|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-10-2008, 09:10 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Warning! Spyware detected on your computer!
Warning! Spyware detected on your computer!
Install an antivirus or spyware remover to clean your computer Then the bugs start crawling everywhere! I seen this posted in a few other threads, but the 5 step instructions said to create a new thread... Attached and C&P'd the requested log files.... TIA for any help!!! Deckard's System Scanner v20071014.68 Run by misty on 2008-06-10 21:30:26 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2008-06-11 02:30:29 UTC - RP4 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-10 21:32:08 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\tlntsvr.exe C:\WINDOWS\explorer.exe C:\WINDOWS\RTHDCPL.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Elantech\KTP.EXE C:\WINDOWS\vsnp2uvc.exe C:\Program Files\Wireless Select Switch\WLSS.exe C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Protector Suite QL\psqltray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\lphc7v8j0ep10.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Microsoft ActiveSync\rapimgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Documents and Settings\misty\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\googletoolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\googletoolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe O4 - HKLM\..\Run: [WLSS] C:\Program Files\Wireless Select Switch\WLSS.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Wow Video&Audio] C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lphc7v8j0ep10] C:\WINDOWS\system32\lphc7v8j0ep10.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe O4 - Global Startup: Fantastic Flame Agent.lnk = C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe O4 - Global Startup: Orbit.lnk = ? O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210215948906 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} () - http://fpdownload.macromedia.com/pub...sh/swflash.cab O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 8692 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel(R) PROSet/Wireless Registry Service> S4 NMIndexingService - "c:\program files\common files\ahead\lib\nmindexingservice.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-05-10 and 2008-06-10 ----------------------------- 2008-06-10 21:25:48 0 d-------- C:\Program Files\SpywareBlaster 2008-06-10 20:48:36 0 d-------- C:\WINDOWS\LastGood 2008-06-10 20:46:58 0 d-------- C:\Program Files\Panda Security 2008-06-10 14:31:30 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-06-10 13:35:18 0 d-------- C:\Documents and Settings\misty\Application Data\shc1v8j0ep10 2008-06-10 13:33:45 52736 --a------ C:\WINDOWS\system32\blphc7v8j0ep10.scr <Not Verified; Peter's Productions; Bugs!> 2008-06-10 13:33:42 92160 --a------ C:\WINDOWS\system32\lphc7v8j0ep10.exe 2008-06-06 15:57:43 802816 --a------ C:\WINDOWS\FeedingFrenzy.scr <Not Verified; Sprout Games, LLC; Feeding Frenzy> 2008-06-04 18:37:04 0 d-------- C:\Documents and Settings\misty\Application Data\Pogo Games 2008-06-03 08:56:50 0 d-------- C:\PSP Stuff 2008-06-03 08:08:57 0 d-------- C:\Documents and Settings\All Users\Application Data\WildTangent 2008-05-27 00:51:05 90112 --a------ C:\WINDOWS\RSetupCE.exe 2008-05-27 00:51:00 0 d-------- C:\Program Files\Resco 2008-05-26 17:44:15 0 d-------- C:\Dump 2008-05-19 21:20:37 0 d-------- C:\Documents and Settings\misty\Application Data\Help 2008-05-18 09:59:30 0 d-------- C:\WINDOWS\system32\Adobe 2008-05-14 23:30:37 0 d-------- C:\Documents and Settings\misty\Application Data\gtk-2.0 2008-05-12 23:11:34 0 d-------- C:\Documents and Settings\misty\Application Data\hIq Inc 2008-05-12 23:09:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-05-12 23:09:05 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-12 03:10:58 0 d-------- C:\Downloads 2008-05-12 03:10:50 0 d-------- C:\Documents and Settings\misty\Application Data\Orbit 2008-05-12 03:10:49 0 d-------- C:\Program Files\Orbitdownloader 2008-05-11 22:45:10 0 d-------- C:\Documents and Settings\misty\Application Data\Move Networks 2008-05-10 23:29:34 0 d-------- C:\Program Files\PPCkitchen.org 2008-05-10 22:40:36 0 d-------- C:\Documents and Settings\misty\Application Data\WinRAR 2008-05-10 21:29:17 0 d-------- C:\PPC Stuff 2008-05-10 19:18:27 0 d-------- C:\Program Files\InterActual 2008-05-10 19:08:01 0 d-------- C:\WINDOWS\Sun 2008-05-10 19:08:01 0 d-------- C:\Documents and Settings\misty\Application Data\Sun -- Find3M Report --------------------------------------------------------------- 2008-06-09 00:13:16 0 d-------- C:\Documents and Settings\misty\Application Data\dvdcss 2008-06-06 23:22:29 0 d-------- C:\Documents and Settings\misty\Application Data\GameHouse 2008-06-06 15:57:42 0 d-------- C:\Program Files\GameHouse 2008-06-05 08:36:10 0 d-------- C:\Documents and Settings\misty\Application Data\.purple 2008-05-27 00:17:51 0 d-------- C:\Program Files\Microsoft ActiveSync 2008-05-13 20:08:50 0 d-------- C:\Documents and Settings\misty\Application Data\Adobe 2008-05-12 23:09:05 0 d-------- C:\Program Files\Common Files 2008-05-12 01:55:36 0 d-------- C:\Documents and Settings\misty\Application Data\LimeWire 2008-05-08 