|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-12-2008, 07:56 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Internet not working, popups, very slow computer, HJT log posted, please help!
I'm including my log at the bottom. I'm not sure what is going on, I see no odd programs installed in Add/Remove Programs but there are a lot of weird things in my HJT log it seems....
Well the problem is my computer is dog slow, various internet pages do not work properly (eg Yahoo mail, Google search, etc...) while others do (such as this one!) and popups randomly appear from time to time to sell me, among other things, anti-spyware products! Wonderful.... If anyone can please help me with this I would be very very grateful! _____________________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:47:47 PM, on 6/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\PowerDVD\PDVDServ.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe c:\progra~1\common~1\instal~1\update~1\isuspm.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: (no name) - {32341E7E-C319-46DE-91D0-E30BB1A3CABA} - C:\WINDOWS\system32\xxyxWOgg.dll O2 - BHO: {85ec4c4e-f952-78e8-4154-8dec1f267983} - {389762f1-ced8-4514-8e87-259fe4c4ce58} - C:\WINDOWS\system32\fpdqmugq.dll O2 - BHO: (no name) - {638EC501-5504-421A-BB69-5C2FDBBC6886} - C:\WINDOWS\system32\byXNfEWQ.dll (file missing) O2 - BHO: (no name) - {6D58949E-18A4-4ED2-9B0F-8FC548AF5CD0} - C:\WINDOWS\system32\ssqRKbCr.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE lebeca web camera driver O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [BM53af381a] Rundll32.exe "C:\WINDOWS\system32\yemsltcn.dll",s O4 - HKLM\..\Run: [509c0b86] rundll32.exe "C:\WINDOWS\system32\ipaljbhg.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [Microsoft viri-check] viri-check.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Microsoft Configs 32] msgconfigrs.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000228.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft viri-check] viri-check.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Traian Popescu\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/a...v2.0.0.10.cab? O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O20 - Winlogon Notify: xxyxWOgg - C:\WINDOWS\SYSTEM32\xxyxWOgg.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: Warning homepage - C:\WINDOWS\warnhp.html -- End of file - 8285 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-16-2008, 05:14 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hello and welcome to TSF
Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
======== Logs Required C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt<----Attached |
|
|
|
|
06-16-2008, 10:06 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hello, thank you so much for your reply! Okay here are the contents of the main.txt file:
Deckard's System Scanner v20071014.68 Run by TP on 2008-06-16 23:46:47 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 4 Restore Point(s) -- 4: 2008-06-17 03:47:08 UTC - RP586 - Deckard's System Scanner Restore Point 3: 2008-06-17 03:22:53 UTC - RP585 - System Checkpoint 2: 2008-06-16 02:44:25 UTC - RP584 - System Checkpoint 1: 2008-06-15 02:22:59 UTC - RP583 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive C: has 0.87 GiB (less than 15%) free. -- HijackThis (run as TP.exe) -------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:49:42 PM, on 6/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\explorer.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Documents and Settings\TP\Desktop\dss.exe C:\PROGRA~1\HIJACK~1\TP.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: (no name) - {32341E7E-C319-46DE-91D0-E30BB1A3CABA} - C:\WINDOWS\system32\xxyxWOgg.dll O2 - BHO: (no name) - {39E5FD5D-355B-437B-A976-D6CE26171503} - (no file) O2 - BHO: (no name) - {3D727430-30AE-41B2-9BC0-B00696C45F33} - C:\WINDOWS\system32\ssqRKbCr.dll O2 - BHO: (no name) - {638EC501-5504-421A-BB69-5C2FDBBC6886} - C:\WINDOWS\system32\byXNfEWQ.dll (file missing) O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE lebeca web camera driver O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [509c0b86] rundll32.exe "C:\WINDOWS\system32\asqkhjqb.dll",b O4 - HKLM\..\Run: [BM53af381a] Rundll32.exe "C:\WINDOWS\system32\niborofo.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [Microsoft viri-check] viri-check.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Microsoft Configs 32] msgconfigrs.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft viri-check] viri-check.exe (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\TP\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/a...v2.0.0.10.cab? O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O20 - Winlogon Notify: xxyxWOgg - C:\WINDOWS\SYSTEM32\xxyxWOgg.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: Warning homepage - C:\WINDOWS\warnhp.html -- End of file - 7620 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) -------------------- backup-20080611-214735-170 O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\NERODV~1\NEROPH~1\data\Xtras\mssysmgr.exe -- File Associations ----------------------------------------------------------- .txt - txtfile - shell\open\command - notepad.exe %1 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfvfs02 (StarForce Protection VFS Driver (version 2.x)) - c:\windows\system32\drivers\sfvfs02.sys <Not Verified; Protection Technology; StarForce Protection System> S3 atimtag - c:\windows\system32\drivers\atimtag.sys (file missing) S3 ZSMC301b (lebeca web camera driver) - c:\windows\system32\drivers\usbvm31b.