\Program Files\Windows Live 2008-03-20 23:17:56 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-20 17:26:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-20 12:30:45 0 d-------- C:\Documents and Settings\Mum\Application Data\Grisoft 2008-03-20 12:29:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-19 15:53:33 263592 --ahs---- C:\WINDOWS\system32\xycdd.ini2 2008-03-13 22:49:01 0 d-------- C:\Documents and Settings\Mum\Application Data\LimeWire 2008-03-13 21:16:22 0 d-------- C:\Program Files\CCleaner 2008-03-13 21:08:52 0 d-------- C:\Program Files\Sun 2008-03-13 20:57:30 0 d-------- C:\Program Files\Common Files\Java 2008-03-13 19:35:42 4717 --ahs---- C:\WINDOWS\system32\rrutv.ini2 2008-03-13 12:49:18 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-03-13 12:48:57 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-03-13 12:48:56 0 d-------- C:\Documents and Settings\Mum\Application Data\SUPERAntiSpyware.com 2008-03-13 09:04:59 0 d-------- C:\Program Files\Trend Micro 2008-03-12 22:28:36 1154 --ahs---- C:\WINDOWS\system32\vyadd.ini2 2008-03-12 15:30:50 237 --a------ C:\355.bat 2008-03-12 15:30:41 36864 -----n--- C:\WINDOWS\system32\efcdabx.dll 2008-03-11 15:16:30 147456 --a------ C:\WINDOWS\system32\vbzip10.dll <Not Verified; Info-ZIP; Info-ZIP's WiZ> 2008-03-04 00:43:19 0 d-------- C:\Program Files\Common Files\L&H 2008-03-04 00:42:11 0 d-------- C:\Program Files\Microsoft Works 2008-03-04 00:08:41 0 dr-h----- C:\MSOCache -- Find3M Report --------------------------------------------------------------- 2008-03-25 22:40:40 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-03-23 14:14:30 0 d-------- C:\Program Files\Symantec 2008-03-23 14:04:25 0 d-------- C:\Program Files\Messenger 2008-03-23 13:11:46 0 d-------- C:\Documents and Settings\Mum\Application Data\Symantec 2008-03-20 23:18:44 0 d-------- C:\Program Files\Common Files 2008-03-20 23:02:07 0 d-------- C:\Documents and Settings\Mum\Application Data\MSN6 2008-03-19 23:53:10 0 d-------- C:\Program Files\Sibelius Software 2008-03-13 21:08:36 0 d-------- C:\Program Files\Java 2008-03-13 12:47:53 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-11 23:25:58 0 d-------- C:\Program Files\Lavasoft 2008-03-11 23:25:56 0 d-------- C:\Documents and Settings\Mum\Application Data\Lavasoft 2008-03-11 19:14:06 0 d-------- C:\Program Files\TuneUp Utilities 2007 2008-03-04 14:49:36 0 d-------- C:\Program Files\Snapshot Viewer 2008-03-04 00:43:52 0 d-------- C:\Program Files\Microsoft ActiveSync 2008-02-25 14:13:58 0 d-------- C:\Program Files\Common Files\Adobe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}] 16/12/2007 03:52 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [16/12/2007 03:52 262144] [-HKEY_CLASSES_ROOT\CLSID\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [11/02/2008 17:22] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 09:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 07:56] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [29/02/2008 16:03] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process] C:\WINDOWS\Fonts\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] AutoRun\command- C:\OpenHtm.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\setup.EXE /AUTORUN configure\command- E:\setup.EXE install\command- E:\setup.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7eb99ec-af51-11d9-9e57-00095be3915b}] AutoRun\command- F:\GizmoSecure\Windows\GizmoSecure30.exe -- End of Deckard's System Scanner: finished at 2008-03-27 08:37:11 ------------ |
|
|
|
|
03-27-2008, 08:32 AM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Please do no more self-fixing while we're working together, as it may work counter to what I have planned.
The items Panda lists as Registry are orphaned traces, and not a major concern. Other scanners such as the ones you've already run (AVG AS, SAS, MBAM) can find these. As far as a slow machine goes, we'll look into that later. It could be that having SUPERAntiSpyware and AVG AntiSpyware running at startup along with Norton is too much. I see you've also used Error Nuker. Registry Cleaners sometimes cause more trouble than good. I see some signs of infection which have me wanting to run a dedicated tool. First..... Run DSS again, using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /daft Click on Scan. Tick the boxes which should appear for these entries: .reg - regfile - shell\open\command - regedit.exe"%1" %* .scr - scrfile - shell\open\command - "%1" %* then Click on Fix Click Scan again, you should get a message "All Associations OK!" Next, click Save Log, and post this log in your next reply. ------------------------------------------------------------------ Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 08:43 AM
|
#5 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
Is this what you need, or do I do the whole scan like earlier?
