|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-24-2008, 07:21 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Hijacked for the 1st time. Please help.
My son clicked on a link whilst on MSN and the computer is now running slow with numerous pop ups.
I have attached my Hijack log after running the following programs but problems still exist. AVG Spybot S&D LSP fix CWShredder I am also unable to turn on Automatic Updates so not sure if this is related. Any help greatly appreciated. Logfile of HijackThis v1.99.1 Scan saved at 8:30:30 PM, on 24/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\iPod\bin\iPodService.exe F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IEMonitor.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Eddie\Desktop\Security\HijackThis.exe O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {F86B11F3-0CE1-475F-9541-5329BF7B3597} - C:\WINDOWS\system32\rqRIabbc.dll O2 - BHO: (no name) - {FE86D569-130D-4EAC-B10D-EBAD68CA25E2} - C:\WINDOWS\system32\khfFWqpP.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BM4f32ead7] Rundll32.exe "C:\WINDOWS\system32\weruwbqm.dll",s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: rqRIabbc - C:\WINDOWS\SYSTEM32\rqRIabbc.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-25-2008, 09:14 AM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Hello and Welcome.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. I need more information before continuing, please. For now, I'd like a more comprehensive set of logs from Deckard's System Scanner. --------------------------------------------------------------------------------------------- You are using an outdated version of HijackThis. Please uninstall from Add/Remove programs, and delete your current version. Next, download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. When it does, just close it, please. Next.... --------------------------------------------------------------------------------------------- Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-26-2008, 06:43 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Thanks for the quick reply,
Here is the latest HJ log generated from running DSS. I have also attached the results of Active Scan. Thanks for your help, Deckard's System Scanner v20071014.68 Run by Eddie on 2008-06-26 19:38:49 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 70: 2008-06-26 10:08:59 UTC - RP382 - Deckard's System Scanner Restore Point 69: 2008-06-25 09:38:59 UTC - RP381 - Removed Microsoft Office Publisher 2007 Trial 68: 2008-06-25 09:37:31 UTC - RP380 - Removed Windows Live Sign-in Assistant 67: 2008-06-25 09:36:26 UTC - RP379 - Removed Windows Live Messenger 66: 2008-06-25 09:35:15 UTC - RP378 - Removed MSXML 4.0 SP2 Parser and SDK -- First Restore Point -- 1: 2008-06-20 11:18:59 UTC - RP313 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 503 MiB (512 MiB recommended). System Drive C: has 7.44 GiB (less than 15%) free. -- HijackThis (run as Eddie.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:41:10 PM, on 26/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\lexpps.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\igfxsrvc.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE G:\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Eddie.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {B1393157-10BB-4E07-8998-17140C7BD80C} - C:\WINDOWS\system32\khfFWqpP.dll (file missing) O2 - BHO: (no name) - {F86B11F3-0CE1-475F-9541-5329BF7B3597} - C:\WINDOWS\system32\rqRIabbc.