|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-14-2008, 08:29 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Adware.W32.spyshredder
Hi, A warning sign is popping up on my desktop with the message Spyware detected, install and clean...........
Another I warning comes up labelling it as Adware.W32.spyshredder advising me to download a certain program to clean it. Help, please. Bugs are eating my screen saver |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-14-2008, 08:36 AM
|
#2 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Here is my HJT log
Logfile of HijackThis v1.99.1 Scan saved at 10:33:45 AM, on 5/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmona.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PGPserv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\aspimgr.exe C:\DOCUME~1\BILLHA~1\LOCALS~1\Temp\Temporary Directory 4 for Copy of hijackthis.zip\HijackThis.exe C:\Program Files\WinIFixer\WinIFixer.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [lanmanwrk.exe clean] C:\WINDOWS\System32\lanmanwrk.exe clean O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: PGPtray.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1177626662593 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E13B48C0-51FF-491E-9BE8-0C4C9FD013A1}: NameServer = 71.242.0.12 71.252.0.12 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: OCMAPIHK.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe |
|
|
|
|
05-15-2008, 01:35 PM
|
#3 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Adware.W32.spyshredder
Hi, A warning sign is popping up on my desktop with the message Spyware detected, install and clean...........
Another warning comes up labelling it as Adware.W32.spyshredder advising me to download a certain program to clean it. Help, please. Bugs are eating my screen saver, and it looks like a caterpillar munching through a leaf. It dissappears when I touch the mouse and reverts to my desk top. I believe I picked it up while copying product information from one of my suppliers site, first thing in the AM when I revisited the product I was copying, I was asked to enter an Active X program, unusual, as it hadn't done that on th other 90% of the work already completed, but I allowed the Active X to run the program. I viewed the source, copied and pasted the html I needed onto my webpage and then proceeded to redirect the image sources and href's to my shopping cart, at which time I noticed that there were a lot of strange re-directs, mostly referencing a www.direct88.com or something similar to that. I did not retain that after the S**T hit the fan. My DSS logs are posted and attached. Thanks, Bill Hayes Deckard's System Scanner v20071014.68 Run by Bill Hayes on 2008-05-15 15:08:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 3 Restore Point(s) -- 3: 2008-05-15 19:09:00 UTC - RP14 - Deckard's System Scanner Restore Point 2: 2008-05-15 18:37:31 UTC - RP13 - Last good restore point 1: 2008-05-15 18:37:26 UTC - RP12 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Bill Hayes.exe) ------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:12:11 PM, on 5/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmona.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe C:\WINDOWS\system32\aspimgr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PGPserv.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Bill Hayes\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Bill Hayes.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [lanmanwrk.exe clean] C:\WINDOWS\System32\lanmanwrk.exe clean O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: PGPtray.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1177626662593 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E13B48C0-51FF-491E-9BE8-0C4C9FD013A1}: NameServer = 71.242.0.12 71.252.0.12 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: lvJnHlYQEX - {903E3064-3A94-9ACE-ADFC-7A0891B51B04} - C:\WINDOWS\system32\qf.dll O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe -- End of file - 8490 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 PGPwded (PGPwded Storage Filter Service) - c:\windows\system32\drivers\pgpwded.sys <Not Verified; PGP Corporation; PGP> R1 ATMhelpr - c:\windows\system32\drivers\atmhelpr.sys <Not Verified; Adobe Systems Incorporated; Adobe Type Manager Deluxe> R1 lanmandrv - c:\windows\system32\lanmandrv.sys R2 PGPdisk - c:\windows\system32\drivers\pgpdisk.sys <Not Verified; PGP Corporation; PGP> R2 PGPsdkDriver - c:\windows\system32\drivers\pgpsdk.sys <Not Verified; PGP Corporation; PGPsdk> R3 sysrest.sys - c:\windows\system32\sysrest.sys S0 epstwnt - c:\windows\system32\drivers\epstwnt.mpd <Not Verified; Shuttle Technology.; Shuttle Miniport Driver for SCSI Devices> S2 SHARSHTL (Shuttle Sharer) - c:\windows\system32\drivers\sharshtl.sys <Not Verified; Shuttle Technology; Shuttle Printer Sharer for Windows NT> S2 YLBWBVPM - c:\windows\system32\ylbwbvpm.ycs (file missing) S3 MREMPR5 (MREMPR5 NDIS Protocol Driver) - c:\program files\common files\motive\mrempr5.sys <Not Verified; Motive, Inc.; Motive Rawether for Windows> S3 MRENDIS5 (MRENDIS5 NDIS Protocol Driver) - c:\program files\common files\motive\mrendis5.sys <Not Verified; Motive, Inc.; Motive Rawether for Windows> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 a2AntiMalware (a-squared Anti-Malware Service) - "c:\program files\a-squared anti-malware\a2service.exe" <Not Verified; Emsi Software GmbH; a-squared> R2 aspimgr (Microsoft ASPI Manager) - c:\windows\system32\aspimgr.exe R2 PGPserv - c:\windows\system32\pgpserv.exe <Not Verified; PGP Corporation; PGPsdk> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-13 05:30:00 372 --a------ C:\WINDOWS\Tasks\McAfee AntiSpyware.job 2008-05-09 18:30:00 360 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D3K89Z81-Bill Hayes).job -- Files created between 2008-04-15 and 2008-05-15 ----------------------------- 2008-05-15 15:11:15 0 d-------- C:\Program Files\Trend Micro 2008-05-15 14:43:12 0 d-------- C:\bbf34f5904ad1f444c132e81 2008-05-15 14:39:25 0 d-------- C:\843b1a606d7918e073e8bebe2c 2008-05-15 14:21:52 0 d-------- C:\de4785478ad390262716999c95840d 2008-05-15 13:34:24 0 d-------- C:\WINDOWS\system32\CatRoot_bak 2008-05-15 12:47:28 0 d-------- C:\ie-spyad_zo 2008-05-15 12:40:59 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-15 12:40:55 0 d-------- C:\Program Files\SpywareBlaster 2008-05-14 17  11 233472 --a------ C:\WINDOWS\system32\Ilda32.dll <Not Verified; Creative Development LTD; >2008-05-14 17 11 18944 --a------ C:\WINDOWS\system32\BORLNDMM.DLL <Not Verified; Inprise Corporation; Borland Memory Manager>2008-05-14 17 10 0 d-------- C:\Program Files\CoffeeCup Software2008-05-14 12:59:19 0 d-------- C:\Program Files\Panda Security 2008-05-14 10:33:05 0 d-------- C:\Documents and Settings\Bill Hayes\Application Data\WinIFixer.com 2008-05-14 10:33:02 0 d-------- C:\Program Files\WinIFixer 2008-05-14 09:12:24 44032 --a------ C:\WINDOWS\system32\KernelDrv.exe 2008-05-14 09:12:12 0 --a------ C:\WINDOWS\system32\ksvcl.dll 2008-05-14 09:12:12 607 --a------ C:\WINDOWS\system32\kcopt.dll 2008-05-14 09:12:08 44032 --a------ C:\WINDOWS\system32\56392.exe 2008-05-14 09:04:50 18432 --a------ C:\WINDOWS\86653.exe 2008-05-14 08:53:12 96256 --a------ C:\WINDOWS\system32\11qqaasswww.exe 2008-05-14 08:53:08 135168 --a------ C:\WINDOWS\system32\8723rhiu.exe 2008-05-14 08:43:04 724 --a------ C:\WINDOWS\system32\qmopt.dll 2008-05-14 08:42:56 73728 --a------ C:\WINDOWS\system32\aspimgr.exe 2008-05-14 08:42:52 160256 --a------ C:\WINDOWS\system32\blackster.scr <Not Verified; Peter's Productions; Bugs!> 2008-05-14 08:42:46 96256 --a------ C:\WINDOWS\11qqaasswww.exe 2008-05-14 08:42:38 96256 --a------ C:\WINDOWS\system32\ctfmona.exe 2008-05-14 08:42:36 114176 --a------ C:\WINDOWS\system32\nvrsma.dll 2008-05-14 08:42:34 135168 --a------ C:\WINDOWS\system32\ntpl.bin 2008-05-12 12:21:19 0 d-------- C:\my documents -- Find3M Report --------------------------------------------------------------- 2008-05-15 14:47:24 0 d-------- C:\Documents and Settings\Bill Hayes\Application Data\Skype 2008-05-14 08:42:36 577536 --a------ C:\WINDOWS\system32\user32.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-05-13 15:43:18 6331 --a----c- C:\WINDOWS\mozver.dat 2008-03-19 05:47:00 1845248 --a------ C:\WINDOWS\system32\win32k.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-05 15:32:36 1080 --a------ C:\WINDOWS\AUTOLNCH.REG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [12/08/2005 09:15 PM] "MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [01/11/2006 01:05 PM] "MCAgentExe"="C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" [09/22/2005 07:29 PM] "Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [03/11/2007 05:37 PM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/07/2007 01:36 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [05/14/2008 08:42 AM] "lanmanwrk.exe"="" [] "WinIFixer"="C:\Program Files\WinIFixer\WinIFixer.exe" [04/26/2008 07:43 AM] "WinIFixer"="C:\Program Files\WinIFixer\WinIFixer.exe" [04/26/2008 07:43 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [03/30/2007 01:34 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/23/2007 02:09 PM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 06:43 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ PGPtray.exe.lnk - C:\WINDOWS\Installer\{036D7BD4-1E9F-49C2-A25D-1B78369E95F3}\Icon6560581611.exe [3/16/2006 12:44:36 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "lvJnHlYQEX"= {903E3064-3A94-9ACE-ADFC-7A0891B51B04} - C:\WINDOWS\system32\qf.dll [04/16/2007 11:52 AM 32768] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=OCMAPIHK.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup] c:\program files\mcafee.com\shared\mcappins.exe /v=3 /cleanup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Lamp] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpppt] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppt.exe /ICON [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Pml Driver HPZ12"=3 (0x3) "PGPserv"=2 (0x2) "NetSvc"=3 (0x3) "mcupdmgr.exe"=3 (0x3) "McTskshd.exe"=2 (0x2) "McDetect.exe"=2 (0x2) "AOL ACS"=2 (0x2) -- End of Deckard's System Scanner: finished at 2008-05-15 15:12:53 ------------ |
|
|
|
|
05-15-2008, 01:41 PM
|
#4 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
I forgot to mention that my system would not allow me to update Windows service pack 3