DAFT Log saved on 2008-03-27 14:42:44 ----------------------------------------------------------------------- .js - JSFile - DefaultIcon - C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe,2 .js - JSFile - shell\open\command - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1" |
|
|
|
|
03-27-2008, 08:49 AM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
That part is fine, but I assumed you would continue with the ComboFix instructions, and post all logs together.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 09:11 AM
|
#8 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:09:45, on 27/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\GS30s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:80 O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/tech...l/SymAData.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1128463012750 O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/sof...iveXPlugin.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GS30s - Unknown owner - C:\WINDOWS\SYSTEM32\GS30s.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9537 bytes |
|
|
|
|
03-27-2008, 09:33 AM
|
#9 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Hi, you've installed the Recovery Console, that's great....however in the User's Guide, read on...from here
Quote:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
03-27-2008, 10:05 AM
|
#10 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
ComboFix 08-03-26.1 - Mum 2008-03-27 15:40:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1047 [GMT 0:00] Running from: C:\Documents and Settings\Mum\Desktop\ComboFix.exe . ADS - svchost.exe: deleted 88 bytes in 2 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\Temp\sanR24 C:\WINDOWS\BM1bb328d1.xml C:\WINDOWS\bobsaver.exe C:\WINDOWS\bobsaver.scr C:\WINDOWS\pskt.ini C:\WINDOWS\system32\efcdabx.dll C:\WINDOWS\system32\jjkkj.ini2 C:\WINDOWS\system32\knadptgy.dll C:\WINDOWS\system32\rrutv.ini C:\WINDOWS\system32\rrutv.ini2 C:\WINDOWS\system32\vyadd.ini C:\WINDOWS\system32\vyadd.ini2 C:\WINDOWS\system32\xuqpnpkj.dll C:\WINDOWS\system32\xycdd.ini2 C:\z.txt . ((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 ))))))))))))))))))))))))))))))) . 2008-03-27 08:31 . 2008-03-27 08:31 <DIR> d-------- C:\Deckard 2008-03-25 18:03 . 2008-03-25 18:03 <DIR> d-------- C:\kav 2008-03-24 12:52 . 2008-03-24 12:52 <DIR> d-------- C:\VundoFix Backups 2008-03-23 18:49 . 2008-03-23 18:49 <DIR> d-------- C:\ie-spyad_zo 2008-03-23 17:55 . 2008-03-25 11:23 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-23 17:54 . 2008-03-25 11:22 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-23 12:40 . 2008-03-23 14:38 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-23 12:40 . 2008-03-23 12:40 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-23 12:40 . 2008-03-23 12:40 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\Malwarebytes 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-03-22 16:29 . 2008-03-22 16:29 <DIR> d-------- C:\Program Files\Error Nuker 2008-03-21 23:31 . 2008-03-21 23:31 294 ---hs---- C:\WINDOWS\system32\kehtcstn.ini 2008-03-21 11:45 . 2008-03-21 12:40 414 ---hs---- C:\WINDOWS\system32\ifxufiep.ini 2008-03-21 11:26 . 2008-03-21 11:26 294 ---hs---- C:\WINDOWS\system32\smyegvbi.ini 2008-03-20 23:18 . 2008-03-20 23:24 <DIR> d-------- C:\Program Files\Windows Live 2008-03-20 23:18 . 2008-03-20 23:23 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-20 23:17 . 2008-03-20 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-20 19:07 . 2008-03-20 19:10 172 --a------ C:\WINDOWS\wininit.ini 2008-03-20 17:26 . 2008-03-22 23:09 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-03-20 17:26 . 2008-03-24 12:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-20 17:08 . 2008-03-20 23:48 826 ---hs---- C:\WINDOWS\system32\sqfjjhur.ini 2008-03-20 12:30 . 2008-03-20 12:30 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\Grisoft 2008-03-20 12:30 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-20 12:29 . 2008-03-20 12:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-20 11:46 . 2008-03-20 17:08 534 ---hs---- C:\WINDOWS\system32\anmvdpnt.ini 2008-03-19 16:28 . 2008-03-20 11:38 414 ---hs---- C:\WINDOWS\system32\jgjcccgi.ini 2008-03-13 22:49 . 2008-03-18 18:46 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\LimeWire 2008-03-13 21:16 . 2008-03-13 21:16 <DIR> d-------- C:\Program Files\CCleaner 2008-03-13 21:08 . 2008-03-13 21:08 <DIR> d-------- C:\Program Files\Sun 2008-03-13 21:08 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-13 20:57 . 2008-03-13 20:57 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-13 12:49 . 2008-03-13 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-03-13 12:48 . 2008-03-23 14:14 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-03-13 12:48 . 2008-03-13 12:48 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\SUPERAntiSpyware.com 2008-03-13 09:04 . 2008-03-13 09:04 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-12 15:30 . 2008-03-12 15:30 237 --a------ C:\355.bat 2008-03-12 15:08 . 2008-03-12 15:08 244 --ah----- C:\sqmnoopt13.sqm 2008-03-12 15:08 . 2008-03-12 15:08 232 --ah----- C:\sqmdata13.sqm 2008-03-11 15:16 . 2008-03-11 15:16 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-03-04 00:43 . 2008-03-04 00:43 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-03-04 00:42 . 2008-03-04 00:42 <DIR> d-------- C:\Program Files\Microsoft Works 2008-03-04 00:08 . 