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BM4f32ead7] Rundll32.exe "C:\WINDOWS\system32\weruwbqm.dll",s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O20 - Winlogon Notify: rqRIabbc - C:\WINDOWS\ O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7640 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System> S3 nocashio - c:\windows\system32\drivers\nocashio.sys S3 USBAAPL (Apple Mobile USB Driver) - c:\windows\system32\drivers\usbaapl.sys <Not Verified; Apple, Inc.; Apple Mobile Device USB Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318} Description: SCSI/RAID Host Controller Device ID: ACPI\PNPA000\4&5D18F2DF&0 Manufacturer: (Standard mass storage controllers) Name: SCSI/RAID Host Controller PNP Device ID: ACPI\PNPA000\4&5D18F2DF&0 Service: a3lc9ohk -- Scheduled Tasks ------------------------------------------------------------- 2008-06-21 13:05:06 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-05-26 and 2008-06-26 ----------------------------- 2008-06-26 19:37:36 0 d-------- C:\Program Files\Trend Micro 2008-06-25 20:53:06 67672 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2008-06-25 19:51:13 0 d-------- C:\Program Files\SpywareBlaster 2008-06-24 18:04:51 81920 --a------ C:\WINDOWS\system32\mlkbtawm.dll 2008-06-24 17:52:51 91136 --a------ C:\WINDOWS\system32\weruwbqm.dll 2008-06-23 19:57:46 0 dr-h----- C:\Documents and Settings\Eddie\Recent 2008-06-22 17:42:42 90112 --a------ C:\WINDOWS\system32\euwwdowp.dll 2008-06-22 17:41:59 469022 --ahs---- C:\WINDOWS\system32\PpqWFfhk.ini2 2008-06-22 11:47:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-22 10:31:07 90112 --a------ C:\WINDOWS\system32\xkwtloma.dll 2008-06-22 10:30:43 557008 --ahs---- C:\WINDOWS\system32\dLoUCJlm.ini2 2008-06-20 20:48:47 564666 --ahs---- C:\WINDOWS\system32\tuBKknnn.ini2 2008-06-19 07:08:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-13 19:43:44 0 d-------- C:\Program Files\The Creative Assembly 2008-06-10 06:59:14 0 d-------- C:\Program Files\The Creative Assembly(2) 2008-06-09 13:30:13 483 --a------ C:\WINDOWS\eReg.dat 2008-06-09 13:29:57 0 d-------- C:\Program Files\Maxis 2008-06-04 08:17:29 0 d-------- C:\Program Files\Lionhead Studios Ltd 2008-06-02 17:28:32 0 d-------- C:\Documents and Settings\Eddie\Incomplete 2008-05-31 13:49:10 0 d-------- C:\Documents and Settings\Eddie\Contacts -- Find3M Report --------------------------------------------------------------- 2008-06-26 17:17:59 0 d-------- C:\Program Files\Warcraft III 2008-06-26 08:00:05 0 d-------- C:\Documents and Settings\Eddie\Application Data\AVG7 2008-06-25 19:08:24 0 d-------- C:\Program Files\Windows Live 2008-06-25 19:08:24 0 d-------- C:\Program Files\MSN Messenger 2008-06-24 20:04:13 0 d-------- C:\Documents and Settings\Eddie\Application Data\DMCache 2008-06-23 20:35:16 0 d-------- C:\Program Files\PokerStars 2008-06-23 11:08:53 0 d-------- C:\Documents and Settings\Eddie\Application Data\LimeWire 2008-06-22 17:41:44 0 d-------- C:\Program Files\GameSpy Arcade 2008-06-22 17:40:47 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-18 08:02:57 0 d-------- C:\Documents and Settings\Eddie\Application Data\uTorrent 2008-06-15 17:33:13 0 d-------- C:\Program Files\DivX 2008-06-11 13:55:33 0 d-------- C:\Program Files\LucasArts 2008-06-04 09:50:45 0 d-------- C:\Program Files\Lexmark X1100 Series 2008-06-01 17:57:12 0 d-------- C:\Program Files\UltimateBet 2008-05-31 22:30:05 0 d-------- C:\Program Files\PartyGaming 2008-05-30 21:49:49 0 d-------- C:\Documents and Settings\Eddie\Application Data\Petroglyph 2008-05-27 08:04:47 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; > 2008-05-25 13:33:25 0 d-------- C:\Program Files\WarRock 2008-05-21 16:35:24 19 --a------ C:\WINDOWS\popcinfo.dat 2008-05-18 12:11:31 0 d-------- C:\Documents and Settings\Eddie\Application Data\InstallShield 2008-05-17 22:44:14 0 d-------- C:\Program Files\Full Tilt Poker 2008-05-15 04:13:21 0 d-------- C:\Program Files\Common Files 2008-05-15 04:13:21 0 d-------- C:\Program Files\Common Files\DirectX 2008-05-11 16:37:32 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-05-11 16:33:19 0 d-------- C:\Program Files\PopCap Games 2008-05-11 12:16:56 0 d-------- C:\Documents and Settings\Eddie\Application Data\Zylom 2008-05-11 12:16:56 0 d-------- C:\Documents and Settings\Eddie\Application Data\Identities 2008-05-11 09:58:25 0 d-------- C:\Documents and Settings\Eddie\Application Data\PlayFirst 2008-05-05 19:35:57 0 d-------- C:\Documents and Settings\Eddie\Application Data\IDM 2008-04-26 16:54:56 0 d-------- C:\Documents and Settings\Eddie\Application Data\Adobe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1393157-10BB-4E07-8998-17140C7BD80C}] C:\WINDOWS\system32\khfFWqpP.