c:\windows\system32\services.exe is open or in use with another program. I've called to supplier who appears to have their website cleaned now if I can get any updates on what they had. Thanks |
|
|
|
|
05-16-2008, 08:14 AM
|
#5 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
I also noticed that the warning sign on my desktop was created by the program. It ads a file "ctfmonb" to my desktop themes on startup. If I switch desktop themes it appears as though there are no longer any bugs eating the screen when the screensaver stars
|
|
|
|
|
05-16-2008, 08:50 AM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,707
OS: 2000 Pro; XP Pro; XP Home
|
Re: Adware.W32.spyshredder
Hello -
You don't appear to have a dedicated AntiVirus application installed on this machine. Why is that? Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer. We will address that in the course of this fix, a bit later. ewido anti-spyware 4.0 is oudated, and no longer supported. You may want to consider uninstalling it. AVG Anti-Spyware 7.5 will only be supported til the end of this year. AVG Anti-Spyware 7.5 has been rolled into AVG AntiVirus suite. Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-16-2008, 11:41 AM
|
#7 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
It won't let me install the Recovery Console
X:\i386 refers to a location that is unavailable. It could be on a hard drive or network. Check to make sure that the disk is properly installed or that you are connected to the internet (It is and I am). It continues to say if it cannot be located it may be moved to a different location?? |
|
|
|
|
05-16-2008, 11:46 AM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,707
OS: 2000 Pro; XP Pro; XP Home
|
Re: Adware.W32.spyshredder
You're apparently attempting to install Recovery Console from disk, and have not used the correct drive letter for your CDROM drive.
It's easier to just use ComboFix to install the Recovery Console. You have Microsoft Windows XP Home Edition Service Pack 2 Download the file from this page: http://www.microsoft.com/downloads/d...displaylang=en Download the file & save it as it's originally named, next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. When complete, you will see the screen as presented in my last post. Click on Yes to continue
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-16-2008, 12:13 PM
|
#9 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Thanks, here it is
ComboFix 08-05-15.3 - Bill Hayes 2008-05-16 14:02:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.507 [GMT -4:00] Running from: C:\Documents and Settings\Bill Hayes\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Bill Hayes\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Bill Hayes\Application Data\WinIFixer.com C:\Program Files\WinIFixer C:\Program Files\WinIFixer\MFC71.dll C:\Program Files\WinIFixer\MFC71ENU.DLL C:\Program Files\WinIFixer\msvcp71.dll C:\Program Files\WinIFixer\msvcr71.dll C:\Program Files\WinIFixer\WinIFixer.exe C:\Program Files\WinIFixer\WinIFixerSkin.dll C:\WINDOWS\86653.exe C:\WINDOWS\Downloaded Program Files\ODCTOOLS C:\WINDOWS\g32.txt C:\WINDOWS\s32.txt C:\WINDOWS\system32\56392.exe C:\WINDOWS\system32\aspimgr.exe C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\ctfmona.exe C:\WINDOWS\system32\icqmlib.exe C:\WINDOWS\system32\iepref32.dll C:\WINDOWS\system32\ierplc.dll C:\WINDOWS\system32\ips.dll C:\WINDOWS\system32\kcopt.dll C:\WINDOWS\system32\KernelDrv.exe C:\WINDOWS\system32\ksvcl.dll C:\WINDOWS\system32\lanmandrv.sys C:\WINDOWS\system32\lanmanwrk.exe C:\WINDOWS\system32\laprxy.dllexe C:\WINDOWS\system32\nvrsma.dll C:\WINDOWS\system32\ocxapi.dll C:\WINDOWS\system32\ocxloader.exe C:\WINDOWS\system32\qmopt.dll C:\WINDOWS\ws386.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ASPIMGR -------\Legacy_LANMANDRV -------\Legacy_SYSREST.SYS -------\Service_aspimgr -------\Service_lanmandrv -------\Service_sysrest.sys ((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 ))))))))))))))))))))))))))))))) . 2008-05-15 17:58 . 2008-05-15 17:58 96,256 --a------ C:\WINDOWS\yyy6677euuun.exe 2008-05-15 15:11 . 2008-05-15 15:11 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-15 15:08 . 2008-05-15 15:08 <DIR> d-------- C:\Deckard 2008-05-15 14:21 . 2008-05-15 14:22 <DIR> d-------- C:\de4785478ad390262716999c95840d 2008-05-15 13:34 . 2008-05-15 14:45 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-05-15 13:09 . 2008-05-15 20:12 15,328 --a------ C:\WINDOWS\system32\sysrest.sys 2008-05-15 12:47 . 2008-05-15 12:47 <DIR> d-------- C:\ie-spyad_zo 2008-05-15 12:40 . 2008-05-15 12:42 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-15 12:40 . 2008-05-15 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-15 12:40 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-05-15 11:45 . 2008-05-14 23:45 160,256 --a------ C:\WINDOWS\system32\145.tmp 2008-05-14 23:46 . 2008-05-14 23:45 23,040 --a------ C:\WINDOWS\system32\sysrest32.exe 2008-05-14 23:45 . 2008-05-14 10:44 160,256 --a------ C:\WINDOWS\system32\137.tmp 2008-05-14 17:06 . 2008-05-15 12:13 <DIR> d-------- C:\Program Files\CoffeeCup Software 2008-05-14 17:06 . 