2008-03-04 00:08 <DIR> dr-h----- C:\MSOCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-25 22:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-23 14:14 --------- d-----w C:\Program Files\Symantec 2008-03-23 13:11 --------- d-----w C:\Documents and Settings\Mum\Application Data\Symantec 2008-03-23 13:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-03-23 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-03-20 23:02 --------- d-----w C:\Documents and Settings\Mum\Application Data\MSN6 2008-03-19 23:53 --------- d-----w C:\Program Files\Sibelius Software 2008-03-13 21:08 --------- d-----w C:\Program Files\Java 2008-03-13 12:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-03-11 23:25 --------- d-----w C:\Program Files\Lavasoft 2008-03-11 23:25 --------- d-----w C:\Documents and Settings\Mum\Application Data\Lavasoft 2008-03-11 19:14 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2008-03-04 14:49 --------- d-----w C:\Program Files\Snapshot Viewer 2008-03-04 00:43 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-02-25 14:13 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-08-13 22:18 3,593,404 ----a-w C:\Program Files\chrosary.mp3 2007-08-04 10:29 18,176,512 ----a-w C:\Program Files\aaw2007.exe 2006-09-02 21:00 1,875,544 -c--a-w C:\Program Files\BELKIN_RT_54G_UK_4.05.03.bin 2005-04-16 19:54 2,678,725 ----a-w C:\Program Files\WinZip 9.0 + WinZip Self-Extractor + Serial [FULL](By Black Knight).zip 2002-03-29 02:00 9,350 -c--a-w C:\Program Files\SETUP.LST 2002-03-29 01:49 74 -c--a-w C:\Program Files\NBORN.BM_ 2002-03-29 01:48 84 -c--a-w C:\Program Files\OCREATE.BM_ 2002-03-29 00:37 1,457,472 -c--a-w C:\Program Files\BIBLEA.EX_ 2002-03-29 00:34 3,147 -c--a-w C:\Program Files\README.TXT 2002-03-29 00:34 2,084 -c--a-w C:\Program Files\README.TX_ 2002-03-06 11:39 1,953,601 -c--a-w C:\Program Files\DVD Wizard Pro.exe 1996-10-30 23:00 10,146 -c--a-w C:\Program Files\ComCat.dl_ 1996-08-20 23:00 15,600 -c--a-w C:\Program Files\Ctl3d32.dl_ 1996-07-30 23:00 540,268 -c--a-w C:\Program Files\MFC40.dl_ 1996-07-30 23:00 183,001 -c--a-w C:\Program Files\MSVCRT40.dl_ 1996-01-11 23:00 98,555 -c--a-w C:\Program Files\THREED32.OC_ . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}] 2007-12-16 03:52 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2007-12-16 03:52 262144] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-16 03:52 262144] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56 15360] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 17:22 53096] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 07:56 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2003-04-22 22:43 413775 C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process] C:\WINDOWS\Fonts\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-12-11 12:10 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\QTTask.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\kav\\kis7.0\\english\\setup.exe"= R2 GS30d;GS30d;C:\WINDOWS\system32\Drivers\GS30d.sys [2006-04-04 19:41] R2 ousbehci;%OWC_USBEHCD.DeviceDesc%;C:\WINDOWS\system32\Drivers\ousbehci.sys [2002-01-31 23:39] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-03-12 09:47] R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 12:12] R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2002-01-31 23:39] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\PROGRA~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS [2003-07-24 11:10] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\OpenHtm.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\setup.EXE /AUTORUN \Shell\configure\command - E:\setup.EXE \Shell\install\command - E:\setup.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7eb99ec-af51-11d9-9e57-00095be3915b}] \Shell\AutoRun\command - F:\GizmoSecure\Windows\GizmoSecure30.exe . Contents of the 'Scheduled Tasks' folder "2008-03-21 17:21:16 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-03-20 16:15:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-21 22:04:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mum.job" - C:\PROGRA~1\NORTON~2\Navw32.exe "2008-03-27 11:31:21 C:\WINDOWS\Tasks\User_Feed_Synchronization-{E40E5818-8915-48C6-9C3D-FEF75462E5F3}.job" - C:\WINDOWS\system32\msfeedssync.exe "2008-03-07 23:08:50 C:\WINDOWS\Tasks\{2421ACDB-E6ED-4D7D-AECF-CD6093BB0D6D}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exe "2008-03-27 09:00:01 C:\WINDOWS\Tasks\{3BDFA095-FAFA-44C3-B579-CCDFAA8C3E2C}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exe "2008-03-26 16:00:00 C:\WINDOWS\Tasks\{6432DEDB-2D91-45EF-B96F-A5E7ADC27416}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-27 15:46:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\GS30s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Messenger\msmsgs.exe . ************************************************************************** . Completion time: 2008-03-27 15:50:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-27 15:50:52 Pre-Run: 100,848,926,720 bytes free Post-Run: 100,762,136,576 bytes free . 2008-03-12 10:02:34 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:05:30, on 27/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\GS30s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Symantec\LiveUpdate\AUpdate.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:80 O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/tech...l/SymAData.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1128463012750 O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/sof...iveXPlugin.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GS30s - Unknown owner - C:\WINDOWS\SYSTEM32\GS30s.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9504 bytes |
|
|
|
|
03-27-2008, 10:21 AM
|
#11 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
One or more of the identified infections steal information. That includes all passwords, log ins to forums and your email details & other websites and most of all your Bank, Credit card or Paypal details. If this system is used for web based email, online banking or has credit card information on it, all passwords should be changed immediately by using a different computer (not the infected one!) to make the changes. Banking and credit card institutions, if any, should be notified of the possible security breech. It also seems to be able to steal all your emails so anything you have emailed to anybody is no longer confidential.
