|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-15-2008, 10:57 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Windows XP
|
Popups, Spikes and Lag...Tried a lot nothin working!
Howdy partners...
Well I've tried AVG Adaware ZoneAlarm S&D, etc...Nothing seems to be able to catch this adware or virus. I get popups from IE when using Firefox, for random stuff, one just opened now for "Leadsandfeeds.com". When I play Warcraft, I get terrible spikes and eventually disconnect. When I use firefox every 3 or 5 minutes I get a good lag spike for about 20 seconds. The only thing that worked was using Zone Alarm to block IE from opening, and that worked decent but it still lagged and disc. me from games. When I startup my computer I get about 4 errors, 3 of them .DLL errors, which I google'd and couldn't find, and one that says my SQL Server is corrupt. I think that's about all I can t - here's another for "Ovguide.com" - can think of. Truly appreciate the help! If I messed up the attachments or didn't post something please tell me and I'll fix it asap. Also, I remember I was seeing E?plorer.exe? in my task manager for a while, but I might have fixed it. Thanks for the help! | | | V Deckard's System Scanner v20071014.68 Run by john on 2008-05-15 11:26:37 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- -- Last 5 Restore Point(s) -- 5: 2008-05-15 08:58:48 UTC - RP5 - Deckard's System Scanner Restore Point 4: 2008-05-15 06:20:34 UTC - RP4 - Removed Half-Life(R) 2 3: 2008-05-15 06:19:33 UTC - RP3 - Removed HP Software Update 2: 2008-05-15 06:19:30 UTC - RP2 - Removed HPSU306Stub 1: 2008-05-15 06:16:14 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as john.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:27:43 AM, on 5/15/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Documents and Settings\john\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\john.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [4018d0aa] rundll32.exe "C:\WINDOWS\system32\vdrtuecm.dll",b O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BM432be336] Rundll32.exe "C:\WINDOWS\system32\etjnawqb.dll",s O4 - HKLM\..\Run: [DellHelp] C:\Dell\DellHelp\DellHelp.exe /c O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [j3291530] rundll32 C:\WINDOWS\system32\j3291530.dll sook O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NoDNS] C:\Program Files\\NoDNS\\NoDNS.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSSQL$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SQLAgent$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 4404 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080418-125235-826 O4 - HKCU\..\Run: [Kujfirzp] "C:\Program Files\Common Files\M?crosoft\e?plorer.exe" backup-20080418-125235-909 O4 - HKCU\..\Run: [Qiepgyzt] "C:\Program Files\?icrosoft.NET\?ervices.exe" backup-20080421-095002-321 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz backup-20080421-095123-162 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ backup-20080421-095123-256 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com backup-20080421-095123-382 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html backup-20080421-095123-434 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ backup-20080421-095123-619 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html backup-20080421-095340-955 O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) backup-20080421-095341-202 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) backup-20080421-095341-539 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) backup-20080421-095342-278 O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll backup-20080421-095408-153 O2 - BHO: (no name) - {2B0B59B4-55A3-4737-9FD5-B93C6430BF75} - C:\WINDOWS\system32\suwavchq.dll (file missing) backup-20080421-095408-154 O2 - BHO: {79ef4b79-2736-dc1b-1cf4-68b3f109c865} - {568c901f-3b86-4fc1-b1cd-637297b4fe97} - C:\WINDOWS\system32\ihluuaeu.dll (file missing) backup-20080421-095408-377 O2 - BHO: (no name) - {7844C853-B42E-48DF-B41C-CD1DF5BAEFA9} - C:\WINDOWS\system32\gebya.dll (file missing) backup-20080421-095408-458 O2 - BHO: (no name) - {6EB43240-EDB3-4538-AFF6-D4D6A9A078Df} - C:\WINDOWS\system32\ovtrrhwh.dll (file missing) backup-20080421-095408-525 O2 - BHO: (no name) - {ED120D76-BF31-412C-A99B-783C6676E128} - C:\WINDOWS\system32\efccayy.dll (file missing) backup-20080421-095408-725 O2 - BHO: (no name) - {38629BE5-5424-5DF9-5362-2E00B9CCDBE8} - C:\WINDOWS\system32\ifyyhyt.dll (file missing) backup-20080421-095408-733 O2 - BHO: (no name) - {75E567E8-87A6-4D3B-93B5-A7CC72F1375E} - C:\WINDOWS\system32\ddabx.dll (file missing) backup-20080421-095408-890 O2 - BHO: (no name) - {38629B9F-5456-5DFC-5310-2E00CECFDBE8} - C:\WINDOWS\system32\ifyyhyt.dll (file missing) backup-20080421-095513-322 