|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-12-2008, 11:34 AM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Help with HJT log on computer that keeps opening up anti-virus websites..
Greetings. I am having difficulty working on the computer in question. Because it is infected with some types of malware, trojans etc., it keeps having popups appear and opening up IE to anti-virus websites making it very difficult to try to run programs to clean it up. Could someone please explain how I get info. off of that computer and onto my other laptop so that I can post to this site? I did manage to run HiJackthis & it created a logfile, but I don't want to infect my laptop by transferring the info onto this computer that I am using to post this. Also, the whole time the sick computer is on, it downloads stuff and pop up appear. Can I halt this by going into safe mode to work? THanks in advance. Man what a mother's day present...and infection.
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-12-2008, 12:37 PM
|
#2 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
My HiJack Log that I managed to get to this computer... I appreciate any free help that I receive. THis site is a god send when you have computer problems. Great tech's!
 Kill'em with Kindness(My motto) **************************************** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:32:28 AM, on 5/12/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\USB Storage RW\shwicon.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Grisoft\AVG7\avgwb.dat C:\WINDOWS\System32\rundll32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\wmsdkns.exe, O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW" O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [70166a6d] rundll32.exe "C:\WINDOWS\System32\gqbaxtcp.dll",b O4 - HKLM\..\Run: [BM732559f1] Rundll32.exe "C:\WINDOWS\System32\batuuimw.dll",s O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1183357003421 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1183356966781 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\b2new.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- End of file - 8240 bytes |
|
|
|
|
05-17-2008, 07:55 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Hi Sandy -
We prefer a more comprehensive set of logs from Deckard's System Scanner, as outlined in this thread: http://www.techsupportforum.com/secu...oval-help.html Please do this: Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-18-2008, 07:34 AM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Good Day,
I can't get Deckard to finish running. I am not running in safe mode and it tells me it runs into problems and needs to close. :( What is next please since I cannot get this to work? Sandy |
|
|
|
|
05-18-2008, 09:10 AM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
At what stage is DSS when it encounter problems?
To save you time, I will offer this workaround: Please download ATF Cleaner by Atribune.
For Technical Support, double-click the e-mail address located at the bottom of each menu. --------------------------------------------------------------------------------------------- Please run Deckard's System Scanner once again, this time using these instructions (this assumes dss.exe is on the desktop): Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /configOn the left side, UnTick Temp CleanUp On the right side, UnTick Event Logs Click Scan! When finished, it shall produce two logs for you. Post the logs in your next reply.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-18-2008, 07:02 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
OK. THanks that worked. This is the computer that since I had lost all administrator privledges due to this virus, I had created a new log in that I thought could perform the test to rid this virus since I was planning on giving it administrator privledges. This new user is TEST. THe old administrator and primary account was Administrator but it only shows up in safe mode :(. This master plan did not work as I couldn't change privledges of TEST except for administrator.
I was so excited after doing the first step that I didn't notice the command line that you told me to enter on Deckard Log the first time. I just clicked it. After re-reading, I then followed the instructions to a T so I hope the log doesn't reflect anything unusual because of my error. That is why it is labeled main1. Please tell me where to proceed next. THanks, Sandy Deckard's System Scanner v20071014.68 Run by Test on 2008-05-18 15:48:08 Computer is in Normal Mode. -------------------------------------------------------------------------------- System Drive C: has 15.39 GiB (less than 15%) free. -- HijackThis (run as Test.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:48:11 PM, on 5/18/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\USB Storage RW\shwicon.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\rundll32.exe C:\Documents and Settings\Test\desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Test.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\wmsdkns.exe, O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: {fa8a84b8-52c7-d348-da44-b3831e380308} - {803083e1-383b-44ad-843d-7c258b48a8af} - C:\WINDOWS\System32\tnwuxoot.dll O2 - BHO: (no name) - {9571E2DA-069F-42EB-B4D9-ABC54EB30ABA} - C:\WINDOWS\System32\nnnoLCTL.dll O2 - BHO: (no name) - {C542E842-BFFA-4B0E-A4EA-BA86AC2542CB} - C:\WINDOWS\System32\yayWNHbA.dll O2 - BHO: (no name) - {C7BBC1FA-E415-4926-9A47-9AB58D0B3BC8} - C:\WINDOWS\System32\jkkHXPJa.dll O2 - BHO: (no name) - {D836BFC0-B7DD-47B5-8000-1281C7BCEE7E} - C:\WINDOWS\System32\yayaApNg.dll O2 - BHO: (no name) - {D8D64603-4F79-4FF2-BF42-FB5A51F8852F} - C:\WINDOWS\System32\iifeFuSL.dll O2 - BHO: (no name) - {DC04D03E-7455-4486-BE31-7AF751A26298} - C:\WINDOWS\System32\mlJBUOHx.dll O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW" O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [BM732559f1] Rundll32.exe "C:\WINDOWS\System32\fjmowuqw.dll",s O4 - HKLM\..\Run: [70166a6d] rundll32.exe "C:\WINDOWS\System32\djdncyts.dll",b O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1183357003421 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1183356966781 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O20 - Winlogon Notify: jkkHXPJa - C:\WINDOWS\SYSTEM32\jkkHXPJa.