I suggest that you read this article too. --------------------------------------------------------------------------------------------- Please go to Start > Run and copy/paste the following, then press Enter: notepad C:\355.bat A text file will open. Please post the contents of the file, and then close it. I will have more instructions for you after that.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 10:23 AM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
In addition to my previous post, please do this:
Please go to: VirusTotal
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 10:41 AM
|
#13 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
@Echo off
:A Del C:\services.exe If Exist C:\services.exe Goto A :B Del C:\lx.exe If Exist C:\lx.exe Goto B :C Del C:\smss.exe If Exist C:\smss.exe Goto C :D Del C:\svchost.exe If Exist C:\svchost.exe Goto D Del C:\355.bat File OpenHtm.exe received on 03.27.2008 17:31:47 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) Loading server information... Your file is queued in position: 12. Estimated start time is between 77 and 110 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.3.26.0 2008.03.27 - AntiVir 7.6.0.75 2008.03.27 - Authentium 4.93.8 2008.03.27 - Avast 4.7.1098.0 2008.03.27 - AVG 7.5.0.516 2008.03.27 - BitDefender 7.2 2008.03.27 - CAT-QuickHeal 9.50 2008.03.26 - ClamAV 0.92.1 2008.03.27 - DrWeb 4.44.0.09170 2008.03.27 - eSafe 7.0.15.0 2008.03.18 - eTrust-Vet 31.3.5648 2008.03.27 - Ewido 4.0 2008.03.27 - F-Prot 4.4.2.54 2008.03.27 - F-Secure 6.70.13260.0 2008.03.27 - FileAdvisor 1 2008.03.27 - Fortinet 3.14.0.0 2008.03.27 - Ikarus T3.1.1.20 2008.03.27 - Kaspersky 7.0.0.125 2008.03.27 - McAfee 5260 2008.03.26 - Microsoft 1.3301 2008.03.27 - NOD32v2 2978 2008.03.27 - Norman 5.80.02 2008.03.26 - Panda 9.0.0.4 2008.03.26 - Prevx1 V2 2008.03.27 - Rising 20.37.32.00 2008.03.27 - Sophos 4.27.0 2008.03.27 - Sunbelt 3.0.978.0 2008.03.18 - Symantec 10 2008.03.27 - TheHacker 6.2.92.256 2008.03.27 - VBA32 3.12.6.3 2008.03.25 - VirusBuster 4.3.26:9 2008.03.27 - Webwasher-Gateway 6.6.2 2008.03.27 - Additional information File size: 40960 bytes MD5: f91814745dd5ad67c16594cbbcefd8cf SHA1: c631d44a60801c2ec7249c48b9ce053f6eac7206 PEiD: - |
|
|
|
|
03-27-2008, 11:03 AM
|
#14 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Open notepad and copy/paste the text in the quotebox below into it:
Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
03-27-2008, 11:22 AM
|
#15 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
Malware Submission
Your file was successfully submitted. Please let the user helping you know that you have submitted the file ComboFix 08-03-26.1 - Mum 2008-03-27 17:07:52.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1089 [GMT 0:00] Running from: C:\Documents and Settings\Mum\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mum\Desktop\CFScript.txt * Created a new restore point FILE :: C:\355.bat C:\WINDOWS\system32\anmvdpnt.ini C:\WINDOWS\system32\ifxufiep.ini C:\WINDOWS\system32\jgjcccgi.ini C:\WINDOWS\system32\kehtcstn.ini C:\WINDOWS\system32\smyegvbi.ini C:\WINDOWS\system32\sqfjjhur.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\355.bat C:\WINDOWS\system32\anmvdpnt.ini C:\WINDOWS\system32\ifxufiep.ini C:\WINDOWS\system32\jgjcccgi.ini C:\WINDOWS\system32\kehtcstn.ini C:\WINDOWS\system32\smyegvbi.ini C:\WINDOWS\system32\sqfjjhur.ini . ((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 ))))))))))))))))))))))))))))))) . 2008-03-27 08:31 . 2008-03-27 08:31 <DIR> d-------- C:\Deckard 2008-03-25 18:03 . 2008-03-25 18:03 <DIR> d-------- C:\kav 2008-03-24 12:52 . 2008-03-24 12:52 <DIR> d-------- C:\VundoFix Backups 2008-03-23 18:49 . 2008-03-23 18:49 <DIR> d-------- C:\ie-spyad_zo 2008-03-23 17:55 . 2008-03-25 11:23 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-23 17:54 . 2008-03-25 11:22 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-23 12:40 . 2008-03-23 14:38 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-23 12:40 . 2008-03-23 12:40 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-23 12:40 . 2008-03-23 12:40 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\Malwarebytes 2008-03-23 00:12 . 2008-03-23 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-03-22 16:29 . 2008-03-22 16:29 <DIR> d-------- C:\Program Files\Error Nuker 2008-03-20 23:18 . 2008-03-20 23:24 <DIR> d-------- C:\Program Files\Windows Live 2008-03-20 23:18 . 2008-03-20 23:23 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-20 23:17 . 2008-03-20 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-20 19:07 . 2008-03-20 19:10 172 --a------ C:\WINDOWS\wininit.ini 2008-03-20 17:26 . 2008-03-22 23:09 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-03-20 17:26 . 2008-03-24 12:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-20 12:30 . 2008-03-20 12:30 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\Grisoft 2008-03-20 12:30 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-20 12:29 . 2008-03-20 12:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-13 22:49 . 2008-03-18 18:46 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\LimeWire 2008-03-13 21:16 . 2008-03-13 21:16 <DIR> d-------- C:\Program Files\CCleaner 2008-03-13 21:08 . 2008-03-13 21:08 <DIR> d-------- C:\Program Files\Sun 2008-03-13 21:08 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-13 20:57 . 2008-03-13 20:57 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-13 12:49 . 2008-03-13 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-03-13 12:48 . 2008-03-23 14:14 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-03-13 12:48 . 2008-03-13 12:48 <DIR> d-------- C:\Documents and Settings\Mum\Application Data\SUPERAntiSpyware.com 2008-03-13 09:04 . 