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 backup-20080421-095513-400 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll backup-20080421-095514-542 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL backup-20080421-095514-747 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll backup-20080421-095514-882 O20 - Winlogon Notify: efccayy - efccayy.dll (file missing) backup-20080421-095515-221 O20 - Winlogon Notify: fccbyvs - fccbyvs.dll (file missing) backup-20080421-095515-366 O20 - Winlogon Notify: gltzccok - gltzccok.dll (file missing) backup-20080421-095515-512 O20 - Winlogon Notify: gebya - C:\WINDOWS\system32\gebya.dll (file missing) backup-20080421-095606-127 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) backup-20080421-095606-240 O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) backup-20080421-095606-477 O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe backup-20080515-031556-436 O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized backup-20080515-031630-291 O4 - HKCU\..\Run: [nvcoi] C:\Program Files\nvcoi\nvcoi.exe backup-20080515-031630-423 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background backup-20080515-031630-622 O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER backup-20080515-031630-654 O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent backup-20080515-031630-832 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R1 VOLSNAPP - c:\windows\system32\drivers\volsnapp.sys R3 smwdm - c:\windows\system32\drivers\smwdm.sys <Not Verified; Analog Devices, Inc.; SoundMAX Digital Audio Driver> S1 AVG Anti-Spyware Driver - c:\program files\grisoft\avg anti-spyware 7.5\guard.sys (file missing) S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S3 RT73 (Linksys Home Wireless-G USB Adapter Driver) - c:\windows\system32\drivers\rt73.sys <Not Verified; Ralink Technology, Corp.; Ralink 802.11 Wireless Adapters> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 AVG Anti-Spyware Guard - c:\program files\grisoft\avg anti-spyware 7.5\guard.exe (file missing) S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing) S2 MSSQL$MICROSOFTBCM - c:\program files\microsoft sql server\mssql$microsoftbcm\binn\sqlservr.exe -smicrosoftbcm (file missing) S3 SQLAgent$MICROSOFTBCM - c:\program files\microsoft sql server\mssql$microsoftbcm\binn\sqlagent.exe -i microsoftbcm (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: Description: USB Device Device ID: USB\VID_13B1&PID_0020\5&3975C876&0&4 Manufacturer: Name: USB Device PNP Device ID: USB\VID_13B1&PID_0020\5&3975C876&0&4 Service: -- Files created between 2008-04-15 and 2008-05-15 ----------------------------- 2008-05-15 03:51:39 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-15 03:51:34 0 d-------- C:\Program Files\SpywareBlaster 2008-05-15 03:04:41 0 d-------- C:\Program Files\Panda Security 2008-05-15 01:20:39 0 d-------- C:\Documents and Settings\john\Application Data\Earthsim 2008-05-14 22:54:52 0 d-------- C:\Program Files\Bazooka Scanner 2008-05-14 18:37:51 0 d-------- C:\Program Files\Lavasoft 2008-05-07 00:50:40 0 d-------- C:\WINDOWS\system32\ZoneLabs 2008-04-26 16:40:54 0 d-------- C:\Documents and Settings\JOHNMAN\Application Data\Grisoft 2008-04-18 13:00:59 0 d-------- C:\Documents and Settings\john\Application Data\Help 2008-04-18 12:57:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla 2008-04-18 12:44:37 0 d-------- C:\!KillBox 2008-04-18 12:36:18 0 d-------- C:\Program Files\Trend Micro -- Find3M Report --------------------------------------------------------------- 2008-05-15 03:04:42 5428 --a----c- C:\WINDOWS\mozver.dat 2008-05-15 02:55:58 0 d-------- C:\Program Files\Warcraft III 2008-05-15 01:34:59 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-15 01:30:29 0 d-------- C:\Program Files\Microsoft SQL Server 2008-05-15 01:20:05 0 d-------- C:\Program Files\Common Files\HP 2008-05-15 01:13:30 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-05-14 18:37:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-12 17:56:21 0 d-------- C:\Program Files\Diablo II 2008-05-12 17:55:53 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2008-05-06 23:45:30 0 d-------- C:\Program Files\Common Files 2008-04-24 18:57:00 0 d-------- C:\Documents and Settings\john\Application Data\AVG7 2008-04-18 13:51:31 0 d-------- C:\Program Files\Common Files\M?crosoft 2008-04-14 18:22:00 36361 --a------ C:\WINDOWS\DIIUnin.dat 2008-04-14 18:21:14 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll 2008-04-14 18:21:13 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll 2008-04-14 18:21:13 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll 2008-04-13 15:07:49 0 d-------- C:\Program Files\Outerinfo 2008-04-13 14:02:19 2829 --a------ C:\WINDOWS\DIIUnin.pif 2008-04-13 14:02:19 94208 --a------ C:\WINDOWS\DIIUnin.exe <Not Verified; Blizzard Entertainment; Diablo II Uninstaller> 2008-04-12 22:59:23 0 d-------- C:\Program Files\Online Services 2008-04-12 11:11:41 0 d-------- C:\Program Files\Temporary 2008-04-10 22:33:56 0 d-------- C:\Program Files\iPod 2008-04-09 22:27:31 0 d-------- C:\Documents and Settings\john\Application Data\U3 2008-04-05 10:52:16 0 d-------- C:\Program Files\NoDNS 2008-03-03 16  49 255505 --ahs---- C:\WINDOWS\system32\xbadd.ini22008-02-16 14:21:28 76122 --a------ C:\WINDOWS\War3Unin.dat 2008-02-16 14:18:37 2829 --a------ C:\WINDOWS\War3Unin.pif 2008-02-16 14:18:36 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "runner1"="C:\WINDOWS\retadpu77.exe" [] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54 AM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [11/14/2007 04:05 PM] "4018d0aa"="C:\WINDOWS\system32\vdrtuecm.dll" [] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [08/25/2004 12:52 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [] "BM432be336"="C:\WINDOWS\system32\etjnawqb.dll" [] "DellHelp"="C:\Dell\DellHelp\DellHelp.exe" [] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [04/11/2004 11:43 AM] "IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [06/29/2004 11:23 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/14/2007 07:05 PM] "j3291530"="C:\WINDOWS\system32\j3291530.dll" [] "Media Gateway"="C:\Program Files\Media Gateway\MediaGateway.exe" [] "mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [] "MMTray"="C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [04/11/2004 08:15 PM] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [10/14/2004 02:42 PM] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 01:35 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM] "NoDNS"="C:\Program Files\\NoDNS\\NoDNS.exe" [] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] C:\Documents and Settings\john\Start Menu\Programs\Startup\ DESKTOP.INI [8/11/2004 5:15:06 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/11/2004 5:15:06 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddabx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ec5d138-06a7-11dd-8ee1-0013203da1a8}] AutoRun\command- G:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-05-15 11:28:13 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-15-2008, 11:58 AM
|
#2 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Windows XP
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Sorry to bump, but I did a SuperAntiSpyware to save yall some time hopefully. Here is the log
SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 05/15/2008 at 12:28 PM Application Version : 4.0.1154 Core Rules Database Version : 3461 Trace Rules Database Version: 1452 Scan type : Complete Scan Total Scan Time : 00:17:01 Memory items scanned : 339 Memory threats detected : 0 Registry items scanned : 5414 Registry threats detected : 18 File items scanned : 12180 File threats detected : 10 Adware.Zango SiteFinder HKLM\Software\Classes\CLSID\{00000000-0000-41DC-A82A-2852822DFC76} HKCR\CLSID\{00000000-0000-41DC-A82A-2852822DFC76} HKCR\CLSID\{00000000-0000-41DC-A82A-2852822DFC76}\InprocServer32 HKCR\CLSID\{00000000-0000-41DC-A82A-2852822DFC76}\InprocServer32#ThreadingModel C:\PROGRAM FILES\ZANGO SITEFINDER\ZANGO SITEFINDER.DLL Adware.Vundo Variant HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{ED120D76-BF31-412C-A99B-783C6676E128} Trojan.NetMon/DNSChange HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc Trojan.Unknown Origin HKLM\Software\xpre HKLM\Software\xpre#execount Adware.ClickSpring/Outer Info Network C:\Program Files\Outerinfo Trojan.Downloader-Gen/RetAd HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A ] RootKit.TnCore/Trace C:\WINDOWS\system32\drivers\core.cache.dsk Adware.JavaCore/NoDNS C:\Program Files\NoDNS\UnInstall.exe C:\Program Files\NoDNS HKU\S-1-5-21-1852957688-4223651985-1134253555-1007\Software\Microsoft\Windows\CurrentVersion\Run#NoDNS [ C:\Program Files\\NoDNS\\NoDNS.exe ] Trojan.Unclassified/NVCOI C:\Program Files\Temporary Adware.Vundo Variant/Rel C:\WINDOWS\SYSTEM32\AYBEG.INI C:\WINDOWS\SYSTEM32\IJJLM.INI C:\WINDOWS\SYSTEM32\XBADD.INI2 Rootkit.TNCore-Variant/A C:\WINDOWS\SYSTEM32\DRIVERS\VOLSNAPP.SYS |
|
|
|
|
05-18-2008, 11:19 AM
|
#4 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 27,016
OS: WinXP and Vista
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Hello keepitrail and welcome,
This will require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows:
Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log. |
|
|
|
|
05-18-2008, 06:32 PM
|
#5 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Windows XP
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Awesome! Here is the Combo and the Deckards HiJack. Thanks for helping!!!