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- End of file - 8901 bytes -- Files created between 2008-04-18 and 2008-05-18 ----------------------------- 2008-05-18 15:47:08 98880 --a----c- C:\WINDOWS\System32\tnwuxoot.dll 2008-05-18 15:41:08 83072 --a----c- C:\WINDOWS\System32\djdncyts.dll 2008-05-18 15:35:48 90272 --a----c- C:\WINDOWS\System32\fjmowuqw.dll 2008-05-18 15:35:07 1342384 --ahs---- C:\WINDOWS\System32\AbHNWyay.ini2 2008-05-18 15:35:05 314480 --a------ C:\WINDOWS\System32\yayWNHbA.dll 2008-05-18 08:07:48 98944 --a----c- C:\WINDOWS\System32\mfwmkmmo.dll 2008-05-18 08:02:50 83136 -------c- C:\WINDOWS\System32\pleradpu.dll 2008-05-18 08:02:34 90336 --a----c- C:\WINDOWS\System32\lybkqvbt.dll 2008-05-17 23:00:25 99024 --a----c- C:\WINDOWS\System32\edqkohfj.dll 2008-05-17 22:58:33 90288 --a----c- C:\WINDOWS\System32\pwibbnqe.dll 2008-05-17 22:38:00 0 d-------- C:\Program Files\Panda Security 2008-05-17 10:45:36 314416 -----n--- C:\WINDOWS\System32\ssqRKCTn.dll 2008-05-17 10:39:38 98960 --a----c- C:\WINDOWS\System32\kndmeyvi.dll 2008-05-17 10:34:36 90224 --a----c- C:\WINDOWS\System32\xhihmcqu.dll 2008-05-17 10:33:37 1342184 --ahs---- C:\WINDOWS\System32\gNpAayay.ini2 2008-05-17 10:33:31 314416 --a------ C:\WINDOWS\System32\yayaApNg.dll 2008-05-17 09:35:56 98960 --a----c- C:\WINDOWS\System32\hqpbesug.dll 2008-05-17 09:34:53 90224 --a----c- C:\WINDOWS\System32\iyabtiap.dll 2008-05-16 11:15:25 82992 --a----c- C:\WINDOWS\System32\rvemyhys.dll 2008-05-16 11:14:38 90240 --a----c- C:\WINDOWS\System32\lfgdouqp.dll 2008-05-16 11:09:09 98896 --a----c- C:\WINDOWS\System32\bqadgidj.dll 2008-05-16 10:58:32 90240 --a----c- C:\WINDOWS\System32\qfegosrn.dll 2008-05-15 14:26:21 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-15 14:25:07 0 d---s--c- C:\Documents and Settings\Test\UserData 2008-05-15 14:23:56 0 d------c- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-05-15 12:30:02 0 d-------- C:\Program Files\Common Files\Scanner 2008-05-15 12:29:59 0 d------c- C:\Documents and Settings\Test\Application Data\Yahoo! 2008-05-15 12:29:50 0 d------c- C:\Documents and Settings\Test\Application Data\AVG7 2008-05-15 11:56:24 90304 --a------ C:\WINDOWS\System32\xsjddypb.dll 2008-05-15 11:55:10 1345188 --ahs---- C:\WINDOWS\System32\LSuFefii.ini2 2008-05-15 11:54:57 314480 --a------ C:\WINDOWS\System32\iifeFuSL.dll 2008-05-15 11:48:31 82944 --a------ C:\WINDOWS\System32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-05-15 11:48:31 82944 --a------ C:\WINDOWS\System32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-05-15 10:50:50 0 d------c- C:\Documents and Settings\Test\Application Data\Macromedia 2008-05-15 10:42:09 82960 --a------ C:\WINDOWS\System32\qvybbspo.dll 2008-05-15 10:36:09 98960 --a------ C:\WINDOWS\System32\ojmeuaue.dll 2008-05-15 10:32:06 90304 --a------ C:\WINDOWS\System32\jmyycxfo.dll 2008-05-14 09:04:12 99008 --a------ C:\WINDOWS\System32\ufggbyva.dll 2008-05-14 08:59:23 90288 --a------ C:\WINDOWS\System32\kghfapdk.dll 2008-05-14 06:40:53 99008 --a------ C:\WINDOWS\System32\ogjdudyk.dll 2008-05-14 06:38:41 90288 --a------ C:\WINDOWS\System32\ctqtrjdv.dll 2008-05-13 20:57:19 90304 --a----c- C:\WINDOWS\System32\croospqc.dll 2008-05-13 20:56:32 1342693 --ahs---- C:\WINDOWS\System32\xHOUBJlm.ini2 2008-05-13 20:56:24 314480 --a------ C:\WINDOWS\System32\mlJBUOHx.dll 2008-05-13 17:30:41 0 d------c- C:\Documents and Settings\Test\Application Data\HP 2008-05-13 17:11:07 314480 -----n--- C:\WINDOWS\System32\yaywvuVm.dll 2008-05-13 17:03:54 168 --ah---c- C:\Documents and Settings\Test\hpothb07.dat 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\Lavasoft 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\InterTrust 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\Identities 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\COREL 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\ArcSoft 2008-05-13 17:03:24 0 d------c- C:\Documents and Settings\Test\Application Data\Adobe 2008-05-13 17:03:23 0 dra----c- C:\Documents and Settings\Test\Favorites 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Desktop 2008-05-13 17:03:23 0 d---s--c- C:\Documents and Settings\Test\Cookies 2008-05-13 17:03:23 0 drah---c- C:\Documents and Settings\Test\Application Data 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\VERITAS 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\Symantec 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\Share-to-Web Upload Folder 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\SampleView 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\MSN6 2008-05-13 17:03:23 0 d------c- C:\Documents and Settings\Test\Application Data\Motive 2008-05-13 17:03:22 0 d------c- C:\Documents and Settings\Test\WINDOWS 2008-05-13 17:03:22 0 d--h---c- C:\Documents and Settings\Test\Templates 2008-05-13 17:03:22 0 dra----c- C:\Documents and Settings\Test\Start Menu 2008-05-13 17:03:22 0 drah---c- C:\Documents and Settings\Test\SendTo 2008-05-13 17:03:22 0 drah---c- C:\Documents and Settings\Test\Recent 2008-05-13 17:03:22 0 d--h---c- C:\Documents and Settings\Test\PrintHood 2008-05-13 17:03:22 0 d--h---c- C:\Documents and Settings\Test\NetHood 2008-05-13 17:03:22 0 dra----c- C:\Documents and Settings\Test\My Documents 2008-05-13 17:03:22 0 d--h---c- C:\Documents and Settings\Test\Local Settings 2008-05-13 17:03:21 1310720 --ah----- C:\Documents and Settings\Test\NTUSER.DAT 2008-05-13 15:02:30 98944 --a----c- C:\WINDOWS\System32\rcihpkuh.dll 2008-05-13 14:54:44 0 d-------- C:\Program Files\SpywareBlaster 2008-05-13 14:53:30 90240 --a----c- C:\WINDOWS\System32\ysyexhep.dll 2008-05-13 09:03:14 98928 --a----c- C:\WINDOWS\System32\nvduaxjy.dll 2008-05-13 08:01:32 98864 --a----c- C:\WINDOWS\System32\rjgnutgg.dll 2008-05-13 07:59:24 83072 --a----c- C:\WINDOWS\System32\xhrmfjhv.dll 2008-05-13 07:58:31 1415042 --ahs---- C:\WINDOWS\System32\LTCLonnn.ini2 2008-05-12 23:36:31 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec> 2008-05-12 23:02:03 68096 --a------ C:\WINDOWS\zip.exe 2008-05-12 23:02:03 49152 --a------ C:\WINDOWS\VFind.exe 2008-05-12 23:02:03 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-05-12 23:02:03 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-05-12 23:02:03 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-05-12 23:02:03 98816 --a------ C:\WINDOWS\sed.exe 2008-05-12 23:02:03 80412 --a------ C:\WINDOWS\grep.exe 2008-05-12 23:02:03 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-05-12 22:05:52 98896 --a----c- C:\WINDOWS\System32\uhlvhtba.dll 2008-05-12 11:54:54 98896 --a----c- C:\WINDOWS\System32\yffkxpif.dll 2008-05-12 10:59:56 98896 --a----c- C:\WINDOWS\System32\hgptujxk.dll 2008-05-12 07:23:50 2618 --a------ C:\WINDOWS\System32\tmp.reg 2008-05-12 06:23:07 98896 --a----c- C:\WINDOWS\System32\iwlnaxiv.dll 2008-05-12 06:17:34 316496 --a------ C:\WINDOWS\System32\nnnoLCTL.dll 2008-05-11 22:51:51 0 d--h----- C:\WINDOWS\System32\GroupPolicy 2008-05-11 22:37:48 86528 --a------ C:\WINDOWS\System32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix> 2008-05-11 22:37:47 25600 --a------ C:\WINDOWS\System32\WS2Fix.exe 2008-05-11 22:37:47 289144 --a------ C:\WINDOWS\System32\VCCLSID.exe <Not Verified; S!Ri; > 2008-05-11 22:37:47 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2008-05-11 22:37:47 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2008-05-11 22:37:46 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2008-05-11 19:14:40 32768 --a------ C:\WINDOWS\System32\sockins32.dll <Not Verified; ThinkPad; ThinkPad repl> 2008-05-11 19:13:51 0 d-------- C:\WINDOWS\System32\dFrnx06 2008-05-11 19:13:48 0 d------c- C:\Temp 2008-05-11 19:11:44 25728 --a------ C:\WINDOWS\System32\jkkHXPJa.dll 2008-05-07 07:48:32 0 d------c- C:\Documents and Settings\Administrator\Application Data\Snapfish 2008-04-21 14:35:40 0 d-------- C:\Program Files\NCH Software 2008-04-21 13:58:39 0 d------c- C:\Documents and Settings\Administrator\Application Data\NCH Swift Sound -- Find3M Report --------------------------------------------------------------- 2008-05-15 14:26:28 0 d-------- C:\Program Files\Common Files 2008-05-13 21:21:57 0 d-------- C:\Program Files\Lavasoft -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{803083e1-383b-44ad-843d-7c258b48a8af}] 05/18/2008 03:47 PM 98880 --a--c--- C:\WINDOWS\System32\tnwuxoot.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9571E2DA-069F-42EB-B4D9-ABC54EB30ABA}] 05/12/2008 06:17 AM 316496 --a------ C:\WINDOWS\System32\nnnoLCTL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C542E842-BFFA-4B0E-A4EA-BA86AC2542CB}] 05/18/2008 03:35 PM 314480 --a------ C:\WINDOWS\System32\yayWNHbA.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C7BBC1FA-E415-4926-9A47-9AB58D0B3BC8}] 05/11/2008 07:11 PM 25728 --a------ C:\WINDOWS\System32\jkkHXPJa.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D836BFC0-B7DD-47B5-8000-1281C7BCEE7E}] 05/17/2008 10:33 AM 314416 --a------ C:\WINDOWS\System32\yayaApNg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8D64603-4F79-4FF2-BF42-FB5A51F8852F}] 05/15/2008 11:54 AM 314480 --a------ C:\WINDOWS\System32\iifeFuSL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DC04D03E-7455-4486-BE31-7AF751A26298}] 05/13/2008 08:56 PM 314480 --a------ C:\WINDOWS\System32\mlJBUOHx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [11/13/2002 01:37 AM] "KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" [10/25/2002 06:33 PM] "AutoTBar"="C:\hp\bin\autotbar.exe" [] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [02/23/2004 04:43 PM] "nwiz"="nwiz.exe" [02/23/2004 04:43 PM C:\WINDOWS\system32\nwiz.exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [12/11/2007 01:10 PM] "Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [04/17/2002 11:42 AM] "DDCActiveMenu"="C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [] "AlcxMonitor"="ALCXMNTR.EXE" [09/07/2004 02:47 PM C:\WINDOWS\Alcxmntr.exe] "BM732559f1"="C:\WINDOWS\System32\fjmowuqw.dll" [05/18/2008 03:35 PM] "70166a6d"="C:\WINDOWS\System32\djdncyts.dll" [05/18/2008 03:41 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [01/19/2007 01:54 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 11:05:26 PM] hp center.lnk - C:\Program Files\hp center\137903\Program\BackWeb-137903.exe [1/31/2003 2:25:11 AM] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2/19/2006 5:21:22 AM] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2/10/2006 8:56:20 AM] ImageMixer for HDD Camcorder.lnk - C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe [5/16/2007 7:52:19 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{C7BBC1FA-E415-4926-9A47-9AB58D0B3BC8}"= C:\WINDOWS\System32\jkkHXPJa.dll [05/11/2008 07:11 PM 25728] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\wmsdkns.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkHXPJa] jkkHXPJa.dll 05/11/2008 07:11 PM 25728 C:\WINDOWS\system32\jkkHXPJa.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\System32\yayWNHbA "Notification Packages"= :\WINDOW [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-05-18 15:48:40 ------------ Last edited by tetonbob; 05-18-2008 at 08:25 PM. |
|
|
|
|
05-18-2008, 08:29 PM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
That's a mess of Vundo you've got there...
 Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-19-2008, 09:19 AM
|
#9 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Thank you TETONBOB for getting back to me so quickly. I am returning with questions before I do anything that I am not sure of. First off, I began looking for my Windows CD that was mentioned on the instruction website. Of course, when you need something you can't find it quickly. Because there were options mentioned if you didn't find the CD, I opted to stop waisting time and just go that route.
Well, I have XPMedia Center Edition on this computer but I don't know if it is professional edition or personal edition. I am not sure how to find this out as there are 2 different directions depending on which edition I have. I did look under SYSTEM PROPERTIES on the computer but it just mentions: Media Center Version 2002 Service Pack 1. I have pulled out all of the paperwork that came with the computer and it all just mentions XP Media Center edition(no classification from personal or professional) So I am in a quandry and don't know if it really matters that much but I am sure it does. ANy clue on how I find out this info? Anxious to proceed... Sandy |
|
|
|
|
05-19-2008, 09:26 AM
|
#10 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
After looking at my Deckards logs, I noticed it mentioned Microsoft Windows XP Professional SP1 so I solved my mystery. Now I will proceed!