23:58:08 0 d-------- C:\Program Files\Java 2008-05-08 23:53:39 0 d-------- C:\Program Files\Common Files\Java 2008-05-08 23:50:17 0 d-------- C:\Program Files\LimeWire 2008-05-08 23:07:22 1169 --a------ C:\WINDOWS\mozver.dat 2008-05-08 20:25:26 0 d-------- C:\Program Files\Google 2008-05-08 19:13:03 0 d-------- C:\Program Files\Oberon Media 2008-05-08 13:59:19 0 d-------- C:\Documents and Settings\misty\Application Data\ImgBurn 2008-05-08 12:52:26 0 d-------- C:\Program Files\YPOPs 2008-05-08 00:27:43 0 d-------- C:\Program Files\MSXML 6.0 2008-05-07 23:52:17 0 d-------- C:\Program Files\Microsoft.NET 2008-05-07 22:47:29 0 d-------- C:\Program Files\Pidgin 2008-05-07 22:47:19 0 d-------- C:\Program Files\Common Files\GTK 2008-05-07 22:03:55 0 d-------- C:\Program Files\Common Files\InstallShield 2008-05-07 22:03:52 0 d-------- C:\Program Files\CyberLink 2008-05-07 22:03:38 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-05-07 09:46:45 0 d-------- C:\Documents and Settings\misty\Application Data\Macromedia 2008-05-07 01:23:35 0 d-------- C:\Program Files\Fantastic Flame Screensaver 2008-05-06 15:53:09 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-06 15:44:43 0 d-------- C:\Program Files\Netflix 2008-05-06 15:42:11 0 d-------- C:\Documents and Settings\misty\Application Data\vlc 2008-05-06 15:31:00 0 d-------- C:\Program Files\VideoLAN 2008-05-06 14:36:16 0 --a------ C:\WINDOWS\nsreg.dat 2008-05-06 14:36:14 0 d-------- C:\Documents and Settings\misty\Application Data\Mozilla 2008-05-06 14:28:59 0 d-------- C:\Program Files\ImgBurn 2008-05-06 14:24:05 0 d-------- C:\Program Files\DVDFab HD Decrypter 4 2008-05-06 14:19:47 0 d-------- C:\Program Files\DVD Shrink 2008-05-06 13:53:24 218624 --a------ C:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-05-06 13:17:09 2528 --a------ C:\Documents and Settings\misty\Application Data\$_hpcst$.hpc 2008-05-06 12:46:46 0 d-------- C:\Program Files\Common Files\Ahead 2008-05-01 08:17:30 0 d-------- C:\Program Files\WIDCOMM -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [05/10/2007 05:08 AM C:\WINDOWS\RTHDCPL.exe] "Alcmtr"="ALCMTR.EXE" [05/03/2005 05:43 AM C:\WINDOWS\Alcmtr.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [11/22/2006 04:31 AM] "KTPWare"="C:\Program Files\Elantech\ktp.exe" [02/13/2007 03:11 PM] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [12/29/2006 02:48 PM] "WLSS"="C:\Program Files\Wireless Select Switch\WLSS.exe" [10/17/2007 02:40 PM] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [06/01/2007 01:51 PM] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [06/01/2007 01:49 PM] "Wow Video&Audio"="C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe" [05/03/2007 08:51 PM] "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [03/28/2007 10:23 PM] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [06/26/2007 07:06 AM] "nwiz"="nwiz.exe" [06/26/2007 07:06 AM C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [06/26/2007 07:06 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM] "lphc7v8j0ep10"="C:\WINDOWS\system32\lphc7v8j0ep10.exe" [06/10/2008 01:33 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [11/13/2006 01:39 PM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [07/27/2007 07:00 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 04:06 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [12/11/2006 6:35:34 PM] Fantastic Flame Agent.lnk - C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe [4/24/2007 3:33:26 PM] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [5/12/2008 3:10:49 AM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=1 (0x1) "NoDispScrSavPage"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] C:\WINDOWS\system32\psqlpwd.dll 03/28/2007 10:46 PM 90112 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Notification Packages"= scecli psqlpwd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ee2c94-da25-11dc-8831-806d6172696f}] AutoRun\command- D:\StartCD.exe *Newly Created Service* - RKPAVPROC -- End of Deckard's System Scanner: finished at 2008-06-10 21:32:25 ------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:42:08 PM, on 6/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\tlntsvr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Elantech\ktp.exe C:\WINDOWS\vsnp2uvc.exe C:\Program Files\Wireless Select Switch\WLSS.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Protector Suite QL\psqltray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\lphc7v8j0ep10.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Orbitdownloader\orbitnet.exe C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\misty\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe O4 - HKLM\..\Run: [WLSS] C:\Program Files\Wireless Select Switch\WLSS.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Wow Video&Audio] C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lphc7v8j0ep10] C:\WINDOWS\system32\lphc7v8j0ep10.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Fantastic Flame Agent.lnk = C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210215948906 O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 7999 bytes |
|
     |
| Sponsored Links |
|
06-13-2008, 06:28 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,661
OS: XP SP3
|
Re: Warning! Spyware detected on your computer!