ComboFix 08-05-15.3 - john 2008-05-18 19:00:01.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.623 [GMT -5:00] Running from: C:\Documents and Settings\john\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\john\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\salesmonitor C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007 C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007\Data\Abbr C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007\Data\ProductCode C:\Documents and Settings\john\Application Data\macromedia\Flash Player\#SharedObjects\XJT7Z9YH\www.broadcaster.com C:\Documents and Settings\john\Application Data\macromedia\Flash Player\#SharedObjects\XJT7Z9YH\www.broadcaster.com\played_list.sol C:\Documents and Settings\john\Application Data\macromedia\Flash Player\#SharedObjects\XJT7Z9YH\www.broadcaster.com\video_queue.sol C:\Documents and Settings\john\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\john\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\john\Application Data\PPATCH~1 C:\Documents and Settings\john\err.log C:\Program Files\Common Files\mcroso~1 C:\Program Files\Common Files\smbols~1 C:\Program Files\icroso~1.net C:\Program Files\poolsv C:\Program Files\sstem3~1 C:\Program Files\sstem3~1\s?stem32\ C:\Program Files\svhost C:\temp\tn3 C:\WINDOWS\crosof~1 C:\WINDOWS\pskt.ini C:\WINDOWS\system32\aihsrklk.ini C:\WINDOWS\system32\aihxaufy.ini C:\WINDOWS\system32\aljixhwt.ini C:\WINDOWS\system32\arinxgxi.ini C:\WINDOWS\system32\asrdsrsa.ini C:\WINDOWS\system32\asulyxco.ini C:\WINDOWS\system32\athfadiw.ini C:\WINDOWS\SYSTEM32\aybeg.ini2 C:\WINDOWS\system32\bapslcml.ini C:\WINDOWS\system32\brkvuyvj.ini C:\WINDOWS\system32\c4 C:\WINDOWS\system32\cdipanhf.ini C:\WINDOWS\system32\chwwflpf.ini C:\WINDOWS\system32\cprmnmmu.ini C:\WINDOWS\system32\crefpkrq.ini C:\WINDOWS\system32\cudhywxk.ini C:\WINDOWS\system32\cukfmilx.ini C:\WINDOWS\system32\ddiwxedj.ini C:\WINDOWS\system32\dgujccvt.ini C:\WINDOWS\system32\drcnnjsu.ini C:\WINDOWS\system32\envrxmii.ini C:\WINDOWS\system32\eopkbxkv.ini C:\WINDOWS\system32\eqmokvka.ini C:\WINDOWS\system32\eyimscea.ini C:\WINDOWS\system32\fhwpycrj.ini C:\WINDOWS\system32\gajwrjqa.ini C:\WINDOWS\system32\gavnnxur.ini C:\WINDOWS\system32\gdoauxsf.ini C:\WINDOWS\system32\gltzccok.dllbox C:\WINDOWS\system32\goijctfg.ini C:\WINDOWS\system32\gymfiajx.ini C:\WINDOWS\system32\hdydnkxj.ini C:\WINDOWS\system32\hhagroyd.ini C:\WINDOWS\system32\hlsgenhe.ini C:\WINDOWS\system32\hmdpnihq.ini C:\WINDOWS\system32\hyjecvox.ini C:\WINDOWS\system32\iDlo01 C:\WINDOWS\system32\idygjkmj.ini C:\WINDOWS\system32\ihyfhlpr.ini C:\WINDOWS\SYSTEM32\ijjlm.ini2 C:\WINDOWS\system32\ikfmrole.ini C:\WINDOWS\system32\imrlnanh.ini C:\WINDOWS\system32\isiannwq.ini C:\WINDOWS\system32\iueqjulg.ini C:\WINDOWS\system32\jbdundob.ini C:\WINDOWS\system32\jcpoxrkn.ini C:\WINDOWS\system32\jjfikuju.ini C:\WINDOWS\system32\jjhecqbh.ini C:\WINDOWS\system32\jqaxixdp.ini C:\WINDOWS\system32\jqdlkhfr.ini C:\WINDOWS\system32\k8 C:\WINDOWS\system32\khjfcypf.ini C:\WINDOWS\system32\kmoincpg.ini C:\WINDOWS\system32\kruvfyxu.ini C:\WINDOWS\system32\kvddwnpy.ini C:\WINDOWS\system32\kxskqmbw.ini C:\WINDOWS\system32\lhwycbsi.ini C:\WINDOWS\system32\lsupttjq.ini C:\WINDOWS\system32\lxyyskoh.ini C:\WINDOWS\system32\mbuwpqtt.ini C:\WINDOWS\system32\mceutrdv.ini C:\WINDOWS\system32\mhcvveoh.ini C:\WINDOWS\system32\myakpaax.ini C:\WINDOWS\system32\nerhkyeo.ini C:\WINDOWS\system32\nxyyjaep.ini C:\WINDOWS\system32\omgfcmbw.ini C:\WINDOWS\system32\omgulldb.ini C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pgvbcuse.ini C:\WINDOWS\system32\psbwvhgm.ini C:\WINDOWS\system32\pyotjtpc.ini C:\WINDOWS\system32\qduwqofj.ini C:\WINDOWS\system32\qouoayli.ini C:\WINDOWS\system32\qpsmmobm.ini C:\WINDOWS\system32\qqgdslgj.ini C:\WINDOWS\system32\qsiucrvn.ini C:\WINDOWS\system32\rafrlljs.ini C:\WINDOWS\system32\raopvfpd.ini C:\WINDOWS\system32\rfuivenl.ini C:\WINDOWS\system32\s7 C:\WINDOWS\system32\shjifqyh.ini C:\WINDOWS\system32\smmtgdkf.ini C:\WINDOWS\system32\stgduohr.ini C:\WINDOWS\system32\tfumyxxk.ini C:\WINDOWS\system32\tgyfsakl.ini C:\WINDOWS\system32\toiwaefm.ini C:\WINDOWS\system32\uabdwgvb.ini C:\WINDOWS\system32\uikepipd.ini C:\WINDOWS\system32\uljvuahl.ini C:\WINDOWS\system32\vcwliubn.ini C:\WINDOWS\system32\vityettb.ini C:\WINDOWS\system32\vlkxkxcr.ini C:\WINDOWS\system32\vsexbhuw.ini C:\WINDOWS\system32\whshxhjd.ini C:\WINDOWS\system32\win C:\WINDOWS\system32\X2 C:\WINDOWS\system32\X3 C:\WINDOWS\system32\X4 C:\WINDOWS\system32\X9 C:\WINDOWS\SYSTEM32\xbadd.ini C:\WINDOWS\system32\xdbumydd.ini C:\WINDOWS\system32\xnsxwxay.ini C:\WINDOWS\system32\xrntkcvm.ini C:\WINDOWS\system32\xslewsko.ini C:\WINDOWS\system32\xxcodvvl.ini C:\WINDOWS\system32\yfwxggmf.ini C:\WINDOWS\system32\yiiettjw.ini C:\WINDOWS\system32\yqiqtiyd.ini C:\WINDOWS\system32\yxnxirtg.ini C:\WINDOWS\system32\yymkelgm.ini C:\WINDOWS\system32\yynnnspl.