2004-11-22 20:56 913,560 --a------ C:\WINDOWS\system32\wodFtpDLX.ocx 2008-05-14 17:06 . 1999-03-22 12:29 233,472 --a------ C:\WINDOWS\system32\Ilda32.dll 2008-05-14 17:06 . 1998-06-17 04:00 18,944 --a------ C:\WINDOWS\system32\BORLNDMM.DLL 2008-05-14 17:06 . 2008-05-15 12:13 13 --a------ C:\WINDOWS\system32\WinSys32.crc 2008-05-14 12:59 . 2008-05-14 13:09 <DIR> d-------- C:\Program Files\Panda Security 2008-05-14 08:53 . 2008-05-14 08:53 135,168 --a------ C:\WINDOWS\system32\8723rhiu.exe 2008-05-14 08:53 . 2008-05-14 08:53 96,256 --a------ C:\WINDOWS\system32\11qqaasswww.exe 2008-05-14 08:42 . 2008-05-15 20:05 269,334 --a------ C:\WINDOWS\system32\ctfmonb.bmp 2008-05-14 08:42 . 2008-05-16 09:07 160,256 --a------ C:\WINDOWS\system32\blackster.scr 2008-05-14 08:42 . 2008-05-14 08:56 135,168 --a------ C:\WINDOWS\system32\ntpl.bin 2008-05-14 08:42 . 2008-05-14 15:27 96,256 --a------ C:\WINDOWS\11qqaasswww.exe 2008-05-14 08:42 . 2008-05-14 08:42 54,784 --a------ C:\WINDOWS\system32\lght.ln 2008-05-14 08:42 . 2008-05-14 08:42 32,768 --a------ C:\WINDOWS\system32\pryx.ln 2008-05-12 12:21 . 2008-05-12 12:21 <DIR> d-------- C:\my documents . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-16 17:59 --------- d-----w C:\Documents and Settings\Bill Hayes\Application Data\Skype 2007-06-16 17:19 630,784 -c--a-w C:\Documents and Settings\Bill Hayes\GoToAssist_chat2way__317_en.exe 2006-07-19 17:38 557,056 -c--a-w C:\Documents and Settings\Bill Hayes\chatlnk.exe 2006-03-04 22:00 3,631 -c--a-w C:\Program Files\NEW SHOP HOURS.doc 2006-01-18 22:26 774,144 -c--a-w C:\Program Files\RngInterstitial.dll 2007-12-10 22:37 104 --sh--r C:\WINDOWS\system32\6756BD854E.sys 2007-12-10 22:37 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . Infected C:\WINDOWS\system32\user32.dll hex repaired ------- Sigcheck ------- 2004-08-04 07:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\backup\svchost.exe md5deep: C:\WINDOWS\system32\svchost.exe: error at offset 0: Permission denied 2004-08-04 07:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\backup\winlogon.exe md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied 2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-04 07:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2004-08-04 07:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\backup\explorer.exe 2004-08-04 07:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\backup\services.exe md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied 2004-08-04 07:00 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\backup\lsass.exe md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-03-30 13:34 25263144] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 14:09 68856] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-08 21:15 98304] "MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [2006-01-11 13:05 212992] "MCAgentExe"="C:\PROGRA~1\McAfee.com\Agent\McAgent.exe" [2005-09-22 19:29 303104] "Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-03-11 17:37 936960] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-07 13:36 185632] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ PGPtray.exe.lnk - C:\WINDOWS\Installer\{036D7BD4-1E9F-49C2-A25D-1B78369E95F3}\Icon6560581611.exe [2006-03-16 12:44:36 55296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "lvJnHlYQEX"= {903E3064-3A94-9ACE-ADFC-7A0891B51B04} - C:\WINDOWS\system32\qf.dll [2007-04-16 11:52 32768] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=OCMAPIHK.DLL [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup] --a--c--- 2005-10-07 13:28 131072 c:\program files\mcafee.com\shared\mcappins.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] C:\Program Files\Dell Support\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a--c--- 2004-12-06 03:05 127035 C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] -----c--- 2005-02-23 18:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Lamp] --a--c--- 1998-11-24 03:00 43520 C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a--c--- 2003-07-25 10:14 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpppt] --a--c--- 1998-11-24 03:00 106496 C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a--c--- 2005-07-20 01:06 77824 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a--c--- 2005-07-20 01:10 114688 C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] --a--c--- 2005-07-20 01:09 94208 C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a--c--- 2005-06-10 12:44 249856 c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a--c--- 2005-06-10 12:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] --a------ 2005-09-22 19:29 303104 c:\PROGRA~1\mcafee.com\agent\mcagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] --a------ 2006-01-11 13:05 212992 c:\PROGRA~1\mcafee.com\agent\mcupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] --a--c--- 2005-09-08 21:20 8192 C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] --a--c--- 2005-09-08 21:20 110592 C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] --a--c--- 2005-08-12 17:16 1121792 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-12-08 21:15 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2007-11-07 13:37 214608 C:\Program