 Sandy |
|
|
|
|
05-19-2008, 09:30 AM
|
#11 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Sandy -
XPMedia Center Edition is based on XP Pro, so use the package for XP Pro, Service Pack 1 Edit: As shown in the extra.txt from DSS: Quote:
http://www.microsoft.com/downloads/d...2-631504EF5E26
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
05-19-2008, 12:36 PM
|
#12 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
This link is for Floppy drive when no CD drive is useable. Is this recovery console possibly able to be downloaded to a CD instead? Is it a different link? I am struggling here.
|
|
|
|
|
05-19-2008, 01:19 PM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Hi Sandy....you're overthinking it. We use ComboFix to install the Recovery Console using that package. Don't worry about floppy/CD issues.
Download the file I've shown you the link for & save it as it's originally named, next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, you'll be presented with this image: Click on Yes. Then follow the rest of the instructions.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-19-2008, 05:38 PM
|
#14 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
TETONBOB:
You were right! I tend to overanalyze when I am stressed.OK. I ran the Combo Fix program. Man, it did have alot of files to go thru. Possibly a new one everytime I received a pop up during the week while trying to fix? There was one day that the pop ups were appearing faster than I could delete them. The more I deleted, the more uploads I got. It is taking awhile for Combo Fix to prepare the log but I am trying to have patience. One question, all of this fixing was done on my newly created user "TEST" so when I finally figure out how to get the invisible ADMINISTRATOR log on back, (It only appears in safe mode now)will the virus be removed from that user also or will I have to do this for each user? It has been about 10 minutes since the scan finished. THE computer re-booted and the C:|Find 3M Screen came up that says it is preparing the Log Report. Do not run any programs until ComboFix has finished. Some program started to open but I hurried and closed it. Does it usually take this long or did I mess something up by closing the HP program that starts on every reboot? I still have the blue C:\ screen along with my desktop appearing with the same Preparing Log Report--but so far No log report?? |
|
|
|
|
05-19-2008, 06:31 PM
|
#15 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Now there is a box also stating this: vfind.cfexe-no disk
THere is no disk in the drive. Please insert a disk into drive \Device\Harddisk2\DR4. Cancel Try Again Continue Not sure which to choose? |
|
|
|
|
05-19-2008, 06:49 PM
|
#16 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
OK. I got rid of the Vfind box and it finally printed a log which I have attached. I noticed I can still see all of my family's user Id's are still there somewhere. What's next?? I'm on a roll.
ComboFix 08-05-15.3 - Test 2008-05-19 18:08:25.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.144 [GMT -5:00] Running from: C:\Documents and Settings\Test\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini C:\WINDOWS\system32\acyvmlnp.ini C:\WINDOWS\system32\adult.txt C:\WINDOWS\system32\bqadgidj.dll C:\WINDOWS\system32\cfevygrs.ini C:\WINDOWS\system32\cnmqwrbb.dll C:\WINDOWS\system32\ctqtrjdv.dll C:\WINDOWS\system32\cwhemdpg.dll C:\WINDOWS\system32\dkhkwumf.ini C:\WINDOWS\system32\edqkohfj.dll C:\WINDOWS\system32\eexflsmi.dll C:\WINDOWS\system32\ffqlvdxl.dll C:\WINDOWS\system32\finance.txt C:\WINDOWS\system32\fjmowuqw.dll C:\WINDOWS\system32\foxgwbpi.dll C:\WINDOWS\system32\glaibppj.dll C:\WINDOWS\system32\gNpAayay.ini C:\WINDOWS\system32\gNpAayay.ini2 C:\WINDOWS\system32\gnqkaaie.ini C:\WINDOWS\system32\hqpbesug.dll C:\WINDOWS\system32\iifeFuSL.dll C:\WINDOWS\system32\ilpbfmjm.ini C:\WINDOWS\system32\imslfxee.ini C:\WINDOWS\system32\iyabtiap.dll C:\WINDOWS\system32\jkkHXPJa.dll C:\WINDOWS\system32\jmyycxfo.dll C:\WINDOWS\system32\kghfapdk.dll C:\WINDOWS\system32\kndmeyvi.dll C:\WINDOWS\system32\kqjbdviv.ini C:\WINDOWS\system32\lfgdouqp.dll C:\WINDOWS\system32\lroivaww.ini C:\WINDOWS\system32\LSuFefii.ini C:\WINDOWS\system32\LSuFefii.ini2 C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\LTCLonnn.ini C:\WINDOWS\system32\LTCLonnn.ini2 C:\WINDOWS\system32\lybkqvbt.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\meuxefmk.ini C:\WINDOWS\system32\mfwmkmmo.dll C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\nvduaxjy.dll C:\WINDOWS\system32\ogjdudyk.dll C:\WINDOWS\system32\ojmeuaue.dll C:\WINDOWS\system32\opsbbyvq.ini C:\WINDOWS\system32\other.txt C:\WINDOWS\system32\pharma.txt C:\WINDOWS\system32\pwibbnqe.dll C:\WINDOWS\system32\qfegosrn.dll C:\WINDOWS\system32\rjgnutgg.dll C:\WINDOWS\system32\rxhibcsh.ini C:\WINDOWS\system32\sft.res C:\WINDOWS\system32\ssqRKCTn.dll C:\WINDOWS\system32\stycndjd.ini C:\WINDOWS\system32\syhymevr.ini C:\WINDOWS\system32\tetteujj.dll C:\WINDOWS\system32\tkyiwfww.dll C:\WINDOWS\system32\tnwuxoot.dll C:\WINDOWS\system32\ufggbyva.dll C:\WINDOWS\system32\updarelp.ini C:\WINDOWS\system32\vhjfmrhx.ini C:\WINDOWS\system32\vyhsugxi.dll C:\WINDOWS\system32\wgxsrkbu.ini C:\WINDOWS\system32\womhjoex.ini C:\WINDOWS\system32\wufgolsr.dll C:\WINDOWS\system32\wwfwiykt.ini C:\WINDOWS\system32\xeojhmow.dll C:\WINDOWS\system32\xhihmcqu.dll C:\WINDOWS\system32\xhrmfjhv.dll C:\WINDOWS\system32\xrhiorkv.dll C:\WINDOWS\system32\xsjddypb.dll C:\WINDOWS\system32\yayaApNg.dll C:\WINDOWS\system32\yaywvuVm.dll . ---- Previous Run ------- . C:\Program Files\webhancer C:\WINDOWS\123messenger.per C:\WINDOWS\2020search.dll C:\WINDOWS\2020search2.dll C:\WINDOWS\apphelp32.dll C:\WINDOWS\asferror32.dll C:\WINDOWS\asycfilt32.dll C:\WINDOWS\athprxy32.dll C:\WINDOWS\ati2dvaa32.dll C:\WINDOWS\ati2dvag32.dll C:\WINDOWS\audiosrv32.dll C:\WINDOWS\autodisc32.dll C:\WINDOWS\avifile32.dll C:\WINDOWS\avisynthex32.dll C:\WINDOWS\aviwrap32.dll C:\WINDOWS\bjam.dll C:\WINDOWS\bokja.exe C:\WINDOWS\browserad.dll C:\WINDOWS\cdsm32.dll C:\WINDOWS\changeurl_30.dll C:\WINDOWS\cookies.ini C:\WINDOWS\didduid.