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))) . 2008-05-18 13:25 . 2008-05-18 13:25 <DIR> d-------- C:\Program Files\Bonjour 2008-05-18 13:17 . 2008-05-18 13:17 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-05-18 10:04 . 2008-05-18 10:04 <DIR> d-------- C:\Program Files\uTorrent 2008-05-18 10:04 . 2008-05-18 10:56 <DIR> d-------- C:\Documents and Settings\john\Application Data\uTorrent 2008-05-16 21:34 . 2008-05-16 21:36 <DIR> d-------- C:\Program Files\Garena 2008-05-16 21:34 . 2008-05-16 21:34 <DIR> d-------- C:\Documents and Settings\john\Application Data\InstallShield 2008-05-16 21:34 . 2006-03-14 02:26 53,248 --a------ C:\WINDOWS\SYSTEM32\ImageOle.dll 2008-05-15 12:09 . 2008-05-15 12:55 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-05-15 12:09 . 2008-05-15 12:09 <DIR> d-------- C:\Documents and Settings\john\Application Data\SUPERAntiSpyware.com 2008-05-15 12:09 . 2008-05-15 12:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-05-15 11:41 . 2008-05-15 11:41 <DIR> d-------- C:\ie-spyad_zo 2008-05-15 03:58 . 2008-05-15 03:58 <DIR> d-------- C:\Deckard 2008-05-15 03:51 . 2008-05-15 03:54 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-15 03:51 . 2008-05-15 03:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-15 03:04 . 2008-05-15 03:04 <DIR> d-------- C:\Program Files\Panda Security 2008-05-15 01:20 . 2008-05-15 01:20 <DIR> d-------- C:\Documents and Settings\john\Application Data\Earthsim 2008-05-14 22:54 . 2008-05-14 22:54 <DIR> d-------- C:\Program Files\Bazooka Scanner 2008-05-14 18:37 . 2008-05-14 18:37 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-07 00:50 . 2008-05-07 00:50 <DIR> d-------- C:\Program Files\Zone Labs 2008-05-04 23:41 . 2008-05-17 03:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-04 23:41 . 2008-05-04 23:41 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-26 16:40 . 2008-04-26 16:40 <DIR> d-------- C:\Documents and Settings\JOHNMAN\Application Data\Grisoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-18 18:25 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-18 18:14 --------- d-----w C:\Program Files\Warcraft III 2008-05-18 02:03 --------- d-----w C:\Program Files\Diablo II 2008-05-17 02:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-15 17:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-05-15 06:34 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-05-15 06:30 --------- d-----w C:\Program Files\Microsoft SQL Server 2008-05-15 06:20 --------- d-----w C:\Program Files\Common Files\HP 2008-05-15 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Earthsim 2008-04-24 23:57 --------- d-----w C:\Documents and Settings\JOHNMAN\Application Data\AVG7 2008-04-24 23:57 --------- d-----w C:\Documents and Settings\john\Application Data\AVG7 2008-04-24 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-04-24 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-04-18 18:00 --------- d-----w C:\Program Files\CleanUp! 2008-04-18 17:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-04-18 17:45 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-04-18 17:36 --------- d-----w C:\Program Files\Trend Micro 2008-04-13 19:02 94,208 ----a-w C:\WINDOWS\DIIUnin.exe 2008-04-13 19:02 2,829 ----a-w C:\WINDOWS\DIIUnin.pif 2008-04-11 03:33 --------- d-----w C:\Program Files\iPod 2008-04-10 03:27 --------- d-----w C:\Documents and Settings\john\Application Data\U3 2007-11-26 04:32 138,801 ----a-w C:\Program Files\Emilyville.sc3 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] "4018d0aa"="C:\WINDOWS\system32\vdrtuecm.dll" [ ] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [ ] "BM432be336"="C:\WINDOWS\system32\etjnawqb.dll" [ ] "DellHelp"="C:\Dell\DellHelp\DellHelp.exe" [ ] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 11:43 53248] "IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 11:23 135168] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088] "j3291530"="C:\WINDOWS\system32\j3291530.dll" [ ] "Media Gateway"="C:\Program Files\Media Gateway\MediaGateway.exe" [ ] "mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [ ] "MMTray"="C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [ ] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15 290816] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42 1404928] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Warcraft III\\war3.