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F86B11F3-0CE1-475F-9541-5329BF7B3597}] C:\WINDOWS\system32\rqRIabbc.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\System32\igfxtray.exe" [14/10/2005 03:49 PM] "igfxhkcmd"="C:\WINDOWS\System32\hkcmd.exe" [14/10/2005 03:46 PM] "igfxpers"="C:\WINDOWS\System32\igfxpers.exe" [14/10/2005 03:50 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [16/04/2008 09:26 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 03:25 AM] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [17/12/2002 11:40 AM] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [11/03/2003 05:38 PM] "DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [02/12/2002 08:56 PM] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [20/08/2003 12:13 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [28/03/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36 AM] "BM4f32ead7"="C:\WINDOWS\system32\weruwbqm.dll" [24/06/2008 05:52 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [01/10/2007 08:23 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 12:56 AM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 11:43 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{F86B11F3-0CE1-475F-9541-5329BF7B3597}"= C:\WINDOWS\system32\rqRIabbc.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRIabbc] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\khfFWqpP [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c116aade-6bbe-11dc-b471-806d6172696f}] AutoRun\command- D:\RunGame.exe -- End of Deckard's System Scanner: finished at 2008-06-26 19:41:48 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel(R) Pentium(R) 4 CPU 2.80GHz Percentage of Memory in Use: 63% Physical Memory (total/avail): 502.08 MiB / 185.69 MiB Pagefile Memory (total/avail): 1226.96 MiB / 813.49 MiB Virtual Memory (total/avail): 2047.88 MiB / 1941.79 MiB C: is Fixed (NTFS) - 58.59 GiB total, 7.44 GiB free. D: is CDROM (CDFS) F: is Fixed (NTFS) - 15.87 GiB total, 13.84 GiB free. G: is Removable (FAT32) \\.\PHYSICALDRIVE0 - WDC WD800JD-75MSA1 - 74.5 GiB - 3 partitions \PARTITION0 - Unknown - 31.35 MiB \PARTITION1 (bootable) - Installable File System - 58.59 GiB - C: \PARTITION2 - Installable File System - 15.87 GiB - F: \\.\PHYSICALDRIVE1 - USB Flash Disk USB Device - 3.84 GiB - 1 partition \PARTITION0 - 16-bit FAT - 3.84 GiB - G: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. AV: AVG 7.5.524 v7.5.524 (Grisoft) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Documents and Settings\\Eddie\\Desktop\\utorrent.exe"="C:\\Documents and Settings\\Eddie\\Desktop\\utorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe:*:Enabled:Age of Empires 3" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" "C:\\Program Files\\Xfire\\Xfire.exe"="C:\\Program Files\\Xfire\\Xfire.exe:*:Enabled:Xfire" "C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server" "C:\\Documents and Settings\\Eddie\\Desktop\\Dylans Games\\Yu-Gi-Oh! Power of Chaos JOEY THE PASSION\\joey_pc.exe"="C:\\Documents and Settings\\Eddie\\Desktop\\Dylans Games\\Yu-Gi-Oh! Power of Chaos JOEY THE PASSION\\joey_pc.exe:*:Enabled:joey_pc" "C:\\Documents and Settings\\Eddie\\My Documents\\Downloads\\Programs\\installer-5455-862-Dragon-Ball-Z-MuGEN-Edition-2-English.exe"="C:\\Documents and Settings\\Eddie\\My