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please explain why this computer has no antivirus program installed and running. This is an open invitation for infection. Please keep this computer offline except when downloading tools and posting in the forum until we get one installed. ------------------------------------------------------ I see you have P2P software ( Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. If you decide to uninstall Limewire, also delete these Folders if they still exist: C:\Documents and Settings\misty\Application Data\LimeWire C:\Program Files\LimeWire ------------------------------------------------------ Please visit this webpage for instructions on downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
06-13-2008, 09:30 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Re: Warning! Spyware detected on your computer!
Thanks for your reply and willingness to help !!!
Please understand that while waiting i grew impatient and performed the following tasks (i felt you should know in case they make any difference) Deleted policys preventing changing the background and screensaver under: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system Deleted the screensaver/background files installed that i found (/system32 folder) lphc7v8j0ep10.exe lphc7v8j0ep10.bmp lphc7v8j0ep10.scr ---------------------------------------------------------- Subscribed to thread and i will follow thru until the end. Thanks again ---------------------------------------------------------- Please recommend cheap or FREE antivirus (that actually works well) other than ignorance and lack of funds, i really cant justify the lack of antivirus software ---------------------------------------------------------- Logs: ---------------------------------------------------------- ComboFix 08-06-12.2 - misty 2008-06-13 23:11:59.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.618 [GMT -5:00] Running from: C:\Documents and Settings\misty\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\misty\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\WINDOWS\Fonts\CALIBRIB.TTF C:\WINDOWS\system32\D.tmp . ((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 ))))))))))))))))))))))))))))))) . 2008-06-12 21:11 . 2008-06-12 21:19 4,681,455,616 --a------ C:\BUFFY_S5_D6.ISO 2008-06-10 21:30 . 2008-06-10 21:30 <DIR> d-------- C:\Deckard 2008-06-10 21:25 . 2008-06-10 21:25 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-10 21:25 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-10 20:46 . 2008-06-10 20:48 <DIR> d-------- C:\Program Files\Panda Security 2008-06-10 15:38 . 2008-06-10 15:28 52,736 --a------ C:\WINDOWS\system32\1C.tmp 2008-06-10 15:28 . 2008-06-10 15:18 52,736 --a------ C:\WINDOWS\system32\19.tmp 2008-06-10 15:18 . 2008-06-10 15:08 52,736 --a------ C:\WINDOWS\system32\16.tmp 2008-06-10 15:08 . 2008-06-10 14:58 52,736 --a------ C:\WINDOWS\system32\13.tmp 2008-06-10 14:58 . 2008-06-10 14:48 52,736 --a------ C:\WINDOWS\system32\10.tmp 2008-06-10 14:31 . 2008-06-10 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-06-10 13:35 . 2008-06-10 13:35 <DIR> d-------- C:\Documents and Settings\misty\Application Data\shc1v8j0ep10 2008-06-08 22:35 . 2008-06-08 22:58 4,681,469,952 --a------ C:\CHARMED_SEASON_6.ISO 2008-06-06 15:57 . 2007-01-07 18:44 802,816 --a------ C:\WINDOWS\FeedingFrenzy.scr 2008-06-04 18:49 . 2008-06-04 19:10 4,681,451,520 --a------ C:\CHARMED_S5_D6.ISO 2008-06-04 18:37 . 2008-06-04 18:37 <DIR> d-------- C:\Documents and Settings\misty\Application Data\Pogo Games 2008-06-04 18:07 . 2008-06-04 18:27 4,681,445,376 --a------ C:\CHARMED_S5_D5.ISO 2008-06-03 08:56 . 2008-06-03 08:57 <DIR> d-------- C:\PSP Stuff 2008-06-03 08:08 . 2008-06-03 09:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WildTangent 2008-05-27 01:20 . 2008-05-27 02:10 77,927,387 --a------ C:\RUU_signed.nbh 2008-05-27 00:51 . 2008-05-27 00:51 <DIR> d-------- C:\Program Files\Resco 2008-05-27 00:51 . 2006-12-08 12:23 90,112 --a------ C:\WINDOWS\RSetupCE.exe 2008-05-26 17:44 . 2008-05-26 17:44 <DIR> d-------- C:\Dump 2008-05-18 09:59 . 2008-05-18 10:05 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-05-14 23:30 . 