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\Warcraft III\\Frozen Throne.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Dewd "6112:UDP"= 6112:UDP:war "6113:TCP"= 6113:TCP:1 "6114:TCP"= 6114:TCP:2 S1 VOLSNAPP;VOLSNAPP;C:\WINDOWS\system32\drivers\VOLSNAPP.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ec5d138-06a7-11dd-8ee1-0013203da1a8}] \Shell\AutoRun\command - G:\LaunchU3.exe -a . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-18 19 13Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ati2evxx.exe C:\WINDOWS\SYSTEM32\ati2evxx.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\SYSTEM32\HPZipm12.exe . ************************************************************************** . Completion time: 2008-05-18 19:10:47 - machine was rebooted [john] ComboFix-quarantined-files.txt 2008-05-19 00:10:23 Pre-Run: 72,700,825,600 bytes free Post-Run: 72,566,566,912 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 286 --- E O F --- 2008-05-16 07:31:22 Deckard's System Scanner v20071014.68 Run by john on 2008-05-18 19:23:44 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as john.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:24:53 PM, on 5/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\john\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\john.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [4018d0aa] rundll32.exe "C:\WINDOWS\system32\vdrtuecm.dll",b O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BM432be336] Rundll32.exe "C:\WINDOWS\system32\etjnawqb.dll",s O4 - HKLM\..\Run: [DellHelp] C:\Dell\DellHelp\DellHelp.exe /c O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [j3291530] rundll32 C:\WINDOWS\system32\j3291530.dll sook O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSSQL$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SQLAgent$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 5177 bytes -- Files created between 2008-04-18 and 2008-05-18 ----------------------------- 2008-05-18 18:59:44 0 d-------- C:\cmdcons 2008-05-18 18:58:50 68096 --a------ C:\WINDOWS\zip.exe 2008-05-18 18:58:50 49152 --a------ C:\WINDOWS\VFind.exe 2008-05-18 18:58:50 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-05-18 18:58:50 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-05-18 18:58:50 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-05-18 18:58:50 98816 --a------ C:\WINDOWS\sed.exe 2008-05-18 18:58:50 80412 --a------ C:\WINDOWS\grep.exe 2008-05-18 18:58:50 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-05-18 13:25:45 0 d-------- C:\Program Files\Bonjour 2008-05-18 13:17:02 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-05-18 10:04:54 0 d-------- C:\Program Files\uTorrent 2008-05-18 10:04:50 0 d-------- C:\Documents and Settings\john\Application Data\uTorrent 2008-05-16 21:34:37 53248 --a------ C:\WINDOWS\system32\ImageOle.dll <Not Verified; TODO: <Company name>; TODO: <Product name>> 2008-05-16 21:34:36 0 d-------- C:\Program Files\Garena 2008-05-16 21:34:26 0 d-------- C:\Documents and Settings\john\Application Data\InstallShield 2008-05-15 12:09:58 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-05-15 12:09:55 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-05-15 12:09:55 0 d-------- C:\Documents and Settings\john\Application Data\SUPERAntiSpyware.com 2008-05-15 11:41:27 0 d-------- C:\ie-spyad_zo 2008-05-15 03:51:39 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-15 03:51:34 0 d-------- C:\Program Files\SpywareBlaster 2008-05-15 03:04:41 0 d-------- C:\Program Files\Panda Security 2008-05-15 01:20:39 0 d-------- C:\Documents and Settings\john\Application Data\Earthsim 2008-05-14 22:54:52 0 d-------- C:\Program Files\Bazooka Scanner 2008-05-14 18:37:51 0 d-------- C:\Program Files\Lavasoft 2008-05-07 00:50:40 0 d-------- C:\WINDOWS\system32\ZoneLabs 2008-04-26 16:40:54 0 d-------- C:\Documents and Settings\JOHNMAN\Application Data\Grisoft 2008-04-18 13:00:59 0 d-------- C:\Documents and Settings\john\Application