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ProtexisLicensing - "c:\program files\common files\protexis\license service\psiservice.exe" <Not Verified; ; PSIService> S3 Imapi Helper - "c:\program files\iso recorder\imapihelper.exe" <Not Verified; Alex Feinman; ISO Recorder> S4 aolsoftware - "c:\windows\qwert.exe" (file missing) S4 dll service (windows dll service) - "c:\windows\rund1132.exe" (file missing) S4 dllmgr64 - "c:\windows\dllmgr64.exe" (file missing) S4 Services - c:\windows\driver~1\i386\services.exe (file missing) S4 sysmgr64 - "c:\windows\sysmgr64.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: Description: RAID Controller Device ID: PCI\VEN_1039&DEV_0180&SUBSYS_810E1043&REV_01\3&267A616A&0&28 Manufacturer: Name: RAID Controller PNP Device ID: PCI\VEN_1039&DEV_0180&SUBSYS_810E1043&REV_01\3&267A616A&0&28 Service: Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Cisco Systems VPN Adapter Device ID: ROOT\NET\0000 Manufacturer: Cisco Systems Name: Cisco Systems VPN Adapter PNP Device ID: ROOT\NET\0000 Service: CVirtA -- Scheduled Tasks ------------------------------------------------------------- 2007-07-23 09:00:00 268 --a------ C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job -- Files created between 2008-05-16 and 2008-06-16 ----------------------------- 2008-06-16 01:32:34 99840 --a------ C:\WINDOWS\system32\ybycujsf.dll 2008-06-16 01:30:30 81408 --a------ C:\WINDOWS\system32\njkvdxsp.dll 2008-06-16 01:30:23 90112 --a------ C:\WINDOWS\system32\niborofo.dll 2008-06-14 21:59:52 98304 --a------ C:\WINDOWS\system32\wnaalqjp.dll 2008-06-14 21:56:37 89600 --a------ C:\WINDOWS\system32\tecjhunf.dll 2008-06-13 21:43:14 99328 --a------ C:\WINDOWS\system32\kpsxtyap.dll 2008-06-13 21:42:57 89600 --a------ C:\WINDOWS\system32\tbkyxsvc.dll 2008-06-12 21:41:22 0 --a------ C:\WINDOWS\system32\fpdqmugq.dll 2008-06-12 21:41:13 0 --a------ C:\WINDOWS\system32\yemsltcn.dll 2008-06-11 21:27:39 0 d-------- C:\TaskKiller 2008-06-11 21:02:16 0 --a------ C:\WINDOWS\system32\jdaqntlu.dll 2008-06-11 21:02:03 0 --a------ C:\WINDOWS\system32\ndahlwas.dll 2008-06-11 21:01:12 550081 --ahs---- C:\WINDOWS\system32\rCbKRqss.ini2 2008-06-11 21:01:08 321536 --a------ C:\WINDOWS\system32\ssqRKbCr.dll 2008-06-10 20:33:58 0 d-------- C:\Program Files\SpywareBlaster 2008-06-10 19:38:25 0 --a------ C:\WINDOWS\system32\ereuxejr.dll 2008-06-09 23:48:39 478110 --ahs---- C:\WINDOWS\system32\QWEfNXyb.ini2 2008-06-09 23:43:19 59904 --a------ C:\WINDOWS\system32\xxyxWOgg.dll 2008-06-08 01  32 38160 --a------ C:\WINDOWS\system32\LMRTREND.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System>2008-06-08 01 24 182032 --a------ C:\WINDOWS\system32\dxtmsft3.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System>2008-06-08 01 09 63488 --a------ C:\WINDOWS\system32\unam4ie.exe <Not Verified; Microsoft Corporation; DirectShow>2008-06-08 01:05:57 10240 --a------ C:\WINDOWS\system32\vidx16.dll 2008-06-08 01:05:57 194320 --a------ C:\WINDOWS\system32\qcut.dll <Not Verified; Microsoft Corporation; DirectShow> 2008-06-08 01:05:51 4608 --a------ C:\WINDOWS\system32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2008-06-08 01:05:51 2272 --a------ C:\WINDOWS\system32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2008-06-08 01:05:24 0 d-------- C:\Program Files\ArcSoft 2008-06-08 00:58:59 0 d-------- C:\Program Files\directx 2008-06-08 00:58:34 127038 --a------ C:\WINDOWS\Clement.exe 2008-06-08 00:58:33 2093106 --a------ C:\WINDOWS\select.exe <Not Verified; ; select Application> 2008-06-08 00:58:29 0 d-------- C:\WINDOWS\Options 2008-06-03 19:44:32 691545 --a------ C:\WINDOWS\unins000.exe 2008-06-03 19:44:32 2521 --a------ C:\WINDOWS\unins000.dat 2008-05-22 23:16:13 0 d-------- C:\Program Files\uTorrent 2008-05-22 23:16:09 0 d-------- C:\Documents and Settings\TP\Application Data\uTorrent 2008-05-18 02:22:22 0 d-------- C:\Program Files\Intel Desktop Board Audio Driver 2008-05-17 21:28:19 0 d-------- C:\WINDOWS\system32\CatRoot_bak -- Find3M Report --------------------------------------------------------------- 2008-06-16 21:54:54 0 d-------- C:\Program Files\Symantec AntiVirus 2008-06-14 23 26 0 d-------- C:\Documents and Settings\TP\Application Data\Lavasoft2008-06-08 01:05:22 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-07 13:52:59 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-15 22:01:10 0 d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint 2008-05-11 01:57:55 0 d-------- C:\Program Files\nFLVPlayer 2008-05-10 23:58:24 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-05-09 23:53:36 0 d-------- C:\Program Files\X-COM 2008-05-07 22:51:19 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-07 22:48:17 0 d-------- C:\Documents and Settings\TP\Application Data\AdobeUM 2008-03-19 05:47:00 1845248 --a------ C:\WINDOWS\system32\win32k.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32341E7E-C319-46DE-91D0-E30BB1A3CABA}] 06/09/2008 11:43 PM 59904 --a------ C:\WINDOWS\system32\xxyxWOgg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39E5FD5D-355B-437B-A976-D6CE26171503}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3D727430-30AE-41B2-9BC0-B00696C45F33}] 06/11/2008 09:01 PM 321536 --a------ C:\WINDOWS\system32\ssqRKbCr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{638EC501-5504-421A-BB69-5C2FDBBC6886}] C:\WINDOWS\system32\byXNfEWQ.