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\licencia.txt C:\WINDOWS\mainms.vpi C:\WINDOWS\megavid.cdt C:\WINDOWS\msa64chk.dll C:\WINDOWS\msapasrc.dll C:\WINDOWS\mspphe.dll C:\WINDOWS\mssvr.exe C:\WINDOWS\muotr.so C:\WINDOWS\ntnut.exe C:\WINDOWS\pskt.ini C:\WINDOWS\saiemod.dll C:\WINDOWS\shdocpe.dll C:\WINDOWS\shdocpl.dll C:\WINDOWS\stcloader.exe C:\WINDOWS\swin32.dll C:\WINDOWS\system32\000060.exe C:\WINDOWS\system32\adult.txt C:\WINDOWS\system32\finance.txt C:\WINDOWS\system32\jiixjmnf.ini C:\WINDOWS\system32\llgxciat.ini C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\LTCLonnn.ini C:\WINDOWS\system32\LTCLonnn.ini2 C:\WINDOWS\system32\lvlbfbpk.ini C:\WINDOWS\system32\other.txt C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pctxabqg.ini C:\WINDOWS\system32\pharma.txt C:\WINDOWS\system32\sft.res C:\WINDOWS\telefonos.txt C:\WINDOWS\textos.txt C:\WINDOWS\voiceip.dll C:\WINDOWS\winsb.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MSSECURITY1.209.4 -------\Service_MsSecurity1.209.4 ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))) . 2008-05-19 13:52 . 2008-05-19 13:52 2,560 --a--c--- C:\WINDOWS\system32\usjqlnkr.exe 2008-05-19 13:37 . 2008-05-19 13:37 2,560 --a--c--- C:\WINDOWS\system32\xnwwqwgj.exe 2008-05-19 13:18 . 2008-05-19 13:18 <DIR> d-------- C:\WINDOWS\msdownld.tmp 2008-05-17 22:38 . 2008-05-17 22:38 <DIR> d-------- C:\Program Files\Panda Security 2008-05-17 14:58 . 2008-05-17 14:58 <DIR> d----c--- C:\Deckard 2008-05-16 11:15 . 2008-05-16 11:15 82,992 --a--c--- C:\WINDOWS\system32\rvemyhys.dll 2008-05-15 14:26 . 2008-05-15 12:30 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-15 14:25 . 2008-05-15 12:30 <DIR> d---sc--- C:\Documents and Settings\Test\UserData 2008-05-15 14:23 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-05-15 12:30 . 2008-05-15 12:30 <DIR> d-------- C:\Program Files\Common Files\Scanner 2008-05-15 12:29 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Yahoo! 2008-05-15 12:29 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\AVG7 2008-05-15 11:48 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-15 11:48 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-15 10:42 . 2008-05-15 10:42 82,960 --a------ C:\WINDOWS\system32\qvybbspo.dll 2008-05-13 20:57 . 2008-05-13 20:57 90,304 --a--c--- C:\WINDOWS\system32\croospqc.dll 2008-05-13 17:30 . 2008-05-13 17:30 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\HP 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\WINDOWS 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\VERITAS 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Symantec 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Share-to-Web Upload Folder 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\SampleView 2008-05-13 17:03 . 2006-06-12 03:46 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\MSN6 2008-05-13 17:03 . 2003-04-14 13:25 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Motive 2008-05-13 17:03 . 2006-06-12 03:06 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Lavasoft 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\InterTrust 2008-05-13 17:03 . 2003-04-06 19:04 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\COREL 2008-05-13 17:03 . 2003-04-14 14:06 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\ArcSoft 2008-05-13 17:03 . 2008-05-15 14:25 <DIR> d----c--- C:\Documents and Settings\Test 2008-05-13 17:03 . 2008-05-19 18:26 1,024 --ah----- C:\Documents and Settings\Test\ntuser.dat.LOG 2008-05-13 17:03 . 2005-06-20 00:38 168 --ah-c--- C:\Documents and Settings\Test\hpothb07.dat 2008-05-13 15:02 . 2008-05-13 15:02 98,944 --a--c--- C:\WINDOWS\system32\rcihpkuh.dll 2008-05-13 14:54 . 2008-05-16 11:02 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-13 14:53 . 2008-05-13 14:53 90,240 --a--c--- C:\WINDOWS\system32\ysyexhep.dll 2008-05-12 22:05 . 2008-05-12 22:05 98,896 --a--c--- C:\WINDOWS\system32\uhlvhtba.dll 2008-05-12 11:54 . 2008-05-12 11:54 98,896 --a--c--- C:\WINDOWS\system32\yffkxpif.dll 2008-05-12 10:59 . 2008-05-12 10:59 98,896 --a--c--- C:\WINDOWS\system32\hgptujxk.dll 2008-05-12 07:23 . 2008-05-15 22:26 2,618 --a------ C:\WINDOWS\system32\tmp.reg 2008-05-12 06:23 . 2008-05-12 06:23 98,896 --a--c--- C:\WINDOWS\system32\iwlnaxiv.dll 2008-05-12 06:22 . 2008-05-19 17:13 109,807 --a------ C:\WINDOWS\BM732559f1.xml 2008-05-12 06:17 . 2008-05-12 06:17 316,496 --a------ C:\WINDOWS\system32\nnnoLCTL.dll 2008-05-11 22:51 . 2008-05-11 22:51 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-11 22:37 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-11 22:37 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-11 22:37 . 2008-04-24 08:10 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-11 22:37 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-11 22:37 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-11 22:37 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-11 20:40 . 2008-05-12 18:28 1,916 --a------ C:\WINDOWS\system32\default.htm 2008-05-11 19:21 . 2008-05-14 06:44 57,546 --a------ C:\WINDOWS\promogif3.gif 2008-05-11 19:21 . 2008-05-14 06:44 24,351 --a------ C:\WINDOWS\promogif1.gif 2008-05-11 19:21 . 2008-05-14 06:44 24,066 --a------ C:\WINDOWS\promogif2.gif 2008-05-11 19:21 . 2008-05-14 06:44 507 --a------ C:\WINDOWS\promo6.html 2008-05-11 19:21 . 2008-05-14 06:44 500 --a------ C:\WINDOWS\promo4.html 2008-05-11 19:21 . 2008-05-14 06:44 478 --a------ C:\WINDOWS\promo5.html 2008-05-11 19:21 . 2008-05-14 06:44 283 --a------ C:\WINDOWS\promo3.html 2008-05-11 19:21 . 2008-05-14 06:44 283 --a------ C:\WINDOWS\promo2.html 2008-05-11 19:21 . 2008-05-14 06:44 283 --a------ C:\WINDOWS\promo1.html 2008-05-11 19:14 . 2008-05-11 19:14 32,768 --a------ C:\WINDOWS\system32\sockins32.dll 2008-05-11 19:13 . 2008-05-11 19:13 <DIR> d-------- C:\WINDOWS\system32\dFrnx06 2008-05-11 19:13 . 2008-05-11 19:13 <DIR> d----c--- C:\Temp\tmpvc14 2008-05-11 19:13 . 2008-05-11 19:13 <DIR> d----c--- C:\Temp 2008-05-07 07:48 . 2008-05-07 07:48 <DIR> d----c--- C:\Documents and Settings\Administrator\Application Data\Snapfish 2008-04-21 14:35 . 2008-04-21 14:35 <DIR> d-------- C:\Program Files\NCH Software 2008-04-21 13:58 . 2008-04-21 13:58 <DIR> d----c--- C:\Documents and Settings\Administrator\Application Data\NCH Swift Sound . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-19 18:26 --------- dc----w C:\Documents and Settings\All Users\Application Data\AVG7 2008-05-14 02:21 --------- d-----w C:\Program Files\Lavasoft 2008-05-14 02:21 --------- d-----w C:\Documents and Settings\Joe.HOMECOMPUTER\Application Data\Lavasoft 2007-07-12 16:53 51,968 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT 2007-07-10 00:45 49,673,528 ----a-w C:\Program Files\iTunesSetup.exe 2007-07-08 03:04 63,992 ----a-w C:\Documents and Settings\Sandra.HOMECOMPUTER\Application Data\GDIPFONTCACHEV1.DAT 2007-06-30 14:18 5,271,552 ----a-w C:\Program Files\PStory.msi 2007-05-23 15:56 21,407,888 ----a-w C:\Program Files\avg75free_467a1008.exe 2006-06-12 15:01 324 ---ha-w C:\Documents and Settings\Joe\hpothb07.dat 2006-06-11 00:28 164 -c-ha-w C:\Documents and Settings\All Users\hpothb07.dat 2006-06-10 22:25 1,312 ---ha-w C:\Documents and Settings\Sandra\hpothb07.dat 2006-06-10 20:50 0 ---ha-w C:\Documents and Settings\Joe.HOMECOMPUTER\hpothb07.dat 2006-06-05 03:12 69,720 ----a-w C:\Documents and Settings\Sandra\Application Data\GDIPFONTCACHEV1.DAT 2005-06-20 05:38 168 -c-ha-w C:\Documents and Settings\Administrator\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\WINDOWS\system32\config\systemprofile\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Ross.YOUR-I1E86FKZ1P\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Default User\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Amanda.JOSEPHHEDGES\hpothb07.dat 2006-06-11 21:15 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ------- Sigcheck ------- 2004-08-04 01:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\ServicePackFiles\i386\ip6fw.sys 2004-08-04 01:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 61,440 2005-02-02 21:44:24 C:\hp\KBD\bak\KBD.EXE ----a-w 39,792 2007-10-11 01:51:55 C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe ----a-w 67,160 2005-06-02 06:34:34 C:\Program Files\AIM\bak\aim.exe ----a-w 221,184 2005-02-16 22:15:22 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe ----a-w 185,784 2006-09-27 18:27:54 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe ----a-w 6,266,880 2006-10-07 12:20:00 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe ----a-w 406,016 2006-12-02 20:59:31 C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe ----a-w 579,072 2007-12-25 18:44:53 C:\Program Files\Grisoft\AVG7\bak\avgcc.exe ----a-w 69,632 2002-06-18 07:11:24 C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe ----a-w 69,632 2002-06-17 22:11:24 C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe ----a-w 69,632 2002-04-18 01:42:56 C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe ----a-w 69,632 2002-04-17 16:42:56 C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe ----a-w 49,152 2005-05-12 05:12:54 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe ----a-w 229,952 2006-09-12 06:58:54 C:\Program Files\iTunes\bak\iTunesHelper.exe ----a-w 267,048 2007-12-11 18:10:26 C:\Program Files\iTunes\iTunesHelper.exe ----a-w 282,624 2006-09-01 20:57:48 C:\Program Files\QuickTime\bak\qttask.exe ----a-w 380,928 2006-08-23 01:30:44 C:\Program Files\SBC Self Support Tool\SmartBridge\bak\MotiveSB.exe ----a-w 155,648 2002-06-18 16:01:00 C:\Program Files\VERITAS Software\Update Manager\bak\sgtray.exe ----a-w 27,648 2002-11-13 06:37:08 C:\WINDOWS\eHome\bak\ehtray.exe ----a-w 27,648 2002-11-13 06:37:08 C:\WINDOWS\eHome\ehtray.exe ----a-w 212,992 2002-09-14 05:42:26 C:\WINDOWS\SMINST\bak\RECGUARD.EXE ----a-w 180 2007-02-03 04  27 C:\WINDOWS\system\bak\hpsysdrv.DAT----a-w 252 2008-02-09 16:56:19 C:\WINDOWS\system\hpsysdrv.dat ----a-w 52,736 1998-05-08 00:04:38 C:\WINDOWS\system\bak\hpsysdrv.exe ----a-w 114,688 2002-09-09 15:05:52 C:\WINDOWS\system32\bak\hkcmd.exe ----a-w 81,920 2002-06-14 23:39:38 C:\WINDOWS\system32\bak\ps2.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9571E2DA-069F-42EB-B4D9-ABC54EB30ABA}] 2008-05-12 06:17 316496 --a------ C:\WINDOWS\System32\nnnoLCTL.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:54 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2002-11-13 01:37 27648] "KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" [2002-10-25 18:33 69632] "AutoTBar"="C:\hp\bin\autotbar.exe" [ ] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-02-23 16:43 3026944] "nwiz"="nwiz.exe" [2004-02-23 16:43 753664 C:\WINDOWS\system32\nwiz.exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 11:42 69632] "DDCActiveMenu"="C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [ ] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\Alcxmntr.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 09:17 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696] hp center.lnk - C:\Program Files\hp center\137903\Program\BackWeb-137903.exe [2003-01-31 02:25:11 16384] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2006-02-10 08:56:20 73728] ImageMixer for HDD Camcorder.lnk - C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe [2007-05-16 07:52:19 1871872] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360] R3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;C:\WINDOWS\System32\DRIVERS\usbintel.sys [2002-08-29 14:00] R3 EvcapMaui;Emuzed EvcapMaui Device;C:\WINDOWS\System32\DRIVERS\EvcapMau.sys [2003-01-07 05:49] . Contents of the 'Scheduled Tasks' folder "2008-05-02 04:21:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-19 19:11:00 C:\WINDOWS\Tasks\AVG Free Control Center.job" - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe "2008-05-04 21:20:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2007-10-17 21:20:30 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-19 18:23:06 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehsched.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Completion time: 2008-05-19 19:43:47 - machine was rebooted [Test] ComboFix-quarantined-files.txt 2008-05-20 00:43:40 Pre-Run: 16,385,753,088 bytes free Post-Run: 16,313,794,560 bytes free 339 --- E O F --- 2008-04-10 11:22:11 Last edited by tetonbob; 05-19-2008 at 07:08 PM. |
|
|
|
|
05-19-2008, 07:24 PM
|
#17 (permalink) | ||
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
If you get this again:
Quote:
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 05-19-2008 at 07:26 PM. |
||
|
|
|
|
05-19-2008, 09:07 PM
|
#18 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
OK. I finally am done with this step. In the end I was told to submit one of the files to be analyzed and that I should tell you.