Documents\\Downloads\\Programs\\installer-5455-862-Dragon-Ball-Z-MuGEN-Edition-2-English.exe:*:Enabled:installer-5455-862-Dragon-Ball-Z-MuGEN-Edition-2-English" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo" "C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "C:\\Program Files\\Soldier of Fortune II - Double Helix GOLD\\SoF2MP.exe"="C:\\Program Files\\Soldier of Fortune II - Double Helix GOLD\\SoF2MP.exe:*:Enabled:SoF2MP" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"="C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat:*:Enabled:The Battle for Middle-earth(tm) II" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer" "C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\Repair.exe"="C:\\Program Files\\World of Warcraft\\Repair.exe:*:Enabled:Blizzard Repair Utility" "C:\\Program Files\\Caplio Software\\RGateLXP.exe"="C:\\Program Files\\Caplio Software\\RGateLXP.exe:*:Enabled:RICOH Gate La for DSC" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Enabled:LEXPPS.EXE" "C:\\Program Files\\Warcraft III\\War3.exe"="C:\\Program Files\\Warcraft III\\War3.exe:*:Enabled:Warcraft III" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM" "C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Enabled:Star Wars Jedi Knight(TM): Jedi Outcast(TM)" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Eddie\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=SOHO ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Eddie LOGONSERVER=\\SOHO NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0409 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Eddie\LOCALS~1\Temp TMP=C:\DOCUME~1\Eddie\LOCALS~1\Temp USERDOMAIN=SOHO USERNAME=Eddie USERPROFILE=C:\Documents and Settings\Eddie windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Eddie (admin) Dylan (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\PROGRA~1\SOLDIE~1\Uninstall\Unwise.exe /u C:\PROGRA~1\SOLDIE~1\Uninstall\install.log --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf ABBYY FineReader 5.0 Sprint --> MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2} Absolute Poker --> C:\Program Files\_uninstallation_info\Absolute Poker\CasinoUninstall.exe Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll" Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Age of Empires III --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97} Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL Black and White --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}\Setup.exe" Caplio Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D20113C0-3A42-480B-92B7-45C9303A0432}\setup.exe" -l0x9 anything Dell Resource CD --> MsiExec.exe /X{FCD9CD52-7222-4672-94A0-A722BA702FD0} DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN FaxTools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F45298E5-0083-426F-A668-1A2C5F04B8A0}\setup.exe" -l0x9 ControlPanel Full Tilt Poker --> "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -runfromtemp -l0x0009 -removeonly Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29} Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll" High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall hp deskjet 3500 --> msiexec /x{8FD62EBB-3175-4907-A326-989B14E5C757} hp deskjet 3500 series --> rundll32 hpzcon08.dll,VendorJettison hp deskjet 3500 series HP Photo and Imaging 2.0 - Deskjet Series --> MsiExec.exe /I{E0828692-FD9D-459F-9312-C645C3CA6650} hp print screen utility --> C:\Program Files\Hewlett-Packard\hp print screen utility\UnInstall\prnunins.exe ImageMixer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3B07D847-8077-4242-91C7-DFA3CE5113E0}\setup.exe" -l0x9 UNINSTALL Intel(R) Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2782 PCI\VEN_8086&DEV_2582 Intel(R) PRO Network Connections Drivers --> Prounstl.exe Internet Download Manager --> F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\Uninstall.exe iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} J2SE Runtime Environment 5.0 Update 12 