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NWEReboot"="" [] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [] "ZoneAlarm Client"="C:\Program Files\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [02/16/2005 05:15 PM] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [02/16/2005 05:15 PM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [02/01/2008 12:13 AM] "509c0b86"="C:\WINDOWS\system32\asqkhjqb.dll" [] "BM53af381a"="C:\WINDOWS\system32\niborofo.dll" [06/16/2008 01:30 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Microsoft viri-check"=viri-check.exe "CU1"=C:\Program Files\Common Files\VCClient\VCClient.exe "CU2"=C:\Program Files\Common Files\VCClient\VCMain.exe "Microsoft Configs 32"=msgconfigrs.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) "ForceActiveDesktopOn"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\WINDOWS\warnhp.html FriendlyName= Warning homepage [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{32341E7E-C319-46DE-91D0-E30BB1A3CABA}"= C:\WINDOWS\system32\xxyxWOgg.dll [06/09/2008 11:43 PM 59904] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyxWOgg] xxyxWOgg.dll 06/09/2008 11:43 PM 59904 C:\WINDOWS\system32\xxyxWOgg.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ssqRKbCr "Notification Packages"= scecli scecli scecli scecli [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RasAuto"=3 (0x3) "SavRoam"=3 (0x3) "sysmgr64"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "RemoteControl"="C:\Program Files\PowerDVD\PDVDServ.exe" -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8713 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-06-16 23:52:33 ------------ Thanks again for your help! Last edited by naiart; 06-16-2008 at 10:09 PM. |
|
|
|
|
06-17-2008, 06:53 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hello again
This is one badly infected machine. Your logs suggest the possibility that your computer was attacked by a backdoor trojan. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? ======== Quote:
======== Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ======== P2P P2P - I see you have P2P software µTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========= Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
========= Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required Report.txt C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
06-17-2008, 10:07 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hi again, okay I've followed the steps and I'm posting the logs. I'm sorry it takes me so long to reply but I'm usually not in front of my computer until late! I've also noticed something, I'm not sure if this is relevant to anything, that stopping and restarting explorer.exe from the Task Manager will get all the websites that I couldn't access going again (such as Google, Yahoo Mail or even the combofix webpage). Anyway, here is the HJT log and I will attach the two others:
SDFix: Version 1.194 Run by Administrator on Tue 06/17/2008 at 10:08 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : services Path : C:\WINDOWS\Driver~1\i386\services.exe services - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\system32\xxyxWOgg.dll - Deleted C:\WINDOWS\system32\eraseme_01464.exe - Deleted C:\WINDOWS\system32\eraseme_65137.exe - Deleted C:\WINDOWS\system32\setup_67384.exe - Deleted C:\WINDOWS\system32\TFTP172 - Deleted C:\WINDOWS\system32\TFTP3292 - Deleted C:\WINDOWS\system32\TFTP3388 - Deleted C:\WINDOWS\system32\TFTP3504 - Deleted C:\WINDOWS\system32\TFTP3512 - Deleted C:\WINDOWS\system32\TFTP3576 - Deleted C:\WINDOWS\system32\TFTP3956 - Deleted C:\WINDOWS\system32\TFTP4020 - Deleted C:\WINDOWS\system32\TFTP4556 - Deleted C:\WINDOWS\system32\TFTP4720 - Deleted C:\WINDOWS\system32\TFTP4848 - Deleted C:\WINDOWS\system32\TFTP5048 - Deleted C:\WINDOWS\system32\TFTP5264 - Deleted C:\WINDOWS\system32\TFTP5444 - Deleted C:\WINDOWS\system32\TFTP908 - Deleted C:\WINDOWS\system32\zxdnt3d.cfg - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-17 22:26:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem20.CAT 12431 bytes C:\WINDOWS\KB951698.log 4631 bytes C:\WINDOWS\LastGood C:\WINDOWS\LastGood\INF C:\WINDOWS\LastGood\INF\oem20.inf 0 bytes C:\WINDOWS\LastGood\INF\oem20.PNF 0 bytes scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 7 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Mozilla Firefox\\firefox.exe"="C:\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\Media Player Classic\\mplayerc.exe"="C:\\Program Files\\Media Player Classic\\mplayerc.exe:*:Enabled:Media Player Classic" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Winamp\\winamp.exe"="C:\\Winamp\\winamp.exe:*:Enabled:Winamp" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Disabled:ćTorrent" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Disabled:eMule" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Disabled:RTC App Sharing" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 27 Dec 2007 88 A.SHR --- "C:\WINDOWS\system32\460A1FC05D.sys" Thu 27 Dec 2007 2,516 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Wed 16 Nov 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 16 Nov 2005 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv14.bak" Tue 22 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Wed 7 Mar 2007 24,576 ...H. --- "C:\Documents and Settings\TP\My Documents\My Received Files\~WRL0001.tmp" Wed 16 Nov 2005 4,348 ...H. --- "C:\Documents and Settings\TP\My Documents\My Music\License Backup\drmv1key.bak" Thu 3 May 2007 401 A..H. --- "C:\Documents and Settings\TP\My Documents\My Music\License Backup\drmv1lic.bak" Sat 25 Mar 2006 488 A.SH. --- "C:\Documents and Settings\TP\My Documents\My Music\License Backup\drmv2key.bak" Sun 18 May 2008 49,102,622 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\download\BITF9.tmp" Finished! ======= ComboFix 08-06-16.5 - TP 2008-06-17 23:25:05.