Files\Real\RealPlayer\RealPlay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a--c--- 2005-03-23 02:20 339968 C:\WINDOWS\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2003-11-19 19:48 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Pml Driver HPZ12"=3 (0x3) "PGPserv"=2 (0x2) "NetSvc"=3 (0x3) "mcupdmgr.exe"=3 (0x3) "McTskshd.exe"=2 (0x2) "McDetect.exe"=2 (0x2) "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\WINDOWS\\system32\\sysrest32.exe"= R0 PGPwded;PGPwded Storage Filter Service;C:\WINDOWS\system32\drivers\PGPwded.sys [2005-12-16 19:12] R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys [1997-06-17 05:00] R2 PGPdisk;PGPdisk;C:\WINDOWS\system32\drivers\PGPdisk.sys [2005-12-16 19:15] R2 PGPsdkDriver;PGPsdkDriver;C:\WINDOWS\system32\Drivers\PGPsdk.sys [2005-12-16 19:12] S0 epstwnt;epstwnt;C:\WINDOWS\system32\Drivers\epstwnt.mpd [1998-10-28 13:49] S2 SHARSHTL;Shuttle Sharer;C:\WINDOWS\system32\Drivers\sharshtl.sys [1998-08-12 03:41] S2 YLBWBVPM;YLBWBVPM;C:\WINDOWS\system32\ylbwbvpm.ycs [] . Contents of the 'Scheduled Tasks' folder "2008-05-13 09:30:00 C:\WINDOWS\Tasks\McAfee AntiSpyware.job" - c:\progra~1\mcafee\MCAFEE~1\MASCon.exe "2008-05-09 22:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D3K89Z81-Bill Hayes).job" - c:\program files\mcafee.com\vso\mcmnhdlr.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-16 14:05:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\epstwnt] "ImagePath"="System32\Drivers\epstwnt.mpd" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\YLBWBVPM] "ImagePath"="\??\C:\WINDOWS\system32\ylbwbvpm.ycs" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\a-squared Anti-Malware\a2service.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PGPserv.exe . ************************************************************************** . Completion time: 2008-05-16 14:09:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-16 18:09:13 Pre-Run: 59,967,750,144 bytes free Post-Run: 60,121,444,352 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 259 --- E O F --- 2008-04-17 19:25:31 |
|
|
|
|
05-16-2008, 12:29 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,707
OS: 2000 Pro; XP Pro; XP Home
|
Re: Adware.W32.spyshredder
Post a new HijackThis log, please.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-16-2008, 12:32 PM
|
#11 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:45 PM, on 5/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PGPserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [lanmanwrk.exe clean] C:\WINDOWS\System32\lanmanwrk.exe clean O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: PGPtray.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1177626662593 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E13B48C0-51FF-491E-9BE8-0C4C9FD013A1}: NameServer = 71.242.0.12 71.252.0.12 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: lvJnHlYQEX - {903E3064-3A94-9ACE-ADFC-7A0891B51B04} - C:\WINDOWS\system32\qf.dll O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe -- End of file - 8291 bytes |
|
|
|
|
05-16-2008, 12:39 PM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,707
OS: 2000 Pro; XP Pro; XP Home
|
Re: Adware.W32.spyshredder
It looks like McAfee used to be installed, but is no longer. Is that correct?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
05-16-2008, 12:44 PM
|
#13 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Correct. It interfered with my Credit Card decryption program, PGP, which also now seems a little disabled??
I try to be very careful, and have run housecall several times, replaced ewido with AVG etc. first problem i've had in almost 3 years?? |
|
|
|
|
05-16-2008, 12:53 PM
|
#14 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,707
OS: 2000 Pro; XP Pro; XP Home
|
Re: Adware.W32.spyshredder
Ok. There are parts of it still showing, so we'll fix them before installing a new AV.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. You can read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? ==================================== Ewido AntiSpyware is no longer supported, was replaced by AVG AntiSpyware, and therefore is unnecessarily using system resources. Uninstall ewido anti-spyware 4.0 from Add or Remove Programs. Next.....................
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
05-16-2008, 02:00 PM
|
#15 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Avira AntiVir Personal
Report file date: Friday, May 16, 2008 15:29 Scanning for 1276115 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: D3K89Z81 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 15:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 14:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 14:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 14:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 16:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 19:08:58 ANTIVIR2.VDF : 7.0.4.0 1554432 Bytes 5/5/2008 19:25:04 ANTIVIR3.VDF : 7.0.4.52 329728 Bytes 5/16/2008 19:25:21 Engineversion : 8.1.0.46 AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 15:58:21 AESCRIPT.DLL : 8.1.0.33 266618 Bytes 5/16/2008 19:26:30 AESCN.DLL : 8.1.0.18 119156 Bytes 5/16/2008 19:26:25 AERDL.DLL : 8.1.0.20 418165 Bytes 