C:\Documents and settings\Test\Desktop.\[4]-Submit_2008-05-10@21.13.zip |
|
|
|
|
05-19-2008, 09:11 PM
|
#19 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,757
OS: 2000 Pro; XP Pro; XP Home
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Thanks, that file has been received, and you may now delete it from your desktop.
Please post the log from ComboFix (C:\ComboFix.txt if it's been closed), and a new HijackThis log, as outlined in my last post.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-19-2008, 09:21 PM
|
#20 (permalink) |
|
Registered User
Join Date: Nov 2004
Posts: 62
OS: Win/XP
|
Re: Help with HJT log on computer that keeps opening up anti-virus websites..
Man, You are quick!! Thanks so much!
My ComboFix log is attached.. ComboFix 08-05-15.3 - Test 2008-05-19 21:15:08.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.211 [GMT -5:00] Running from: C:\Documents and Settings\Test\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Test\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system\bak\hpsysdrv.DAT C:\WINDOWS\system\bak\hpsysdrv.exe C:\WINDOWS\system32\bak\hkcmd.exe C:\WINDOWS\system32\bak\ps2.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\hp\KBD\bak C:\hp\KBD\bak\KBD.EXE C:\Program Files\Adobe\Reader 8.0\Reader\bak C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe C:\Program Files\AIM\bak C:\Program Files\AIM\bak\aim.exe C:\Program Files\Common Files\InstallShield\UpdateService\bak C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe C:\Program Files\Common Files\Real\Update_OB\bak C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe C:\Program Files\Grisoft\AVG Free\bak C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe C:\Program Files\Grisoft\AVG7\bak C:\Program Files\Grisoft\AVG7\bak\avgcc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe C:\Program Files\Hewlett-Packard\HP Software Update\bak C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe C:\Program Files\iTunes\bak C:\Program Files\iTunes\bak\iTunesHelper.exe C:\Program Files\QuickTime\bak C:\Program Files\QuickTime\bak\qttask.exe C:\Program Files\SBC Self Support Tool\SmartBridge\bak C:\Program Files\SBC Self Support Tool\SmartBridge\bak\MotiveSB.exe C:\Program Files\VERITAS Software\Update Manager\bak C:\Program Files\VERITAS Software\Update Manager\bak\sgtray.exe C:\Temp\tmpvc14 C:\WINDOWS\BM732559f1.xml C:\WINDOWS\eHome\bak C:\WINDOWS\eHome\bak\ehtray.exe C:\WINDOWS\promo1.html C:\WINDOWS\promo2.html C:\WINDOWS\promo3.html C:\WINDOWS\promo4.html C:\WINDOWS\promo5.html C:\WINDOWS\promo6.html C:\WINDOWS\promogif1.gif C:\WINDOWS\promogif2.gif C:\WINDOWS\promogif3.gif C:\WINDOWS\pskt.ini C:\WINDOWS\SMINST\bak C:\WINDOWS\SMINST\bak\RECGUARD.EXE C:\WINDOWS\system\bak\hpsysdrv.DAT C:\WINDOWS\system\bak\hpsysdrv.exe C:\WINDOWS\system32\bak\hkcmd.exe C:\WINDOWS\system32\bak\ps2.exe C:\WINDOWS\system32\croospqc.dll C:\WINDOWS\system32\dFrnx06 C:\WINDOWS\system32\gvecvjct.dll C:\WINDOWS\system32\hgptujxk.dll C:\WINDOWS\system32\hykcocdd.dll C:\WINDOWS\system32\iwlnaxiv.dll C:\WINDOWS\system32\LTCLonnn.ini C:\WINDOWS\system32\LTCLonnn.ini2 C:\WINDOWS\system32\nnnoLCTL.dll C:\WINDOWS\system32\qvybbspo.dll C:\WINDOWS\system32\rcihpkuh.dll C:\WINDOWS\system32\rvemyhys.dll C:\WINDOWS\system32\sockins32.dll C:\WINDOWS\system32\uhlvhtba.dll C:\WINDOWS\system32\usjqlnkr.exe C:\WINDOWS\system32\xnwwqwgj.exe C:\WINDOWS\system32\yffkxpif.dll C:\WINDOWS\system32\ysyexhep.dll . ((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 ))))))))))))))))))))))))))))))) . 2008-05-19 13:18 . 2008-05-19 13:18 <DIR> d-------- C:\WINDOWS\msdownld.tmp 2008-05-17 22:38 . 2008-05-17 22:38 <DIR> d-------- C:\Program Files\Panda Security 2008-05-17 14:58 . 2008-05-17 14:58 <DIR> d----c--- C:\Deckard 2008-05-15 14:26 . 2008-05-15 12:30 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-15 14:25 . 2008-05-15 12:30 <DIR> d---sc--- C:\Documents and Settings\Test\UserData 2008-05-15 14:23 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-05-15 12:30 . 2008-05-15 12:30 <DIR> d-------- C:\Program Files\Common Files\Scanner 2008-05-15 12:29 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Yahoo! 2008-05-15 12:29 . 2008-05-15 12:29 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\AVG7 2008-05-15 11:48 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-15 11:48 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-13 17:30 . 2008-05-13 17:30 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\HP 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\WINDOWS 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\VERITAS 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Symantec 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Share-to-Web Upload Folder 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\SampleView 2008-05-13 17:03 . 2006-06-12 03:46 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\MSN6 2008-05-13 17:03 . 2003-04-14 13:25 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Motive 2008-05-13 17:03 . 2006-06-12 03:06 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\Lavasoft 2008-05-13 17:03 . 2003-01-18 07:23 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\InterTrust 2008-05-13 17:03 . 2003-04-06 19:04 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\COREL 2008-05-13 17:03 . 2003-04-14 14:06 <DIR> d----c--- C:\Documents and Settings\Test\Application Data\ArcSoft 2008-05-13 17:03 . 2008-05-15 14:25 <DIR> d----c--- C:\Documents and Settings\Test 2008-05-13 17:03 . 2008-05-19 21:28 1,024 --ah----- C:\Documents and Settings\Test\ntuser.dat.LOG 2008-05-13 17:03 . 2005-06-20 00:38 168 --ah-c--- C:\Documents and Settings\Test\hpothb07.dat 2008-05-13 14:54 . 2008-05-16 11:02 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-12 07:23 . 