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.532 [GMT -4:00] Running from: C:\Documents and Settings\TP\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\TP\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\TP\Application Data\macromedia\Flash Player\#SharedObjects\P7YFLHTC\iforex.com C:\Documents and Settings\TP\Application Data\macromedia\Flash Player\#SharedObjects\P7YFLHTC\iforex.com\Emerp\Events\flash_object.swf\user_data.sol C:\Documents and Settings\TP\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com C:\Documents and Settings\TP\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol C:\Program Files\Common Files\download C:\Program Files\Common Files\download\freeprodtb.exe C:\WINDOWS\BM53af381a.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\bqjhkqsa.ini C:\WINDOWS\system32\csivbipt.ini C:\WINDOWS\system32\dllvhpjn.ini C:\WINDOWS\system32\eywqmals.ini C:\WINDOWS\system32\fbmprjau.dll C:\WINDOWS\system32\fpiyymxg.ini C:\WINDOWS\system32\ghbjlapi.ini C:\WINDOWS\system32\kpsxtyap.dll C:\WINDOWS\system32\lkycoxdg.dll C:\WINDOWS\system32\niborofo.dll C:\WINDOWS\system32\njkvdxsp.dll C:\WINDOWS\system32\njphvlld.dll C:\WINDOWS\system32\psxdvkjn.ini C:\WINDOWS\system32\QWEfNXyb.ini C:\WINDOWS\system32\QWEfNXyb.ini2 C:\WINDOWS\system32\rCbKRqss.ini C:\WINDOWS\system32\rCbKRqss.ini2 C:\WINDOWS\system32\ssqRKbCr.dll C:\WINDOWS\system32\tbkyxsvc.dll C:\WINDOWS\system32\tecjhunf.dll C:\WINDOWS\system32\typhjwwn.ini C:\WINDOWS\system32\wcpit.exe C:\WINDOWS\system32\wnaalqjp.dll C:\WINDOWS\system32\ybycujsf.dll C:\WINDOWS\whcc-giant.exe . ((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 ))))))))))))))))))))))))))))))) . 2008-06-17 22:34 . 2008-06-17 22:34 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-06-17 21:58 . 2008-06-17 21:59 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-17 20:56 . 2008-06-17 22:41 <DIR> d-------- C:\SDFix 2008-06-16 23:44 . 2008-06-16 23:44 <DIR> d-------- C:\Deckard 2008-06-11 21:27 . 2008-06-11 21:27 <DIR> d-------- C:\TaskKiller 2008-06-10 22:05 . 2008-06-10 22:05 93 --a------ C:\WINDOWS\wininit.ini 2008-06-10 20:33 . 2008-06-10 21:00 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 23:03 . 2008-06-09 23:03 167,613 --a------ C:\87100_3_123_1122lo.jpg 2008-06-09 23:03 . 2008-06-09 23:03 162,937 --a------ C:\87113_5_123_255lo.jpg 2008-06-09 23:03 . 2008-06-09 23:03 160,617 --a------ C:\87112_4_123_416lo.jpg 2008-06-08 01:06 . 1998-08-27 00:51 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll 2008-06-08 01:06 . 1998-08-20 07:02 140,800 --a------ C:\WINDOWS\system32\tm20dec.ax 2008-06-08 01:06 . 1998-09-02 04:28 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe 2008-06-08 01:06 . 1998-09-02 04:28 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll 2008-06-08 01:06 . 2008-06-08 01:18 777 --a------ C:\WINDOWS\videoimp.ini 2008-06-08 01:05 . 2008-06-08 01:05 <DIR> d-------- C:\Program Files\ArcSoft 2008-06-08 01:05 . 1998-09-02 04:02 194,320 --a------ C:\WINDOWS\system32\qcut.dll 2008-06-08 01:05 . 1998-08-17 05:21 11,776 --a------ C:\WINDOWS\system32\mciqtz.drv 2008-06-08 01:05 . 1998-08-17 05:21 10,240 --a------ C:\WINDOWS\system32\vidx16.dll 2008-06-08 01:05 . 1998-08-17 05:21 5,672 --a------ C:\WINDOWS\system32\quartz.vxd 2008-06-08 01:05 . 2008-06-08 01:05 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll 2008-06-08 01:05 . 2008-06-08 01:05 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll 2008-06-08 01:05 . 2001-06-20 10:04 21 --a------ C:\WINDOWS\VI_setup.ini 2008-06-08 01:04 . 2008-06-08 01:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-08 01:04 . 2008-06-08 01:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-08 00:58 . 2008-06-08 00:58 <DIR> d-------- C:\Program Files\directx 2008-06-03 19:45 . 2008-06-17 20:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-03 19:44 . 2008-06-03 19:43 691,545 --a------ C:\WINDOWS\unins000.exe 2008-06-03 19:44 . 2008-06-03 19:44 2,521 --a------ C:\WINDOWS\unins000.dat 2008-06-03 00:45 . 2008-06-03 00:45 38,528 --a------ C:\CV.pdf 2008-05-19 22:38 . 2008-05-19 22:38 118,784 --a------ C:\Lexus-IS-F_2008_5b.jpg 2008-05-19 22:38 . 2008-05-19 22:38 108,290 --a------ C:\Lexus-IS-F_2008_09.jpg 2008-05-19 22:37 . 2008-05-19 22:37 190,120 --a------ C:\Lexus-IS-F_2008_2c.jpg 2008-05-19 22:37 . 2008-05-19 22:37 135,168 --a------ C:\Lexus-IS-F_2008_5a.jpg 2008-05-19 22:37 . 2008-05-19 22:37 110,325 --a------ C:\Lexus-IS-F_2008_22.jpg 2008-05-19 22:29 . 2008-05-19 22:29 133,834 --a------ C:\m3sedan08_07.jpg 2008-05-19 22:29 . 2008-05-19 22:29 92,213 --a------ C:\lexusisf08_05.jpg 2008-05-19 22:24 . 2008-05-19 22:24 29,805 --a------ C:\08.audi.rs6.act.f34.1.500.jpg 2008-05-19 22:24 . 2008-05-19 22:25 28,634 --a------ C:\08.audi.rs6.act.r34.3.500.jpg 2008-05-19 22:23 . 2008-05-19 22:23 32,122 --a------ C:\08.audi.rs6.act.f34.8.500.jpg 2008-05-19 22:21 . 2008-05-19 22:25 209,366 --a------ C:\rs608_interior21600.jpg 2008-05-19 22:18 . 2008-05-19 22:18 97,022 --a------ C:\car_photo_248796_25.jpg 2008-05-19 22:14 . 2008-05-19 22:14 112,603 --a------ C:\m3sedan08_06.jpg 2008-05-19 22:08 . 2008-05-19 22:08 249,645 --a------ C:\186_1.jpg 2008-05-18 02:38 . 2003-08-29 15:09 578,304 --a------ C:\WINDOWS\system32\drivers\smwdm.sys 2008-05-18 02:38 . 2002-04-01 14:15 4,816 --a------ C:\WINDOWS\system32\drivers\aeaudio.sys 2008-05-18 02:38 . 2003-04-08 11:30 3,744 --a------ C:\WINDOWS\system32\drivers\smsens.sys 2008-05-18 02:22 . 