2008-05-14 23:32 <DIR> d-------- C:\Documents and Settings\misty\Application Data\gtk-2.0 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-14 04:12 --------- d-----w C:\Documents and Settings\misty\Application Data\Orbit 2008-06-14 04:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-13 23:35 --------- d-----w C:\Documents and Settings\misty\Application Data\.purple 2008-06-11 23:08 --------- d-----w C:\Documents and Settings\misty\Application Data\dvdcss 2008-06-09 04:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-06-07 04:22 --------- d-----w C:\Documents and Settings\misty\Application Data\GameHouse 2008-06-06 20:57 --------- d-----w C:\Program Files\GameHouse 2008-05-27 05:17 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-05-20 01:47 --------- d-----w C:\Documents and Settings\misty\Application Data\Move Networks 2008-05-13 04:11 --------- d-----w C:\Documents and Settings\misty\Application Data\hIq Inc 2008-05-13 04:09 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-12 08:10 --------- d-----w C:\Program Files\Orbitdownloader 2008-05-12 06:55 --------- d-----w C:\Documents and Settings\misty\Application Data\LimeWire 2008-05-11 04:29 --------- d-----w C:\Program Files\PPCkitchen.org 2008-05-11 00:18 --------- d-----w C:\Program Files\InterActual 2008-05-09 04:58 --------- d-----w C:\Program Files\Java 2008-05-09 04:53 --------- d-----w C:\Program Files\Common Files\Java 2008-05-09 04:50 --------- d-----w C:\Program Files\LimeWire 2008-05-09 01:25 --------- d-----w C:\Program Files\Google 2008-05-09 01:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9 2008-05-09 00:13 --------- d-----w C:\Program Files\Oberon Media 2008-05-08 18:59 --------- d-----w C:\Documents and Settings\misty\Application Data\ImgBurn 2008-05-08 17:52 --------- d-----w C:\Program Files\YPOPs 2008-05-08 05:27 --------- d-----w C:\Program Files\MSXML 6.0 2008-05-08 04:52 --------- d-----w C:\Program Files\Microsoft.NET 2008-05-08 03:47 --------- d-----w C:\Program Files\Pidgin 2008-05-08 03:47 --------- d-----w C:\Program Files\Common Files\GTK 2008-05-08 03:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-08 03:03 --------- d-----w C:\Program Files\CyberLink 2008-05-08 03:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-08 02:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-07 06:23 --------- d-----w C:\Program Files\Fantastic Flame Screensaver 2008-05-07 06:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Laconic Software 2008-05-06 20:53 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-05-06 20:44 --------- d-----w C:\Program Files\Netflix 2008-05-06 20:42 --------- d-----w C:\Documents and Settings\misty\Application Data\vlc 2008-05-06 20:31 --------- d-----w C:\Program Files\VideoLAN 2008-05-06 19:28 --------- d-----w C:\Program Files\ImgBurn 2008-05-06 19:24 --------- d-----w C:\Program Files\DVDFab HD Decrypter 4 2008-05-06 19:19 --------- d-----w C:\Program Files\DVD Shrink 2008-05-06 18:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2008-05-06 17:46 --------- d-----w C:\Program Files\Common Files\Ahead 2008-05-01 13:17 --------- d-----w C:\Program Files\WIDCOMM . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay] @={F2F31467-B1AC-4df0-AE79-FD5FA085E22B} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen] @={A3E208F7-0E3A-4182-A7A6-B169D5D691AA} [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}] 2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}] 2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-07-27 07:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 05:08 16342528 C:\WINDOWS\RTHDCPL.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 04:31 630784] "KTPWare"="C:\Program Files\Elantech\ktp.exe" [2007-02-13 15:11 647168] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 14:48 569344] "WLSS"="C:\Program Files\Wireless Select Switch\WLSS.exe" [2007-10-17 14:40 189736] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 13:51 823296] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-06-01 13:49 974848] "Wow Video&Audio"="C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe" [2007-05-03 20:51 951856] "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2007-03-28 22:23 49168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-26 07:06 8462336] "nwiz"="nwiz.exe" [2007-06-26 07:06 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2007-06-26 07:06 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "lphc7v8j0ep10"="C:\WINDOWS\system32\lphc7v8j0ep10.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-12-11 18:35:34 561213] Fantastic Flame Agent.lnk - C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe [2007-04-24 15:33:26 25088] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-05-12 03:10:49 1678536] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] C:\WINDOWS\system32\psqlpwd.dll 2007-03-28 22:46 90112 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "C:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "C:\\Program Files\\Pidgin\\pidgin.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 13:16] R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-17 20:55] R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2007-03-28 22:15] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ee2c94-da25-11dc-8831-806d6172696f}] \Shell\AutoRun\command - D:\StartCD.