2008-03-13 09:04 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-12 15:08 . 2008-03-12 15:08 244 --ah----- C:\sqmnoopt13.sqm 2008-03-12 15:08 . 2008-03-12 15:08 232 --ah----- C:\sqmdata13.sqm 2008-03-11 15:16 . 2008-03-11 15:16 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-03-04 00:43 . 2008-03-04 00:43 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-03-04 00:42 . 2008-03-04 00:42 <DIR> d-------- C:\Program Files\Microsoft Works 2008-03-04 00:08 . 2008-03-04 00:08 <DIR> dr-h----- C:\MSOCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-25 22:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-23 14:14 --------- d-----w C:\Program Files\Symantec 2008-03-23 13:11 --------- d-----w C:\Documents and Settings\Mum\Application Data\Symantec 2008-03-23 13:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-03-23 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-03-20 23:02 --------- d-----w C:\Documents and Settings\Mum\Application Data\MSN6 2008-03-19 23:53 --------- d-----w C:\Program Files\Sibelius Software 2008-03-13 21:08 --------- d-----w C:\Program Files\Java 2008-03-13 12:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-03-12 09:47 14,336 ----a-w C:\WINDOWS\system32\svchost.exe 2008-03-11 23:25 --------- d-----w C:\Program Files\Lavasoft 2008-03-11 23:25 --------- d-----w C:\Documents and Settings\Mum\Application Data\Lavasoft 2008-03-11 19:14 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2008-03-04 14:49 --------- d-----w C:\Program Files\Snapshot Viewer 2008-03-04 00:43 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-02-25 14:13 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-23 12:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-08-13 22:18 3,593,404 ----a-w C:\Program Files\chrosary.mp3 2007-08-04 10:29 18,176,512 ----a-w C:\Program Files\aaw2007.exe 2006-09-02 21:00 1,875,544 -c--a-w C:\Program Files\BELKIN_RT_54G_UK_4.05.03.bin 2005-05-25 06:21 10,607,731 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2005_05_25_00_00_57.dmp.zip 2005-04-16 19:54 2,678,725 ----a-w C:\Program Files\WinZip 9.0 + WinZip Self-Extractor + Serial [FULL](By Black Knight).zip 2002-03-29 02:00 9,350 -c--a-w C:\Program Files\SETUP.LST 2002-03-29 01:49 74 -c--a-w C:\Program Files\NBORN.BM_ 2002-03-29 01:48 84 -c--a-w C:\Program Files\OCREATE.BM_ 2002-03-29 00:37 1,457,472 -c--a-w C:\Program Files\BIBLEA.EX_ 2002-03-29 00:34 3,147 -c--a-w C:\Program Files\README.TXT 2002-03-29 00:34 2,084 -c--a-w C:\Program Files\README.TX_ 2002-03-06 11:39 1,953,601 -c--a-w C:\Program Files\DVD Wizard Pro.exe 1996-10-30 23:00 10,146 -c--a-w C:\Program Files\ComCat.dl_ 1996-08-20 23:00 15,600 -c--a-w C:\Program Files\Ctl3d32.dl_ 1996-07-30 23:00 540,268 -c--a-w C:\Program Files\MFC40.dl_ 1996-07-30 23:00 183,001 -c--a-w C:\Program Files\MSVCRT40.dl_ 1996-01-11 23:00 98,555 -c--a-w C:\Program Files\THREED32.OC_ . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}] 2007-12-16 03:52 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2007-12-16 03:52 262144] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-16 03:52 262144] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56 15360] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 17:22 53096] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 07:56 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2003-04-22 22:43 413775 C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-12-11 12:10 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\QTTask.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\kav\\kis7.0\\english\\setup.exe"= R2 GS30d;GS30d;C:\WINDOWS\system32\Drivers\GS30d.sys [2006-04-04 19:41] R2 ousbehci;%OWC_USBEHCD.DeviceDesc%;C:\WINDOWS\system32\Drivers\ousbehci.sys [2002-01-31 23:39] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-03-12 09:47] R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 12:12] R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2002-01-31 23:39] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\PROGRA~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS [2003-07-24 11:10] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\setup.EXE /AUTORUN \Shell\configure\command - E:\setup.EXE \Shell\install\command - E:\setup.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7eb99ec-af51-11d9-9e57-00095be3915b}] \Shell\AutoRun\command - F:\GizmoSecure\Windows\GizmoSecure30.exe *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-03-21 17:21:16 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-03-27 16:15:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-21 22:04:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mum.job" - C:\PROGRA~1\NORTON~2\Navw32.exeh/TASK: "2008-03-27 11:31:21 C:\WINDOWS\Tasks\User_Feed_Synchronization-{E40E5818-8915-48C6-9C3D-FEF75462E5F3}.job" - C:\WINDOWS\system32\msfeedssync.exe "2008-03-07 23:08:50 C:\WINDOWS\Tasks\{2421ACDB-E6ED-4D7D-AECF-CD6093BB0D6D}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exeA /Schedule= "2008-03-27 09:00:01 C:\WINDOWS\Tasks\{3BDFA095-FAFA-44C3-B579-CCDFAA8C3E2C}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exeA /Schedule= "2008-03-27 16:00:05 C:\WINDOWS\Tasks\{6432DEDB-2D91-45EF-B96F-A5E7ADC27416}_FAMILYPC_Mum.job" - C:\WINDOWS\system32\mobsync.exeA /Schedule= . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-27 17:11:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-27 17:13:00 ComboFix-quarantined-files.txt 2008-03-27 17:12:43 ComboFix2.txt 2008-03-27 15:51:00 Pre-Run: 101,120,409,600 bytes free Post-Run: 101,106,143,232 bytes free . 2008-03-12 10:02:34 --- E O F --- |
|
|
|
|
03-27-2008, 11:30 AM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Thanks for uploading the file. You can delete the zip file from your desktop.