2008-05-18 02:22 <DIR> d-------- C:\Program Files\Intel Desktop Board Audio Driver 2008-05-18 01:03 . 2008-05-18 01:03 76,939 --a------ C:\Copyofmeltdown.jpg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-18 03:35 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-06-18 00:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-15 03:06 --------- d-----w C:\Documents and Settings\TP\Application Data\Lavasoft 2008-06-08 05:05 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-18 07:10 --------- d-----w C:\Program Files\eMule 2008-05-16 02:01 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint 2008-05-13 01:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters 2008-05-11 05:57 --------- d-----w C:\Program Files\nFLVPlayer 2008-05-10 03:53 --------- d-----w C:\Program Files\X-COM 2008-05-08 23:50 20 -c-h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT 2008-05-08 02:51 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-08 02:48 --------- d-----w C:\Documents and Settings\TP\Application Data\AdobeUM 2008-01-14 00:18 23,864 -c--a-w C:\Documents and Settings\TP\Application Data\GDIPFONTCACHEV1.DAT 2007-12-27 04:07 88 --sha-r C:\WINDOWS\system32\460A1FC05D.sys 2007-12-27 04:07 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys 2005-07-29 21:24 472 -csha-r C:\WINDOWS\VHJhaWFuIFBvcGVzY3U\pJL1uqIRKI1Sw3pWsao.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{638EC501-5504-421A-BB69-5C2FDBBC6886}] C:\WINDOWS\system32\byXNfEWQ.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NWEReboot"="" [] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [ ] "ZoneAlarm Client"="C:\Program Files\ZoneAlarm\zlclient.exe" [2007-03-09 00:02 919280] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 17:15 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Microsoft viri-check"="viri-check.exe" [] "CU1"="C:\Program Files\Common Files\VCClient\VCClient.exe" [ ] "CU2"="C:\Program Files\Common Files\VCClient\VCMain.exe" [ ] "Microsoft Configs 32"="msgconfigrs.exe" [] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\WINDOWS\warnhp.html FriendlyName= Warning homepage [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli scecli scecli [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 3100 Series] --a--c--- 2003-09-03 22:33 106496 C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBRKsk] --a--c--- 2003-06-13 10:57 294912 C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 13:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RasAuto"=3 (0x3) "SavRoam"=3 (0x3) "sysmgr64"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "RemoteControl"="C:\Program Files\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Winamp\\winamp.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= R3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [2003-04-09 11:17] S4 aolsoftware;AolSoftware;"C:\WINDOWS\qwert.exe" [] S4 dll service;windows dll service;"C:\WINDOWS\rund1132.exe" [] S4 dllmgr64;dllmgr64;"C:\WINDOWS\dllmgr64.exe" [] S4 sysmgr64;sysmgr64;"C:\WINDOWS\sysmgr64.exe" [] . Contents of the 'Scheduled Tasks' folder "2007-07-23 13:00:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job" - C:\Program Files\Spybot\SpybotSD.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-17 23:38:17 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe . ************************************************************************** . Completion time: 2008-06-17 23:51:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-18 03:51:17 Pre-Run: 725,151,744 bytes free Post-Run: 589,213,696 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 212 --- E O F --- 2008-05-29 02:11:01 ======== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:59:31 PM, on 6/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: (no name) - {638EC501-5504-421A-BB69-5C2FDBBC6886} - C:\WINDOWS\system32\byXNfEWQ.dll (file missing) O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE lebeca web camera driver O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [Microsoft viri-check] viri-check.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Microsoft Configs 32] msgconfigrs.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft viri-check] viri-check.exe (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\TP\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/a...v2.0.0.10.cab? O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: Warning homepage - C:\WINDOWS\warnhp.html -- End of file - 6551 bytes ___________ Thanks again for your help! Last edited by TheBruce1; 06-18-2008 at 06:44 AM. |
|
|
|
|
06-18-2008, 07:24 AM
|
#6 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hello again naiart
Quote:
Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly ======= Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
======== Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ========== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
Animated Tutorial Here To optimize scanning time and produce a more sensible report for review:
======== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Kaspersky Scan Log Hijackthis Log How is you system running now. |
||
|
|
|
|
06-18-2008, 10:56 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hi, okay I followed the stepss, the offline installation of Java didn't download so I used the online install file and that seemed to work fine. Here is the combofix.txt log: (I'm running the Kaspersky scanner now, I will leave it on overnight as it seems to take a while, and post the results tomorrow). Yes, everything seems to be running a lot better now! Thanks again for your help.