Data\Help 2008-04-18 12:57:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla 2008-04-18 12:44:37 0 d-------- C:\!KillBox 2008-04-18 12:36:18 0 d-------- C:\Program Files\Trend Micro -- Find3M Report --------------------------------------------------------------- 2008-05-18 19:00:11 0 d-------- C:\Program Files\Common Files 2008-05-18 13:26:52 0 d-------- C:\Documents and Settings\john\Application Data\Adobe 2008-05-18 13:25:42 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-18 13:14:55 0 d-------- C:\Program Files\Warcraft III 2008-05-17 21:03:38 0 d-------- C:\Program Files\Diablo II 2008-05-17 21:03:06 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2008-05-16 21:34:36 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-05-15 12:09:41 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-15 03:04:42 5428 --a----c- C:\WINDOWS\mozver.dat 2008-05-15 01:34:59 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-15 01:30:29 0 d-------- C:\Program Files\Microsoft SQL Server 2008-05-15 01:20:05 0 d-------- C:\Program Files\Common Files\HP 2008-05-15 01:13:30 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-04-24 18:57:00 0 d-------- C:\Documents and Settings\john\Application Data\AVG7 2008-04-14 18:22:00 36361 --a------ C:\WINDOWS\DIIUnin.dat 2008-04-14 18:21:14 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll 2008-04-14 18:21:13 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll 2008-04-14 18:21:13 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll 2008-04-13 14:02:19 2829 --a------ C:\WINDOWS\DIIUnin.pif 2008-04-13 14:02:19 94208 --a------ C:\WINDOWS\DIIUnin.exe <Not Verified; Blizzard Entertainment; Diablo II Uninstaller> 2008-04-12 22:59:23 0 d-------- C:\Program Files\Online Services 2008-04-10 22:33:56 0 d-------- C:\Program Files\iPod 2008-04-09 22:27:31 0 d-------- C:\Documents and Settings\john\Application Data\U3 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54 AM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [11/14/2007 04:05 PM] "4018d0aa"="C:\WINDOWS\system32\vdrtuecm.dll" [] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [08/25/2004 12:52 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [] "BM432be336"="C:\WINDOWS\system32\etjnawqb.dll" [] "DellHelp"="C:\Dell\DellHelp\DellHelp.exe" [] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [04/11/2004 11:43 AM] "IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [06/29/2004 11:23 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/14/2007 07:05 PM] "j3291530"="C:\WINDOWS\system32\j3291530.dll" [] "Media Gateway"="C:\Program Files\Media Gateway\MediaGateway.exe" [] "mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [] "MMTray"="C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [04/11/2004 08:15 PM] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [10/14/2004 02:42 PM] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 01:35 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/29/2008 04:03 PM] C:\Documents and Settings\john\Start Menu\Programs\Startup\ DESKTOP.INI [8/11/2004 5:15:06 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/11/2004 5:15:06 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 12:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ec5d138-06a7-11dd-8ee1-0013203da1a8}] AutoRun\command- G:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-05-18 19:25:34 ------------ |
|
|
|
|
05-18-2008, 09:36 PM
|
#6 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 27,016
OS: WinXP and Vista
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Hi keepitrail,
ComboFix took out the files for us, now what remains are the orphaned registry entries. Disable Spybot TeaTimer as it will interfere with the fix below:
------------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries: O4 - HKLM\..\Run: [4018d0aa] rundll32.exe "C:\WINDOWS\system32\vdrtuecm.dll",b O4 - HKLM\..\Run: [BM432be336] Rundll32.exe "C:\WINDOWS\system32\etjnawqb.dll",s O4 - HKLM\..\Run: [j3291530] rundll32 C:\WINDOWS\system32\j3291530.dll sook O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe Click 'Fix Checked' and close HijackThis. -------------------------------------------------------------------- It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
--------------------------------------------------------------- Run a new scan with HijackThis.exe (not dss.exe) and save the log. --------------------------------------------------------------- Please include the following in your next reply: Kaspersky results New HijackThis log Update on system behavior |