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-13 23:14:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\tlntsvr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Protector Suite QL\psqltray.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-06-13 23:16:27 - machine was rebooted [misty] ComboFix-quarantined-files.txt 2008-06-14 04:16:21 Pre-Run: 250,158,817,280 bytes free Post-Run: 250,107,969,536 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 188 --- E O F --- 2008-05-08 05:27:50 ---------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:18:06 PM, on 6/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\tlntsvr.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Elantech\ktp.exe C:\WINDOWS\vsnp2uvc.exe C:\Program Files\Wireless Select Switch\WLSS.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Protector Suite QL\psqltray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\misty\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe O4 - HKLM\..\Run: [WLSS] C:\Program Files\Wireless Select Switch\WLSS.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Wow Video&Audio] C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lphc7v8j0ep10] C:\WINDOWS\system32\lphc7v8j0ep10.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Fantastic Flame Agent.lnk = C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210215948906 O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 8136 bytes ---------------------------------------------------------- Once again, please forgive my impatience and ignorance. I have followed your instructions to the "T" and will make no further changes until and await your reply. Thanks again for your help !!! |
|
|
|
|
06-14-2008, 04:38 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,661
OS: XP SP3
|
Re: Warning! Spyware detected on your computer!
Hello again, mredraye82. Please tell us how your system is behaving.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript into ComboFix.exe Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. If you use dial-up to access the internet, skip this step and please let me know in your next reply. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior Last edited by chemist; 06-14-2008 at 04:40 AM. |
|
|
|
|
|
06-14-2008, 12:20 PM
|
#5 (permalink) | |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Re: Warning! Spyware detected on your computer!
Quote:
Your file was successfully submitted. Please let the user helping you know that you have submitted the file. -------------------------------------------------------------------------------- ComboFix 08-06-12.2 - misty 2008-06-14 10:07:25.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.575 [GMT -5:00] Running from: C:\Documents and Settings\misty\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\misty\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\misty\Application Data\shc1v8j0ep10 C:\WINDOWS\system32\10.tmp C:\WINDOWS\system32\13.tmp C:\WINDOWS\system32\16.tmp C:\WINDOWS\system32\19.tmp C:\WINDOWS\system32\1C.tmp . ((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 ))))))))))))))))))))))))))))))) . 2008-06-14 09:57 . 2008-06-14 10:03 4,681,568,256 --a------ C:\CRZ0NNW7.ISO 2008-06-12 21:11 . 2008-06-12 21:19 4,681,455,616 --a------ C:\BUFFY_S5_D6.ISO 2008-06-10 21:30 . 2008-06-10 21:30 <DIR> d-------- C:\Deckard 2008-06-10 21:25 . 2008-06-10 21:25 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-10 21:25 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-10 20:46 . 2008-06-10 20:48 <DIR> d-------- C:\Program Files\Panda Security 2008-06-10 14:31 . 2008-06-10 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-06-08 22:35 . 2008-06-08 22:58 4,681,469,952 --a------ C:\CHARMED_SEASON_6.ISO 2008-06-06 15:57 . 2007-01-07 18:44 802,816 --a------ C:\WINDOWS\FeedingFrenzy.scr 2008-06-04 18:49 . 2008-06-04 19:10 4,681,451,520 --a------ C:\CHARMED_S5_D6.ISO 2008-06-04 18:37 . 2008-06-04 18:37 <DIR> d-------- C:\Documents and Settings\misty\Application Data\Pogo Games 2008-06-04 18:07 . 2008-06-04 18:27 4,681,445,376 --a------ C:\CHARMED_S5_D5.ISO 2008-06-03 08:56 . 2008-06-03 08:57 <DIR> d-------- C:\PSP Stuff 2008-06-03 08:08 . 2008-06-03 09:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WildTangent 2008-05-27 01:20 . 2008-05-27 02:10 77,927,387 --a------ C:\RUU_signed.nbh 2008-05-27 00:51 . 2008-05-27 00:51 <DIR> d-------- C:\Program Files\Resco 2008-05-27 00:51 . 2006-12-08 12:23 90,112 --a------ C:\WINDOWS\RSetupCE.exe 2008-05-26 17:44 . 2008-05-26 17:44 <DIR> d-------- C:\Dump 2008-05-18 09:59 . 2008-05-18 10:05 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-05-14 23:30 . 