While the file is being analyzed, please do this: Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Let me know how the machine is behaving.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 02:35 PM
|
#17 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT Thursday, March 27, 2008 8:35:16 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 27/03/2008 Kaspersky Anti-Virus database records: 667341 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 93746 Number of viruses found: 22 Number of infected objects: 88 Number of suspicious objects: 0 Duration of the scan process: 02:18:18 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\MailFrontier\reginfo.xml Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0174a0bf112375fe78c0fed4224c8f80_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\01bc6dadac77e09f11d109ef0da8f89e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\048d3b0687150ceb91fbda68addab849_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\04fc2ff6f339c957234e688dd5303df6_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\057a602b915f4f90c4bb8c0c3a4d712b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\06c88d851803c61769456438bd952255_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0873fcbcba5f2e2027a0b7ed0f140835_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\08c58964a637366b018cc6323478fcfe_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0d03aea3bba54bda264c3a7b8f32746d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0e966fcc926baac36e835ec08fb28eab_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0f8a7bb0ae3605159c5a3ecc46c8fcf0_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0fcebd7565fb6d3e2b0b22092436ffe1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0fd8fc9f8f28b8bd4eff6d4e40a6af61_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\103c4faef1470187a0f0b7dcde22db15_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1050e3bfdcc0970dbadc5caf18c2db9e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12e51f519ac287734eca34dab6a3b298_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12fa814b9b2711586a93c2ebc80d7e7f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1439ecf93aa9496e41c4eef457eac4f8_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\183888ea7c03fa662bf349794954ce4e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1a802bc2069a2c93d4685462981b9108_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1b108b4cd698903ce645acd1f66fdab1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1bcc005c26e095803b31a15723ae4664_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1ccd147d88b04a8450bffcb99f3ee668_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1ce754504a8f7fb258961f2d8118c90f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1e8c84632f093a1f1d396b36a322d01d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1f9767d76122f2b85a6185743edb165a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\213cb954bdf6df5ccefa6aa0347644c8_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2264e6e8680c837281437b6957e321b9_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\27768ff3ed1f86cbd4d5c9299c5f93ba_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2960d3bea54bc0dfccae67b2e087448e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2c716e28bd00a45d0e9cc21757fe269b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2c9a9678e035596d00a2ed938e7c47d9_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2f95598b61b2f80f3c8ed36887aac5be_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\304b12803e7ca5e5accf5e69d7ac0c5a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3083cc9f29008d49d7d5f56d61ac7fdd_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3134cbd9c62a126d10568d42a7c2d3a6_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\31fa68c2e2b3b4e0a9bff164366b9f75_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\343c667d0475d2e4b910726eb53fce73_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\344bb1a466ac3357249ebdffd433bb6c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3789a6e5228217226bd18a0973e0af1c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\391b8f8ff7156b1e43cae7a5694d458b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\398c7fa87f34e537e6a53e4df96ae2a0_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\39d1769ceb5d048882e4652fd122dd6f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3c81d2404f3b309b157442df8f089f7c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3fdd2f4d9e443408e88377c3a90b8cd2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\41321047d3496712e98562d5a05e01d4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\41e8c31b9c7b94320b36ebc33becac95_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\41ecdb9781137abf52bbcf1f103c1b43_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4751147a0f25a36b9cdfd00e94024bd5_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\47dcf1fe9274393af677323ebd53742c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4881b6c9bcd285466da4a4787f533d54_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\48ae5687720e49fa952fba96ab269b8e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4a57d91dde278581545a70f77b1fa705_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4a59a843b148d81e2dc76c99af31f75c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4aba79828ad48dc2e7effa067f58c23d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4ada9fae9f5501484722858454297f1f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4b553b1c1591f084a9144763982f40cd_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4bb8c6ef62ba28bf4bd242b672d5c9fd_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4c4d0f3bd75449c620ab31c91a820c73_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4dbda9d1c9de60d914c45732a97d4929_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4dc1dc0d4fdd57d53d063bd09ebbff00_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4dc469fc2884714f612e9c2c2405bb0c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4f31ddb35a5a11d7f31d0a8fc975f546_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\50746c1c017642c13277846da24bb8a1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5094522c0cb03d9450798acdf138bb7d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5098ccb9beb98756ea09e2c5dfe2a923_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\51319a7ddad6be1f54319da5b9b091da_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5153738800eed16e54ac2c789b80e94a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\540e90d2711d5b25a4fc537c38f42fa1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\552f5c6ebb2de7fdeb7537829c7ad437_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5540a01bfb90746095867420dce92335_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\560ef637daee8a5da0a8294ca89f5a92_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\564434f5d7a32268bd9f0a2dfaf21ce3_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5a1202269690c55c430fc0f1f63a2fb4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5ac45f208e47e93cba4f3bc955ea6f3d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c69107c01acd14b812502276ede8b01_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d6483d11ad96e67110172b74f61bdf7_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fe95d81c13a6b881b17105b58a829e5_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\605053ccac8ac9dbfdbc9732534d64d2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\60dabfeaee0e481f936690f7bab3eb76_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\623723c6daa3cad54e75a990e4ce5ec1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\63523738af32e5175489ae6e6e7d3265_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\636b0b7bcfb69aea081f29e7b5f3fdee_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\65796cac006f10968eaa0a7337a8ef5b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\661c51c7a1576fff2962cb6ff427e414_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\694ab716bc74e41a98526958e39574d6_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b0aaa7b3418162b1720e0ab74445836_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6d62c15330dca64414acf295e3fb674f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6d844a9e558b7ca5d450f266a4f94514_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\704a50798b349316e2393ac192d634d1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\75835da45b5c5120dd412ef8ce81e4a0_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\75f9165c0112e13660c1b5567d83d6f2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\762a15b1224887b9c29c9e47cb3f0dcd_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7766ab5a072629d6e424aee8aefa6e1c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\785b3f91b1d93854bc11e357ab78dd8b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7cee1d63d80ac4b6ee7590a2596a53e1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7d966382791b527dd460ea4826973447_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7e04ae4d15c145b120a1d942d2b53b76_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7e38034d0da498a15f815f2dca9bc7cd_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7ea808c075ec9cd6f8caf63cb1b08cb4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7fb5b7ad1206b52dc4a727a6b5718ff1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\81080120cf0b4170744c9db71b6b7949_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\84308f9534c863da0d393f292156bd3e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8465c22be8e6