___________ ComboFix 08-06-16.5 - TP 2008-06-18 22:57:o6.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.579 [GMT -4:o0] Running from: C:\Documents and Settings\TP\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\TP\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\dllmgr64.exe C:\WINDOWS\qwert.exe C:\WINDOWS\rund1132.exe C:\WINDOWS\sysmgr64.exe C:\WINDOWS\VHJhaWFuIFBvcGVzY3U\pJL1uqIRKI1Sw3pWsao.vbs C:\WINDOWS\videoimp.ini C:\WINDOWS\warnhp.html C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\enewsletterpro1.dat C:\WINDOWS\VHJhaWFuIFBvcGVzY3U\pJL1uqIRKI1Sw3pWsao.vbs C:\WINDOWS\videoimp.ini C:\WINDOWS\wininit.ini C:\WINDOWS\winsysupd41.dat C:\WINDOWS\winsysupd51.dat C:\WINDOWS\winsysupd61.dat . ((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 ))))))))))))))))))))))))))))))) . 2008-06-17 22:32 . 2008-04-14 07:o1 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-17 21:58 . 2008-06-17 21:59 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-17 20:56 . 2008-06-17 22:41 <DIR> d-------- C:\SDFix 2008-06-16 23:44 . 2008-06-16 23:44 <DIR> d-------- C:\Deckard 2008-06-11 21:27 . 2008-06-11 21:27 <DIR> d-------- C:\TaskKiller 2008-06-10 20:33 . 2008-06-10 21:o0 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 23:o3 . 2008-06-09 23:o3 167,613 --a------ C:\87100_3_123_1122lo.jpg 2008-06-09 23:o3 . 2008-06-09 23:o3 162,937 --a------ C:\87113_5_123_255lo.jpg 2008-06-09 23:o3 . 2008-06-09 23:o3 160,617 --a------ C:\87112_4_123_416lo.jpg 2008-06-08 01:o6 . 1998-08-27 00:51 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll 2008-06-08 01:o6 . 1998-08-20 07:o2 140,800 --a------ C:\WINDOWS\system32\tm20dec.ax 2008-06-08 01:o6 . 1998-09-02 04:28 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe 2008-06-08 01:o6 . 1998-09-02 04:28 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll 2008-06-08 01:o5 . 2008-06-08 01:o5 <DIR> d-------- C:\Program Files\ArcSoft 2008-06-08 01:o5 . 1998-09-02 04:o2 194,320 --a------ C:\WINDOWS\system32\qcut.dll 2008-06-08 01:o5 . 1998-08-17 05:21 11,776 --a------ C:\WINDOWS\system32\mciqtz.drv 2008-06-08 01:o5 . 1998-08-17 05:21 10,240 --a------ C:\WINDOWS\system32\vidx16.dll 2008-06-08 01:o5 . 1998-08-17 05:21 5,672 --a------ C:\WINDOWS\system32\quartz.vxd 2008-06-08 01:o5 . 2008-06-08 01:o5 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll 2008-06-08 01:o5 . 2008-06-08 01:o5 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll 2008-06-08 01:o5 . 2001-06-20 10:o4 21 --a------ C:\WINDOWS\VI_setup.ini 2008-06-08 01:o4 . 2008-06-08 01:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-08 01:o4 . 2008-06-08 01:o8 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-08 00:58 . 2008-06-08 00:58 <DIR> d-------- C:\Program Files\directx 2008-06-03 19:45 . 2008-06-17 20:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-03 19:44 . 2008-06-03 19:43 691,545 --a------ C:\WINDOWS\unins000.exe 2008-06-03 19:44 . 2008-06-03 19:44 2,521 --a------ C:\WINDOWS\unins000.dat 2008-06-03 00:45 . 2008-06-03 00:45 38,528 --a------ C:\CV.pdf 2008-05-19 22:38 . 2008-05-19 22:38 118,784 --a------ C:\Lexus-IS-F_2008_5b.jpg 2008-05-19 22:38 . 2008-05-19 22:38 108,290 --a------ C:\Lexus-IS-F_2008_09.jpg 2008-05-19 22:37 . 2008-05-19 22:37 190,120 --a------ C:\Lexus-IS-F_2008_2c.jpg 2008-05-19 22:37 . 2008-05-19 22:37 135,168 --a------ C:\Lexus-IS-F_2008_5a.jpg 2008-05-19 22:37 . 2008-05-19 22:37 110,325 --a------ C:\Lexus-IS-F_2008_22.jpg 2008-05-19 22:29 . 2008-05-19 22:29 133,834 --a------ C:\m3sedan08_07.jpg 2008-05-19 22:29 . 2008-05-19 22:29 92,213 --a------ C:\lexusisf08_05.jpg 2008-05-19 22:24 . 2008-05-19 22:24 29,805 --a------ C:\08.audi.rs6.act.f34.1.500.jpg 2008-05-19 22:24 . 2008-05-19 22:25 28,634 --a------ C:\08.audi.rs6.act.r34.3.500.jpg 2008-05-19 22:23 . 2008-05-19 22:23 32,122 --a------ C:\08.audi.rs6.act.f34.8.500.jpg 2008-05-19 22:21 . 2008-05-19 22:25 209,366 --a------ C:\rs608_interior21600.jpg 2008-05-19 22:18 . 2008-05-19 22:18 97,022 --a------ C:\car_photo_248796_25.jpg 2008-05-19 22:14 . 2008-05-19 22:14 112,603 --a------ C:\m3sedan08_06.jpg 2008-05-19 22:o8 . 2008-05-19 22:o8 249,645 --a------ C:\186_1.jpg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-19 03:10 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-06-18 01:50 368,640 ----a-w C:\WINDOWS\Internet Logs\xDBA7.tmp 2008-06-18 00:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-15 03:o6 --------- d-----w C:\Documents and Settings\TP\Application Data\Lavasoft 2008-06-14 03:29 339,968 ----a-w C:\WINDOWS\Internet Logs\xDBA6.tmp 2008-06-09 04:17 429,568 ----a-w C:\WINDOWS\Internet Logs\xDBA5.tmp 2008-06-08 05:o5 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-04 03:30 3,098,624 ----a-w C:\WINDOWS\Internet Logs\xDBA4.tmp 2008-06-03 00:o0 31,873,414 -c--a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-05-18 07:10 --------- d-----w C:\Program Files\eMule 2008-05-18 06:22 --------- d-----w C:\Program Files\Intel Desktop Board Audio Driver 2008-05-16 02:o1 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint 2008-05-13 01:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters 2008-05-11 05:57 --------- d-----w C:\Program Files\nFLVPlayer 2008-05-10 03:53 --------- d-----w C:\Program Files\X-COM 2008-05-09 05:34 1,278,464 ----a-w C:\WINDOWS\Internet Logs\xDBA3.tmp 2008-05-08 23:50 20 -c-h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-08 02:51 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-08 02:48 --------- d-----w C:\Documents and Settings\TP\Application Data\AdobeUM 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-03 06:17 182,272 ----a-w C:\WINDOWS\Internet Logs\xDBA2.tmp 2008-05-02 04:32 2,758,144 ----a-w C:\WINDOWS\Internet Logs\xDBA1.tmp 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-11 05:37 3,452,928 -c--a-w C:\WINDOWS\Internet Logs\xDBA0.tmp 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-20 05:o1 5,042,176 -c--a-w C:\WINDOWS\Internet Logs\xDB9E.tmp 2008-03-20 05:o1 2,122,240 -c--a-w C:\WINDOWS\Internet Logs\xDB9F.tmp 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-01-14 00:18 23,864 -c--a-w C:\Documents and Settings\TP\Application Data\GDIPFONTCACHEV1.DAT 2007-12-27 04:o7 88 --sha-r C:\WINDOWS\system32\460A1FC05D.sys 2007-12-27 04:o7 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-06-17_23.50.37.56 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-07 04:55:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll + 2008-05-07 05:12:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll + 2008-05-07 05:o4:15 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll + 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll - 2008-06-18 03:37:o5 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-19 03:o4:o5 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-14 11:o1:o2 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-03-01 13:o6:20 124,928 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll + 2008-03-01 13:o6:21 347,136 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll + 2008-03-01 13:o6:21 214,528 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll + 2008-03-01 13:o6:21 133,120 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll + 2008-03-01 13:o6:21 63,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll + 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe + 2008-03-01 13:o6:21 153,088 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll + 2008-03-01 13:o6:21 230,400 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll + 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll + 2008-03-01 13:o6:22 383,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll + 2008-03-01 13:o6:22 384,512 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll + 2008-03-01 13:o6:24 6,066,176 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll + 2008-03-01 13:o6:24 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll + 2008-03-01 13:o6:25 267,776 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll + 2008-02-22 10:o0:51 13,824 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe + 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe + 2008-03-01 13:o6:25 27,648 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll + 2008-03-01 13:o6:26 459,264 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll + 2008-03-01 13:o6:26 52,224 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll + 2008-03-01 22:36:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll + 2008-03-01 13:o6:28 478,208 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll + 2008-03-01 13:o6:28 193,024 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll + 2008-03-01 13:o6:29 671,232 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll + 2008-03-01 13:o6:29 102,912 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll + 2008-03-01 13:o6:29 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll + 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll + 2008-03-01 13:o6:29 105,984 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\url.dll + 2008-03-01 13:o6:30 1,159,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll + 2008-03-01 13:o6:30 233,472 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll + 2008-03-01 13:o6:31 826,368 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll - 2008-03-01 13:o6:20 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2008-03-01 13:o6:20 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-04-23 04:16:28 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll - 2008-03-01 13:o6:21 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-04-23 04:16:28 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-03-01 13:o6:21 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-04-23 04:16:28 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2008-03-01 13:o6:21 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-04-23 04:16:28 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2008-03-01 13:o6:21 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll + 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2008-03-01 13:o6:21 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2008-03-01 13:o6:21 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2008-02-15 05:44:25 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2008-04-20 05:o7:51 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll - 2008-03-01 13:o6:22 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2008-03-01 13:o6:22 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2008-03-01 13:o6:24 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2008-03-01 13:o6:24 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll - 2008-03-01 13:o6:25 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2008-02-22 10:o0:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe + 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe - 2008-03-01 13:o6:25 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-04-23 04:16:28 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2008-03-01 13:o6:26 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2008-03-01 13:o6:26 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2008-03-01 22:36:30 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-04-24 02:16:30 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2008-03-01 13:o6:28 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-04-23 04:16:28 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2008-03-01 13:o6:28 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-04-23 04:16:28 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2008-03-01 13:o6:29 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-04-23 04:16:28 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2008-03-01 13:o6:29 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll + 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll - 2008-03-01 13:o6:29 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-04-23 04:16:28 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-10-29 22:43:o3 1,287,680 -c----w C:\WINDOWS\system32\dllcache\quartz.dll + 2008-05-07 05:18:48 1,287,680 -c----w C:\WINDOWS\system32\dllcache\quartz.dll - 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys + 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys - 2008-03-01 13:o6:29 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll + 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll - 2008-03-01 13:o6:30 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-04-23 04:16:29 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-03-01 13:o6:30 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll - 2008-03-01 13:o6:31 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-04-23 04:16:29 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2004-08-04 06:10:37 274,304 -c--a-w C:\WINDOWS\system32\drivers\bthport.sys + 2008-04-14 11:o1:o2 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys - 2008-03-01 13:o6:21 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2008-03-01 13:o6:21 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2008-03-01 13:o6:21 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll - 2008-03-01 13:o6:21 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2008-04-23 04:16:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2008-02-29 08:55:23 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2008-04-22 07:39:58 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2008-03-01 13:o6:21 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2008-04-23 04:16:28 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2008-03-01 13:o6:21 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2008-04-23 04:16:28 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2008-04-20 05:o7:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2008-03-01 13:o6:22 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2008-04-23 04:16:28 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2008-03-01 13:o6:22 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2008-04-23 04:16:28 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2008-03-01 13:o6:24 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll + 2008-04-23 04:16:28 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2008-03-01 