2008-05-14 23:32 <DIR> d-------- C:\Documents and Settings\misty\Application Data\gtk-2.0 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-14 15:03 --------- d-----w C:\Documents and Settings\misty\Application Data\dvdcss 2008-06-14 14:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-06-14 04:15 --------- d-----w C:\Documents and Settings\misty\Application Data\Orbit 2008-06-14 04:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-13 23:35 --------- d-----w C:\Documents and Settings\misty\Application Data\.purple 2008-06-07 04:22 --------- d-----w C:\Documents and Settings\misty\Application Data\GameHouse 2008-06-06 20:57 --------- d-----w C:\Program Files\GameHouse 2008-05-27 05:17 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-05-20 01:47 --------- d-----w C:\Documents and Settings\misty\Application Data\Move Networks 2008-05-13 04:11 --------- d-----w C:\Documents and Settings\misty\Application Data\hIq Inc 2008-05-13 04:09 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-12 08:10 --------- d-----w C:\Program Files\Orbitdownloader 2008-05-12 06:55 --------- d-----w C:\Documents and Settings\misty\Application Data\LimeWire 2008-05-11 04:29 --------- d-----w C:\Program Files\PPCkitchen.org 2008-05-11 00:18 --------- d-----w C:\Program Files\InterActual 2008-05-09 04:58 --------- d-----w C:\Program Files\Java 2008-05-09 04:53 --------- d-----w C:\Program Files\Common Files\Java 2008-05-09 04:50 --------- d-----w C:\Program Files\LimeWire 2008-05-09 01:25 --------- d-----w C:\Program Files\Google 2008-05-09 01:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9 2008-05-09 00:13 --------- d-----w C:\Program Files\Oberon Media 2008-05-08 18:59 --------- d-----w C:\Documents and Settings\misty\Application Data\ImgBurn 2008-05-08 17:52 --------- d-----w C:\Program Files\YPOPs 2008-05-08 05:27 --------- d-----w C:\Program Files\MSXML 6.0 2008-05-08 04:52 --------- d-----w C:\Program Files\Microsoft.NET 2008-05-08 03:47 --------- d-----w C:\Program Files\Pidgin 2008-05-08 03:47 --------- d-----w C:\Program Files\Common Files\GTK 2008-05-08 03:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-08 03:03 --------- d-----w C:\Program Files\CyberLink 2008-05-08 03:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-08 02:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-07 06:23 --------- d-----w C:\Program Files\Fantastic Flame Screensaver 2008-05-07 06:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Laconic Software 2008-05-06 20:53 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-05-06 20:44 --------- d-----w C:\Program Files\Netflix 2008-05-06 20:42 --------- d-----w C:\Documents and Settings\misty\Application Data\vlc 2008-05-06 20:31 --------- d-----w C:\Program Files\VideoLAN 2008-05-06 19:28 --------- d-----w C:\Program Files\ImgBurn 2008-05-06 19:24 --------- d-----w C:\Program Files\DVDFab HD Decrypter 4 2008-05-06 19:19 --------- d-----w C:\Program Files\DVD Shrink 2008-05-06 18:53 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-05-06 18:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2008-05-06 17:46 --------- d-----w C:\Program Files\Common Files\Ahead 2008-05-01 13:17 --------- d-----w C:\Program Files\WIDCOMM . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\Documents and Settings\All Users\Application Data\nView_Profiles ---- ((((((((((((((((((((((((((((( snapshot@2008-06-13_23.16.07.56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-14 04:11:43 59,842 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-06-14 04:18:38 59,842 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-06-14 04:11:43 395,768 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-14 04:18:38 395,768 ----a-w C:\WINDOWS\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay] @={F2F31467-B1AC-4df0-AE79-FD5FA085E22B} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen] @={A3E208F7-0E3A-4182-A7A6-B169D5D691AA} [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}] 2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}] 2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-07-27 07:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 05:08 16342528 C:\WINDOWS\RTHDCPL.