e91a30e496adb0994b2b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\85b685198f1dc747621a7e52fb59ba04_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8833ca38a0f33f3e0a659fe2d7f496ac_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8a897df19306d93260c6256d01e512df_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8cb1a3a89a890ba71ee14e5623da82ce_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d157e2c4dab293b143bee3b1ac16eaf_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d595888f2349174e9391aba1f3c6e3a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\913f0018043ddfb47c7ab5e65582165b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\916b406de315c811291d123e30c79678_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\925f39da9b855a338b6b574d1d6d8741_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9345c970c074af0101924f011e5814c2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9382bdc4def7151af12402c6412dbc74_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9430b134bc5d4e58f8d91ccefabc4290_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\955e7d92786cb8d55fc223c1c759de9e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95834c2a936a6d908cae36dd62a900e3_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\979a2bb33baed736d02723593d2d1a69_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\98382e3f2943179dc058d738759d0082_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\994146d3ff954c6e5d0dde212738bece_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9b12f2a9d1c213f03568197b6bc42379_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9b8196de1a5e3eaf98c3ea34750278ee_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9c822c284b5aeeb4782436ad49932591_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9c902c8a49c8eb142a6a41ca450c312e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9c96ac25bc45e5a46629f7462300852b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a04177f43445485985748db6c7ac3c2e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a1829593eb902f8bc003bc1e71894607_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a206673334bb1fe876df8f36993476f2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a348dbc8a881c33951774e1655fe6b4b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a3e56196bae36b98b03acbb91f676aa1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a455dcf25a3c3303fadc997740bfdaca_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a4e160c58b3950fde4b48c68c6386cb3_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a60f881374115a52677fb46cbf1bfccb_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a6102a4d683037c5d8945f22eb32cb1d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a860908265a34ae5368e7f0d26534b28_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a86ac6f4373b198387b0a397833e5fe9_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\abbbf486b36c8d0bf94f726cab191a51_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\abbd21d39734a9868131104db0e502ad_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\abc1e1874925d6969978c8b7f311feac_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\acffb9fae8057a3b4a13148319fa8142_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\adb60c3548f562f27dd6cccbaf85ae29_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\af5f5acf265f2ad9d06aa8415ccc63ef_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b0279b829bfcf21d27025f2776302e2f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b0a7c05c3439cb239d132d089511779b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b48d4455cd47a504b8311287175f1f44_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b78f44eb25e9dd9e5b7b3c4e559346a4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b86c5b9ff7d56f235c19eb6fa3f9c9c1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b87dec29b0f2eaa8dc62a9a6c9cad207_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b9ea36adabe8c749469a07bdc9bd5c7d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb22cbf78b3f71d6f72193e7c8784bc6_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bce14ea78829706cd9e8f0b5dccc04c9_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bcff5bc6a616f36b6345f542754d2779_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bd046bdf29b391fa1808dd6af84eacf1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bdff5c40a5f7fdd05e5ff154ed4fd58f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\be0e078f66863970b752327b7d136d25_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\be5485d48d6ac0cca8eeaee74ff39ea4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bf431d87430523fdecd4f3aba12db129_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bfa278889dc22ea2decd46bb6891ae7a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c1146302946a3d37fae3c517c7ecc672_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2b3fbae9666d1b7daa7d978c9e865d2_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c506d71b69ef738d0233b67dc9b5cc4a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c565bdfcfe58f99697be5c78f3a0e9cc_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c66ad4552382025cb226f4f5f54bf6cf_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c7a50785d91b4f3693190819ce7348f4_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c9e4d1b64d9c990705b98062664ad1b9_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ca35bd7134c445eecb8f67d04dcdfddb_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ca5b42c1e8ef23e15a6e730dfe73c878_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ca5f047ca350d669debcf6ab472c670e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cae1c38a30f1c080adb1d2e523c107b1_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbce5863eada9bf921c743e51028aac7_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cd124cf1e89f446a559d85a4120a0c50_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cd6edd10a4b66aaafed8248b096125f0_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ce571eeaa8a8aafc92081a16356653c5_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cfbc34802909da766fd98ecb45be91da_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d37a0c7e3937bcc1b72a23e85fa81b7d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d68d36a1d9380c02b595d57f8bceba7d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d6d46815eef4be02410b0dfcc1ad1579_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d6fc496ca7534aa151310b0570d2a7c0_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\da35f93c4d81a206add1d49e67ab928b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\da5681c1ef55a0d91a8519f8e0fdee04_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dac8351faaa449d15a156491cbde6e1a_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\db69c72dfb912c2a2cea6d6bd9cf32cc_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dbb8e1e40e836c77febb0fab0f4f5f7c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dfb51332ace876aaa80c24fe8cbaf54c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e2391952a4e86603e53fd553ad9be472_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e3f9b380d6f40a1421a643500fbadf7f_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e6623f2ea7e7049c6661fa613f8a6d1d_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e79e1fd467c8bae17a8cc28bc14dd4f8_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e7f0e7788021581a682e22f48222b37b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e8458e242e8d203756a537bc519e35cb_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea70ecb4a0821324b7d6484561047cde_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eaad950a6c978dd65f33a5ed621baa2e_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eab33797f4f503db00d93e759ef48882_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec11011be03b1cdac0e538e2eb6bff31_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ecaab416cbce313372930c741241ef21_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f05e1af6bcd49e34dd017b2e511b0881_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f066b8cf241c71829587a5caee59651b_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f338804738bccfd54eb9ed2cec6a5005_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f444e986478ff7d5491730c23b49afdb_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f5fe25ff9f730f93e0be7b76e8f14736_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f6d18cafab84b7467159c5673a335f19_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f7a384e78c8fbf5a039d99485f1207a7_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f879ced24be17131e520679947f6fcae_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f95ad2a7e15a4ef1d585640122e40a6c_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fc2c040f68e35191ff4727f919198995_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fec59414df2e3d82da2887a8d496dfcf_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ff90f4a9c922ddf6175cbaa3bfed9d24_a6806a98-779e-4389-bf93-d3ad91504ba7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-03-27_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\06017B99.tmp Infected: Worm.Win32.VB.an skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0A97270F.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D8E5AAF Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D9F2C9D Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0DA2569A Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0DA50096 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0EE43265.exe Infected: Trojan-Proxy.Win32.Agent.kj skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\111B1721.exe Infected: Trojan.Win32.Agent.cmn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\12427EB0.exe Infected: Trojan-Proxy.Win32.Agent.kj skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\12CB6219.exe Infected: Trojan-Proxy.Win32.Agent.kj skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\16E5176C.