13:o6:24 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll + 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2008-03-01 13:o6:25 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2008-04-23 04:16:28 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2008-02-22 10:o0:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2008-03-01 13:o6:25 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-04-23 04:16:28 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2008-05-09 21:35:o4 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe - 2008-03-01 13:o6:26 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2008-04-23 04:16:28 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2008-03-01 13:o6:26 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2008-04-23 04:16:28 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2008-03-01 22:36:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-04-24 02:16:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-03-01 13:o6:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2008-03-01 13:o6:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-04-23 04:16:28 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2008-03-01 13:o6:29 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-04-23 04:16:28 671,232 ----a-w C:\WINDOWS\system32\mstime.dll - 2008-03-01 13:o6:29 102,912 ----a-w C:\WINDOWS\system32\occache.dll + 2008-04-23 04:16:28 102,912 ----a-w C:\WINDOWS\system32\occache.dll - 2008-03-01 13:o6:29 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2008-03-20 18:41:20 14,640 ----a-w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll - 2008-03-01 13:o6:29 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-04-23 04:16:28 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2008-03-01 13:o6:30 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-03-01 13:o6:30 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-06-19 03:o4:44 40,960 ----a-w C:\WINDOWS\Temp\rtdrvmon.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NWEReboot"="" [] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [ ] "ZoneAlarm Client"="C:\Program Files\ZoneAlarm\zlclient.exe" [2007-03-09 00:o2 919280] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 17:15 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli scecli scecli [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 3100 Series] --a--c--- 2003-09-03 22:33 106496 C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBRKsk] --a--c--- 2003-06-13 10:57 294912 C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 13:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RasAuto"=3 (0x3) "SavRoam"=3 (0x3) "sysmgr64"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "RemoteControl"="C:\Program Files\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:o0000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:o0000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Winamp\\winamp.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= R3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [2003-04-09 11:17] S4 aolsoftware;AolSoftware;"C:\WINDOWS\qwert.exe" [] S4 dll service;windows dll service;"C:\WINDOWS\rund1132.exe" [] S4 dllmgr64;dllmgr64;"C:\WINDOWS\dllmgr64.exe" [] S4 sysmgr64;sysmgr64;"C:\WINDOWS\sysmgr64.exe" [] . Contents of the 'Scheduled Tasks' folder "2007-07-23 13:o0:o0 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job" - C:\Program Files\Spybot\SpybotSD.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-18 23:o5:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe . ************************************************************************** . Completion time: 2008-06-18 23:18:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-19 03:18:12 ComboFix2.txt 2008-06-18 03:51:35 Pre-Run: 888,370,176 bytes free Post-Run: 869,147,648 bytes free 358 --- E O F --- 2008-06-18 04:o8:42 |
|
|
|
|
06-19-2008, 06:10 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Ok here are the Kaspersky log and the HJT log. Thanks!
____________ -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, June 19, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, June 18, 2008 15:36:21 Records in database: 878919 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ G:\ Scan statistics: Files scanned: 55400 Threat name: 8 Infected objects: 8 Suspicious objects: 0 Duration of the scan: 02:13:43 File name / Threat name / Threats count C:\Cars\New Folder (5)\Rover\New Folder (6)\p6_2458jw.jpg Infected: Trojan-Clicker.HTML.IFrame.rp 1 C:\Documents and Settings\TP\My Documents\Downloads\Estelle - American Boy ft Kanye West [2008].zip Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\Program Files\Common Files\Download\freeprodtb.exe.vir Infected: Backdoor.Win32.Agent.bpk 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fbmprjau.dll.vir Infected: Trojan.Win32.Monder.vq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kpsxtyap.dll.vir Infected: Trojan.Win32.Monder.qf 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lkycoxdg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.yza 1 C:\QooBox\Quarantine\C\WINDOWS\system32\njphvlld.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.yyr 1 C:\SDFix\backups\backups.zip Infected: not-a-virus:AdWare.Win32.Virtumonde.xbg 1 The selected area was scanned. ____________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:08:15 AM, on 6/19/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\Mozilla Firefox\firefox.exe C:\Documents and Settings\TP\Local Settings\Temp\jkos-TP\binaries\ScanningProcess.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE lebeca web camera driver O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\TP\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/a...v2.0.0.10.cab? O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6404 bytes |
|
|
|
|
06-19-2008, 07:18 AM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hello again
Delete these files in red. C:\Cars\New Folder (5)\Rover\New Folder (6)\p6_2458jw.jpg C:\Documents and Settings\TP\My Documents\Downloads\Estelle - American Boy ft Kanye West [2008].zip =========== If there are no further problems your good to go, delete SDFix from your desktop, also delete this folder C:\SDFix. You can keep ATF-Cleaner if you wish. =========== Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ========== Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
|
06-19-2008, 09:22 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 6
OS: Win XP SP2
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Hi, Okay I followed your steps and everything seems to be working great now! Thank you so much again. You've been really helpful and I'd like to donate a little something - do you have any sort of online donation, like PayPal? Thanks again.
|
|
|
|
|
06-20-2008, 05:42 AM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Internet not working, popups, very slow computer, HJT log posted, please help!
Yes we do, see this link http://www.techsupportforum.com/vbse...url=donate.php and thank you.
|
|
|
|
| Thread Tools | |
|
|