5/16/2008 19:26:20 AEPACK.DLL : 8.1.1.5 364918 Bytes 5/16/2008 19:26:13 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 5/16/2008 19:26:06 AEHEUR.DLL : 8.1.0.29 1253750 Bytes 5/16/2008 19:26:01 AEHELP.DLL : 8.1.0.14 115063 Bytes 5/16/2008 19:25:41 AEGEN.DLL : 8.1.0.21 303477 Bytes 5/16/2008 19:25:38 AEEMU.DLL : 8.1.0.6 430451 Bytes 5/16/2008 19:25:33 AECORE.DLL : 8.1.0.29 168311 Bytes 5/16/2008 19:25:25 AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/23/2008 23:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 16:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 19:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 1/23/2008 23:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 14:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 14:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 23:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/23/2008 23:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 18:05:10 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 20:37:25 RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 18:02:11 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Friday, May 16, 2008 15:29 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'infocard.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PGPserv.exe' - '1' Module(s) have been scanned Scan process 'MDM.EXE' - '1' Module(s) have been scanned Scan process 'guard.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'skypePM.exe' - '1' Module(s) have been scanned Scan process 'PGPtray.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned Scan process 'Skype.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'McciTrayApp.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Module is infected -> 'C:\WINDOWS\system32\winlogon.exe' Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 35 processes with 35 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] The device is not ready. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '20' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\.tt13A.tmp [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '48a1e19c.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\.tt5.tmp.vbs [DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002 [NOTE] The file was moved to '48a1e19f.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\.tt9.tmp [DETECTION] Contains detection pattern of the dropper DR/FraudTool.WinFixer.F.8 [NOTE] The file was moved to '48a1e1a1.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\dJee.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '4892e17c.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\RaQV.exe [0] Archive type: RSRC --> Object [1] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '487ee197.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\rsyncini.exe [DETECTION] Is the Trojan horse TR/Shutdowner.EM [NOTE] The file was moved to '48a6e1ab.qua'! C:\Deckard\System Scanner\backup\DOCUME~1\BILLHA~1\LOCALS~1\Temp\swXF.exe [0] Archive type: RSRC --> Object [1] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '4885e1b1.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\fvvcjpsy.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\fvvcjpsy.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.F.Gen [NOTE] The file was moved to '48a3e1ca.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\jkaspcll.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\jkaspcll.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Dldr.Botol.C.1 [NOTE] The file was moved to '488ee1c1.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\osuufppx.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\osuufppx.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.F.Gen [NOTE] The file was moved to '48a2e1cb.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\system32fab.exe.bac_a02128 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\system32fab.exe.bac_a02128 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '48a0e1d3.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\system32fab.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\system32fab.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '48a0e1d5.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\winblsrv.dll.bac_a02128 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\winblsrv.dll.bac_a02128 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '489be1c7.qua'! C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\winblsrv.dll.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall\Quarantine\winblsrv.dll.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '489be1c9.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\fvvcjpsy.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\fvvcjpsy.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.F.Gen [NOTE] The file was moved to '48a3e1d9.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\jkaspcll.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\jkaspcll.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Dldr.Botol.C.1 [NOTE] The file was moved to '488ee1d0.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\osuufppx.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\osuufppx.