|
|
|
|
05-19-2008, 08:36 AM
|
#7 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Windows XP
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Looking good! I'm not getting any more popups! I am still getting lag in games though, as of last night, and disconnects. I'm beginning to think this could be a problem with the router? I have a linksys wau54g and i'm hardwired to it while my girlfriend uses the wirelessness of it. She's getting terrible signals from it, from one room away. So it could be that. I really appreciate the help your forum is giving out! When you give me the all clear I'd love to donate if you guys have a way to do that.
 Here's the Kassperasskeys & Hijack In the future, attached or just copy & pasted? (I attached the Kasperksy in case it's easier to read) KASPERSKY ONLINE SCANNER REPORT Monday, May 19, 2008 9:26:39 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/05/2008 Kaspersky Anti-Virus database records: 784101 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 71869 Number of viruses found: 1 Number of infected objects: 4 Number of suspicious objects: 0 Duration of the scan process: 01:19:14 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_50e417e0-e461-474b-96e2-077b80325612 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\cert8.db Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\history.dat Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\key3.db Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\parent.lock Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\search.sqlite Object is locked skipped C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\john\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-314914ec.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped C:\Documents and Settings\john\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-314914ec.zip ZIP: infected - 1 skipped C:\Documents and Settings\john\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-17f4200d.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped C:\Documents and Settings\john\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-17f4200d.zip ZIP: infected - 1 skipped C:\Documents and Settings\john\Cookies\index.dat Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\john\Local Settings\Application Data\Mozilla\Firefox\Profiles\egz5hyk2.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\john\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\john\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\john\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\john\ntuser.dat Object is locked skipped C:\Documents and Settings\john\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP16\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{8B60A26F-0259-4E67-B65A-ED017C6BFF4F}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:28:27 AM, on 5/19/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\john\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [DellHelp] C:\Dell\DellHelp\DellHelp.exe /c O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSSQL$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SQLAgent$MICROSOFTBCM - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 5244 bytes Last edited by keepitrail; 05-19-2008 at 08:38 AM. |
|
|
|
|
05-19-2008, 08:46 AM
|
#8 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 27,016
OS: WinXP and Vista
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
Hi keepitrail,
Copy/paste directly into the thread is preferred unless otherwise instructed.  Yes, it sounds like an issue with the router and signal strength. Kaspersky is reporting infection in your Sun Java cache. The following procedure will take care of that, as well as provide you further protection. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
After you've done that, your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links: The following procedure will clear out the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls http://miekiemoes.blogspot.com/search/label/Prevention **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. **Kindly respond one more time and let me know if we may consider this thread resolved. |
|
|
|
| Thread Tools | |
|
|
Re: Popups, Spikes and Lag...Tried a lot nothin working!