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1787636B.exe Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19653CAB.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1972649D.VBS Infected: Email-Worm.VBS.Gedza skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2038707E.exe Infected: Trojan-Downloader.Win32.VB.bsa skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2253466A.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\227A7802.exe Infected: Trojan.Win32.Agent.cmn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23DE587B.exe/td.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23DE587B.exe/run.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23DE587B.exe/zgo.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23DE587B.exe ZIP: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23DE587B.exe CryptFF: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\28E57D81 Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CAE758E.tmp Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2CB87383.tmp Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2D3758F7.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2D5E50CC.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2D6B78BE.tmp Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39C71D06.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39E840E2.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39EB6ADF.tmp Infected: Email-Worm.VBS.Gedza skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D8351BB.exe Infected: Trojan.Win32.Agent.cmn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40F152FF.tmp Infected: Trojan-Downloader.Win32.VB.dck skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\412672C5.exe Infected: Trojan-Downloader.Win32.VB.dck skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47A00C81.DLL Infected: not-a-virus:AdWare.Win32.Agent.asj skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47AA0A76.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\55CB0FDD Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59D26C61.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A903FA6.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E3627A2.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69E17323.htm Infected: Trojan-Downloader.JS.Agent.kd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6BA344A4.exe Infected: Trojan-Downloader.Win32.VB.ceh skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C6B4824.exe Infected: Worm.Win32.VB.an skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C754437.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6EE06D13.cmt Infected: Trojan-Downloader.Win32.Agent.lak skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6EE7410C.exe Infected: Trojan-Downloader.Win32.Agent.lak skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70640223.exe Infected: not-a-virus:AdWare.Win32.180Solutions.at skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71402470.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\715B5859.tmp/td.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\715B5859.tmp/run.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\715B5859.tmp/zgo.exe Infected: P2P-Worm.Win32.Agent.v skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\715B5859.tmp ZIP: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\715B5859.tmp CryptFF: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\748A0E05.tmp Infected: Backdoor.Win32.IRCBot.aro skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\749E09EF.tmp Infected: Trojan.Win32.Agent.cmn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0005/stream/data0004 Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0005/stream Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0005 Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0006/stream/data0004 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0006/stream/data0005 Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0006/stream Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp/data0006 Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp NSIS: infected - 7 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74A807E5.tmp CryptFF: infected - 7 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0005/stream/data0004 Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0005/stream Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0005 Infected: not-a-virus:AdWare.Win32.TrafficSol.n skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0006/stream/data0004 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0006/stream/data0005 Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0006/stream Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe/data0006 Infected: not-a-virus:AdWare.Win32.BHO.lq skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe NSIS: infected - 7 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75B37ABE.exe CryptFF: infected - 7 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78216B1C.exe Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\797823A3.exe Infected: Trojan.Win32.Crypt.e skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mum\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-3-27-2008( 15-59-10 ).LOG Object is locked skipped C:\Documents and Settings\Mum\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped C:\Documents and Settings\Mum\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Mum\Desktop\stuff\sailing by.wm Infected: Trojan-Downloader.WMA.Wimad.m skipped C:\Documents and Settings\Mum\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Mum\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Mum\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Mum\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mum\Local Settings\History\History.IE5\MSHist012008032720080328\index.dat Object is locked skipped C:\Documents and Settings\Mum\Local Settings\Temp\~DF167.tmp Object is locked skipped C:\Documents and Settings\Mum\Local Settings\Temp\~DF178.tmp Object is locked skipped C:\Documents and Settings\Mum\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mum\ntuser.dat Object is locked skipped C:\Documents and Settings\Mum\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton AntiVirus\Savrt\0620NAV~.TMP Object is locked skipped C:\Program Files\Norton AntiVirus\Savrt\0926NAV~.TMP Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\xuqpnpkj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP13\A0007500.dll Infected: not-a-virus:AdWare.Win32.Agent.asj skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0013487.exe Infected: Trojan-Downloader.Win32.VB.dck skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0013488.exe Infected: Trojan-Downloader.Win32.VB.dck skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0013489.dll Infected: not-a-virus:AdWare.Win32.Agent.aye skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0013493.dll Infected: not-a-virus:AdWare.Win32.Agent.aye skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0020518.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0020519.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP14\A0020520.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP16\A0024202.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP19\A0024283.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP20\change.log Object is locked skipped C:\System Volume Information\_restore{7DE7E66C-8086-44B5-9E95-B61DA99A584D}\RP5\A0000233.exe Infected: not-a-virus:PSWTool.Win32.PassView.ag skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
03-27-2008, 02:54 PM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Locate and delete this file, as it's identified as a trojan downloader:
C:\Documents and Settings\Mum\Desktop\stuff\sailing by.wm Please use Symantec's guide to remove the Norton Quarantine files. The other items found by Kaspersky will be addressed by uninstalling ComboFix as instructed below: Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-27-2008, 03:25 PM
|
#19 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 15
OS: Windows XP home [sp 2]
|
Re: Internet hijacked. Have followed five steps; need assurance
Thanks tetonbob,
I've no doubt that my problems originated with a P2P. I thought my system was secure with Norton anti-virus, Zone alarm firewall, and ad-aware 2007. I know better now. I know you are not affiliated with particular programs/sites, but since you used Kaspersky to find the remainder of the viruses, and Kaspersky had last week found viruses when I uploaded files to virustotal, would you suggest that it might be a better option than the norton? My current licence expires on 1 April, and I was planning to look around for something else....... Donation to TSF to follow. Thanks for your time and help. |
|
|
|
|
03-27-2008, 04:31 PM
|
#20 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Internet hijacked. Have followed five steps; need assurance
Kaspersky is one of the best AV applications there is. I would highly recommend it, or NOD32 by Eset.
Have a look here: www.av-comparatives.org That said, we as users have to be careful about what we bring onto the machines. You're welcome for the help. Surf Safely! 
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