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 04:31 630784] "KTPWare"="C:\Program Files\Elantech\ktp.exe" [2007-02-13 15:11 647168] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 14:48 569344] "WLSS"="C:\Program Files\Wireless Select Switch\WLSS.exe" [2007-10-17 14:40 189736] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 13:51 823296] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-06-01 13:49 974848] "Wow Video&Audio"="C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe" [2007-05-03 20:51 951856] "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2007-03-28 22:23 49168] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-26 07:06 8462336] "nwiz"="nwiz.exe" [2007-06-26 07:06 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2007-06-26 07:06 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-12-11 18:35:34 561213] Fantastic Flame Agent.lnk - C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe [2007-04-24 15:33:26 25088] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-05-12 03:10:49 1678536] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] C:\WINDOWS\system32\psqlpwd.dll 2007-03-28 22:46 90112 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "C:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "C:\\Program Files\\Pidgin\\pidgin.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 13:16] R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-17 20:55] R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2007-03-28 22:15] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ee2c94-da25-11dc-8831-806d6172696f}] \Shell\AutoRun\command - D:\StartCD.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-14 10:08:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-14 10:08:21 ComboFix-quarantined-files.txt 2008-06-14 15:08:17 ComboFix2.txt 2008-06-14 04:16:28 Pre-Run: 237,006,196,736 bytes free Post-Run: 236,994,035,712 bytes free 169 --- E O F --- 2008-05-08 05:27:50 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Saturday, June 14, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, June 14, 2008 15:12:28 Records in database: 863600 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 36400 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 00:47:41 No malware has been detected. The scan area is clean. The selected area was scanned. -------------------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:05:23 PM, on 6/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\tlntsvr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Elantech\ktp.exe C:\WINDOWS\vsnp2uvc.exe C:\Program Files\Wireless Select Switch\WLSS.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Protector Suite QL\psqltray.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Documents and Settings\misty\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe O4 - HKLM\..\Run: [WLSS] C:\Program Files\Wireless Select Switch\WLSS.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Wow Video&Audio] C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Fantastic Flame Agent.lnk = C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210215948906 O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 7737 bytes -------------------------------------------------------------------------------- Never really noticed much of a change in the performance, just the annoying pop ups, bugs on the screen, and inability to change settings. System seems to be running smoothly but, u got any recommendations for antivirus programs? Thanks again *edit* somewhere around this site i think i saw an option to remove windows messenger, since i never use it i would like to disable/remove it. Last edited by mredraye82; 06-14-2008 at 12:26 PM. |
|
|
|
|
|
06-14-2008, 12:57 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,661
OS: XP SP3
|
Re: Warning! Spyware detected on your computer!
Hello again, mredraye82.
Download this good, free antivirus program, install it, update it, and run a full system scan. Avira Antivir PersonalEdition Classic See this tutorial on its setup and use. When the scan is complete, click on Report and post the logfile that opens in your next reply. If nothing is found, you needn't post the log. Do not install more than one antivirus program as they will conflict with each other. Update your antivirus once a week so it remains effective against new malware. ------------------------------------------------------ Please visit this website for help with disabling/removing Windows Messenger: http://www.pchell.com/support/removemessenger.shtml ------------------------------------------------------ Delete the following Folders if they still exist: C:\Documents and Settings\All Users\Application Data\nView_Profiles C:\Documents and Settings\All Users\Application Data\WildTangent Congratulations. Well done! Your logs appear clean. You should be good to go. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. FIREWALL Using a third-party Firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one Firewall program as they will conflict with each other.SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
06-14-2008, 04:07 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Re: Warning! Spyware detected on your computer!