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.F.Gen [NOTE] The file was moved to '48a2e1da.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\system32fab.exe.bac_a02128 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\system32fab.exe.bac_a02128 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '48a0e1e1.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\system32fab.exe.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\system32fab.exe.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '48a0e1e3.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\winblsrv.dll.bac_a02128 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\winblsrv.dll.bac_a02128 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '489be1d5.qua'! C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\winblsrv.dll.bac_a02652 [0] Archive type: HIDDEN --> FIL\\\?\C:\Documents and Settings\Bill Hayes\.housecall6.6\Quarantine\winblsrv.dll.bac_a02652 [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen [NOTE] The file was moved to '489be1d7.qua'! C:\Documents and Settings\Bill Hayes\Desktop\[4]-Submit_2008-05-16@15.01.zip [0] Archive type: ZIP --> 11qqaasswww.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen --> 11qqaasswww.exe.1 [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen --> 8723rhiu.exe [1] Archive type: RSRC --> Object [2] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 --> lght.ln [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> ntpl.bin [1] Archive type: RSRC --> Object [2] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 --> pryx.ln [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 --> qf.dll [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen --> sysrest.sys [DETECTION] Is the Trojan horse TR/Rootkit.Gen --> sysrest32.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen --> yyy6677euuun.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '488ae1f0.qua'! C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '4898e58a.qua'! C:\QooBox\Quarantine\catchme2008-05-16_140414.37.zip [0] Archive type: ZIP --> lanmandrv.sys [DETECTION] Is the Trojan horse TR/Agent.kcr --> lanmanwrk.exe [DETECTION] Is the Trojan horse TR/Agent.lpy [NOTE] The file was moved to '48a1e600.qua'! C:\QooBox\Quarantine\C\Program Files\WinIFixer\WinIFixer.exe.vir [DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.WinFixer.F [NOTE] The file was moved to '489be613.qua'! C:\QooBox\Quarantine\C\WINDOWS\86653.exe.vir [DETECTION] Is the Trojan horse TR/Agent.lpy [NOTE] The file was moved to '4863e5e4.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\56392.exe.vir [DETECTION] Is the Trojan horse TR/Spy.ZBot.CD.3 [NOTE] The file was moved to '4860e5ec.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\ctfmona.exe.vir [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '4893e62d.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\KernelDrv.exe.vir [DETECTION] Is the Trojan horse TR/Spy.ZBot.CD.3 [NOTE] The file was moved to '489fe620.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\lanmanwrk.exe.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was moved to '489be61e.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\nvrsma.dll.vir [0] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '489fe635.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\qf.dll.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was moved to '485be628.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000496.exe [DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.WinFixer.F [NOTE] The file was moved to '485de5fb.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000502.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '485de5fd.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000503.dll [0] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '485de5ff.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000505.exe [DETECTION] Is the Trojan horse TR/Spy.ZBot.CD.3 [NOTE] The file was moved to '485de601.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000507.exe [DETECTION] Is the Trojan horse TR/Agent.lpy [NOTE] The file was moved to '485de602.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000508.exe [DETECTION] Is the Trojan horse TR/Spy.ZBot.CD.3 [NOTE] The file was moved to '485de604.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP16\A0000514.exe [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was moved to '485de606.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP17\A0000597.dll [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was moved to '485de60a.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000774.vbs [DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002 [NOTE] The file was moved to '485de616.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000775.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '485de61a.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000776.exe [0] Archive type: RSRC --> Object [1] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '485de61c.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000777.exe [DETECTION] Is the Trojan horse TR/Shutdowner.EM [NOTE] The file was moved to '485de61e.