2008-05-15 22:26 2,618 --a------ C:\WINDOWS\system32\tmp.reg 2008-05-11 22:51 . 2008-05-11 22:51 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-11 22:37 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-11 22:37 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-11 22:37 . 2008-04-24 08:10 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-11 22:37 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-11 22:37 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-11 22:37 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-11 20:40 . 2008-05-12 18:28 1,916 --a------ C:\WINDOWS\system32\default.htm 2008-05-11 19:13 . 2008-05-19 21:15 <DIR> d----c--- C:\Temp 2008-05-07 07:48 . 2008-05-07 07:48 <DIR> d----c--- C:\Documents and Settings\Administrator\Application Data\Snapfish 2008-04-21 14:35 . 2008-04-21 14:35 <DIR> d-------- C:\Program Files\NCH Software 2008-04-21 13:58 . 2008-04-21 13:58 <DIR> d----c--- C:\Documents and Settings\Administrator\Application Data\NCH Swift Sound . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-20 02:15 --------- d-----w C:\Program Files\QuickTime 2008-05-20 02:15 --------- d-----w C:\Program Files\iTunes 2008-05-20 02:15 --------- d-----w C:\Program Files\AIM 2008-05-19 18:26 --------- dc----w C:\Documents and Settings\All Users\Application Data\AVG7 2008-05-14 02:21 --------- d-----w C:\Program Files\Lavasoft 2008-05-14 02:21 --------- d-----w C:\Documents and Settings\Joe.HOMECOMPUTER\Application Data\Lavasoft 2007-07-12 16:53 51,968 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT 2007-07-10 00:45 49,673,528 ----a-w C:\Program Files\iTunesSetup.exe 2007-07-08 03:04 63,992 ----a-w C:\Documents and Settings\Sandra.HOMECOMPUTER\Application Data\GDIPFONTCACHEV1.DAT 2007-06-30 14:18 5,271,552 ----a-w C:\Program Files\PStory.msi 2007-05-23 15:56 21,407,888 ----a-w C:\Program Files\avg75free_467a1008.exe 2006-06-12 15:01 324 ---ha-w C:\Documents and Settings\Joe\hpothb07.dat 2006-06-11 00:28 164 -c-ha-w C:\Documents and Settings\All Users\hpothb07.dat 2006-06-10 22:25 1,312 ---ha-w C:\Documents and Settings\Sandra\hpothb07.dat 2006-06-10 20:50 0 ---ha-w C:\Documents and Settings\Joe.HOMECOMPUTER\hpothb07.dat 2006-06-05 03:12 69,720 ----a-w C:\Documents and Settings\Sandra\Application Data\GDIPFONTCACHEV1.DAT 2005-06-20 05:38 168 -c-ha-w C:\Documents and Settings\Administrator\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\WINDOWS\system32\config\systemprofile\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Ross.YOUR-I1E86FKZ1P\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Default User\hpothb07.dat 2005-06-20 05:38 168 ---ha-w C:\Documents and Settings\Amanda.JOSEPHHEDGES\hpothb07.dat 2006-06-11 21:15 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ------- Sigcheck ------- 2004-08-04 01:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\ServicePackFiles\i386\ip6fw.sys 2004-08-04 01:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys . ((((((((((((((((((((((((((((( snapshot@2008-05-19_18.48.24.23 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-19 23:20:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-20 02:22:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-20 02:23:03 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_480.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:54 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2002-11-13 01:37 27648] "KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" [2002-10-25 18:33 69632] "AutoTBar"="C:\hp\bin\autotbar.exe" [ ] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-02-23 16:43 3026944] "nwiz"="nwiz.exe" [2004-02-23 16:43 753664 C:\WINDOWS\system32\nwiz.exe] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 11:42 69632] "DDCActiveMenu"="C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [ ] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\Alcxmntr.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 09:17 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696] hp center.lnk - C:\Program Files\hp center\137903\Program\BackWeb-137903.exe [2003-01-31 02:25:11 16384] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2006-02-10 08:56:20 73728] ImageMixer for HDD Camcorder.lnk - C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe [2007-05-16 07:52:19 1871872] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360] R3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;C:\WINDOWS\System32\DRIVERS\usbintel.sys [2002-08-29 14:00] R3 EvcapMaui;Emuzed EvcapMaui Device;C:\WINDOWS\System32\DRIVERS\EvcapMau.sys [2003-01-07 05:49] . Contents of the 'Scheduled Tasks' folder "2008-05-02 04:21:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-19 19:11:00 C:\WINDOWS\Tasks\AVG Free Control Center.job" - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe "2008-05-04 21:20:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2007-10-17 21:20:30 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-19 21:23:45 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehsched.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Completion time: 2008-05-19 21:50:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-20 02:50:45 ComboFix2.txt 2008-05-20 00:43:48 Pre-Run: 16,668,172,288 bytes free Post-Run: 16,647,335,936 bytes free 233 --- E O F --- 2008-04-10 11:22:11 My new log from HiJack This: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:14:11 PM, on 5/19/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\USB Storage RW\shwicon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW" O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1183357003421 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1183356966781 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- End of file - 7740 bytes Last edited by tetonbob; 05-19-2008 at 09:27 PM. |
|
|
|
| Thread Tools | |
|
|