Avira AntiVir Personal
Report file date: Saturday, June 14, 2008 17:05 Scanning for 1331584 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: [removed] Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: X Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 16:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 15:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 15:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 15:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 17:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 20:08:58 ANTIVIR2.VDF : 7.0.4.195 2546176 Bytes 6/14/2008 21:16:20 ANTIVIR3.VDF : 7.0.4.196 2048 Bytes 6/14/2008 21:16:20 Engineversion : 8.1.0.55 AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 16:58:21 AESCRIPT.DLL : 8.1.0.40 266618 Bytes 6/14/2008 21:18:34 AESCN.DLL : 8.1.0.21 119156 Bytes 6/14/2008 21:18:25 AERDL.DLL : 8.1.0.20 418165 Bytes 6/14/2008 21:18:20 AEPACK.DLL : 8.1.1.5 364918 Bytes 6/14/2008 21:18:00 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 6/14/2008 21:17:45 AEHEUR.DLL : 8.1.0.30 1253750 Bytes 6/14/2008 21:17:38 AEHELP.DLL : 8.1.0.15 115063 Bytes 6/14/2008 21:16:52 AEGEN.DLL : 8.1.0.28 307572 Bytes 6/14/2008 21:16:46 AEEMU.DLL : 8.1.0.6 430451 Bytes 6/14/2008 21:16:36 AECORE.DLL : 8.1.0.31 168310 Bytes 6/14/2008 21:16:29 AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/24/2008 00:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 17:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 20:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 1/24/2008 00:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 15:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 15:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 00:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/24/2008 00:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 19:05:10 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 21:37:25 RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 19:02:11 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Saturday, June 14, 2008 17:05 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'orbitnet.exe' - '1' Module(s) have been scanned Scan process 'Dot1XCfg.exe' - '1' Module(s) have been scanned Scan process 'BTSTAC~1.EXE' - '1' Module(s) have been scanned Scan process 'orbitdm.exe' - '1' Module(s) have been scanned Scan process 'FantasticFlameAgent.exe' - '1' Module(s) have been scanned Scan process 'BTTray.exe' - '1' Module(s) have been scanned Scan process 'rapimgr.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'psqltray.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'WVAMain.exe' - '1' Module(s) have been scanned Scan process 'iFrmewrk.exe' - '1' Module(s) have been scanned Scan process 'ZCfgSvc.exe' - '1' Module(s) have been scanned Scan process 'WLSS.exe' - '1' Module(s) have been scanned Scan process 'vsnp2uvc.exe' - '1' Module(s) have been scanned Scan process 'KTP.EXE' - '1' Module(s) have been scanned Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'tlntsvr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'MDM.EXE' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'btwdins.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 47 processes with 47 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '36' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\Deckard\System Scanner\backup\DOCUME~1\misty\LOCALS~1\Temp\.tt7.tmp.vbs [DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002 [NOTE] The file was moved to '48c8412c.qua'! C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '48bf478c.qua'! C:\System Volume Information\_restore{FC0B9B82-B9A8-4F0A-B75E-555C566D2C4B}\RP12\A0001408.vbs [DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002 [NOTE] The file was moved to '488447b9.qua'! C:\System Volume Information\_restore{FC0B9B82-B9A8-4F0A-B75E-555C566D2C4B}\RP12\A0001414.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '488447bf.qua'! C:\System Volume Information\_restore{FC0B9B82-B9A8-4F0A-B75E-555C566D2C4B}\RP6\A0000071.exe [DETECTION] Is the Trojan horse TR/Peed.JLG [NOTE] The file was moved to '488447c5.qua'! End of the scan: Saturday, June 14, 2008 17:40 Used time: 35:17 min The scan has been done completely. 3700 Scanning directories 383388 Files were scanned 5 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 5 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 383383 Files not concerned 8305 Archives were scanned 2 Warnings 5 Notes How do i delete files that are quarantined by this pr0g? Last edited by mredraye82; 06-14-2008 at 04:10 PM. |
|
|
|
|
06-14-2008, 05:11 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,661
OS: XP SP3
|
Re: Warning! Spyware detected on your computer!
Hello, mredraye82.
Items in quarantine are rendered inactive and can do no harm to your system as long as they stay in quarantine. The quarantine folder is emptied automatically every so often, although I don't know exactly how often Antivir does that. However, if you wish to delete an item in quarantine:
|
|
|
|
|
06-14-2008, 05:46 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Re: Warning! Spyware detected on your computer!
That worked great! So i can uninstall some of the programs now lol right?
i did install spywareblaster, that avira, and comodo firewall and did the uninstall of combofix |
|
|
|
|
06-14-2008, 05:58 PM
|
#10 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,661
OS: XP SP3
|
Re: Warning! Spyware detected on your computer!
Quote:
Are there programs you want to uninstall? Since you installed Comodo, make sure your Windows Firewall is disabled. You can check it in the Security Center of your Control Panel. Please let me know. |
|
|
|
|
|
06-14-2008, 06:08 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 7
OS: WinXP SP2
|
Re: Warning! Spyware detected on your computer!
Like the DSS and HiJackThis, Activescan, and the [4]-Submit_2008-06-14@10.07 and logs, etc on the desktop, i can delete those now?
Thanks again! Last edited by mredraye82; 06-14-2008 at 06:10 PM. |
|
|
|
| Thread Tools | |
|
|