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000778.exe [0] Archive type: RSRC --> Object [1] Archive type: RSRC --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.9 --> Object [DETECTION] Is the Trojan horse TR/Spy.Agent.cad.8 [NOTE] The file was moved to '485de620.qua'! C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP18\A0000779.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '485de622.qua'! C:\WINDOWS\system32\winlogon.exe [DETECTION] Is the Trojan horse TR/Patched.AA.18 [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] End of the scan: Friday, May 16, 2008 16:00 Used time: 30:50 min The scan has been done completely. 6452 Scanning directories 311882 Files were scanned 66 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 46 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 311816 Files not concerned 6381 Archives were scanned 4 Warnings 46 Notes |
|
|
|
|
05-16-2008, 02:03 PM
|
#16 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:20 PM, on 5/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PGPserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: PGPtray.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1177626662593 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E13B48C0-51FF-491E-9BE8-0C4C9FD013A1}: NameServer = 71.242.0.12 71.252.0.12 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe -- End of file - 8500 bytes |
|
|
|
|
05-16-2008, 03:11 PM
|
#19 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
Avira AntiVir Personal
Report file date: Friday, May 16, 2008 16:36 Scanning for 1276115 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: D3K89Z81 Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 15:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 14:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 14:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 14:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 16:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 19:08:58 ANTIVIR2.VDF : 7.0.4.0 1554432 Bytes 5/5/2008 19:25:04 ANTIVIR3.VDF : 7.0.4.52 329728 Bytes 5/16/2008 19:25:21 Engineversion : 8.1.0.46 AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 15:58:21 AESCRIPT.DLL : 8.1.0.33 266618 Bytes 5/16/2008 19:26:30 AESCN.DLL : 8.1.0.18 119156 Bytes 5/16/2008 19:26:25 AERDL.DLL : 8.1.0.20 418165 Bytes 5/16/2008 19:26:20 AEPACK.DLL : 8.1.1.5 364918 Bytes 5/16/2008 19:26:13 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 5/16/2008 19:26:06 AEHEUR.DLL : 8.1.0.29 1253750 Bytes 5/16/2008 19:26:01 AEHELP.DLL : 8.1.0.14 115063 Bytes 5/16/2008 19:25:41 AEGEN.DLL : 8.1.0.21 303477 Bytes 5/16/2008 19:25:38 AEEMU.DLL : 8.1.0.6 430451 Bytes 5/16/2008 19:25:33 AECORE.DLL : 8.1.0.29 168311 Bytes 5/16/2008 19:25:25 AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/23/2008 23:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 16:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 19:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 1/23/2008 23:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 14:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 14:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 23:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/23/2008 23:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 18:05:10 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 20:37:25 RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 18:02:11 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Friday, May 16, 2008 16:36 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'OUTLOOK.EXE' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PGPserv.exe' - '1' Module(s) have been scanned Scan process 'MDM.EXE' - '1' Module(s) have been scanned Scan process 'guard.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'skypePM.exe' - '1' Module(s) have been scanned Scan process 'PGPtray.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned Scan process 'Skype.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'avgas.exe' - '1' Module(s) have been scanned Scan process 'apdproxy.exe' - '1' Module(s) have been scanned Scan process 'McciTrayApp.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Module is infected -> 'C:\WINDOWS\system32\winlogon.exe' Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 35 processes with 35 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] The device is not ready. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '20' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\winlogon.exe [DETECTION] Is the Trojan horse TR/Patched.AA.18 [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] End of the scan: Friday, May 16, 2008 17:09 Used time: 32:41 min The scan has been done completely. 6459 Scanning directories 312354 Files were scanned 2 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 312352 Files not concerned 6380 Archives were scanned 4 Warnings 0 Notes |
|
|
|
|
05-16-2008, 03:40 PM
|
#20 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 36
OS: Win XP
|
Re: Adware.W32.spyshredder
i also still cannot get the service pack 3 to install.
set up cannot copy the winlogon.exe. It's trying to copy from c:\windows\system32, and asking me if this is not correct to specify the drive I want it in?? |
|
|
|
| Thread Tools | |
|
|