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Lexmark X1100 Series --> C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBKUN5C.EXE -dLexmark X1100 Series LimeWire 4.16.6 --> "C:\Program Files\LimeWire\uninstall.exe" Microsoft Halo --> "C:\Program Files\Microsoft Games\Halo\UNINSTAL.EXE" /runtemp /addremove Microsoft Office 2000 Disc 2 --> MsiExec.exe /I{00040409-78E1-11D2-B60F-006097C998E7} Microsoft Office 2000 Professional --> MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7} MySpaceIM --> C:\Program Files\MySpace\IM\Uninstall.exe Nokia Connectivity Cable Driver --> MsiExec.exe /X{0FF1922C-B6C4-40BB-AF30-BEF75A482444} Pacific Poker --> C:\PROGRA~1\PACIFI~1\UNWISE.EXE C:\PROGRA~1\PACIFI~1\INSTALL.LOG PartyPoker --> "C:\Program Files\PartyGaming\PartyPoker\Uninstall.exe" "C:\Program Files\PartyGaming\PartyPoker\install.log" PC Connectivity Solution --> MsiExec.exe /I{D8E4A66D-DB68-481F-ABA8-AC622566D4CB} Poker Tracker Version 2.16.03d --> "C:\Program Files\Poker Tracker V2\unins000.exe" PokerStars --> "C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} Rome - Total War --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}\setup.exe" -l0x9 -removeonly Safari --> MsiExec.exe /I{F0E8F94D-6E68-4B35-92DF-3AA6DC6A6768} SigmaTel Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly SimCity 4 --> C:\Program Files\Maxis\SimCity 4\EAUninstall.exe Soldier of Fortune II - Double Helix GOLD --> C:\PROGRA~1\SOLDIE~1\UNINST~1\UNWISE.EXE C:\PROGRA~1\SOLDIE~1\UNINST~1\INSTALL.LOG Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins001.exe" SpywareBlaster 4.1 --> "C:\Program Files\SpywareBlaster\unins000.exe" Star Wars JK II Jedi Outcast --> C:\Program Files\InstallShield Installation Information\{8681B1E6-CD96-46EF-9065-CE0D1085ED99}\Setup.exe -runfromtemp -l0x0009 -removeonly Star Wars Knights of the Old Republic --> C:\Program Files\InstallShield Installation Information\{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}\Setup.exe -runfromtemp -l0x0009 -removeonly T6poker --> MsiExec.exe /X{8E8B88CB-2B90-455F-85F4-5CDFDA08E168} The Battle for Middle-earth (tm) II --> C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\EAUninstall.exe Titan Poker --> "C:\Poker\Titan Poker\_SetupPoker.exe" /uninstall UltimateBet --> C:\PROGRA~1\ULTIMA~1\UNWISE.EXE C:\PROGRA~1\ULTIMA~1\INSTALL.LOG Warcraft III: All Products --> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat WarRock --> C:\Program Files\InstallShield Installation Information\{00D15456-F679-4AD4-8BD2-56450D4C3F72}\setup.exe -runfromtemp -l0x0009 -removeonly Windows Driver Package - Nokia (WUDFRd) WPD (11/03/2006 6.82.26.2) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_6B630EE2E66584353C6CD8683D447072872F34D8\pccswpddriver.inf Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe Xvid 1.1.3 final uninstall --> "C:\Program Files\Xvid\unins000.exe" -- Application Event Log ------------------------------------------------------- Event Record #/Type2445 / Warning Event Submitted/Written: 06/25/2008 07:05:05 PM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}', feature 'Disk1Compressed' failed during request for component '{5617BF49-9195-4C35-B9AD-F8D165DE25BB}' Event Record #/Type2444 / Warning Event Submitted/Written: 06/25/2008 07:05:05 PM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{716E0306-8318-4364-8B8F-0CC4E9376BAC}', feature 'MSXMLSXS' failed during request for component '{5617BF49-9195-4C35-B9AD-F8D165DE25BB}' Event Record #/Type2443 / Warning Event Submitted/Written: 06/25/2008 07:05:00 PM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}', feature 'Disk1Compressed' failed during request for component '{5617BF49-9195-4C35-B9AD-F8D165DE25BB}' Event Record #/Type2442 / Warning Event Submitted/Written: 06/25/2008 07:05:00 PM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{716E0306-8318-4364-8B8F-0CC4E9376BAC}', feature 'MSXMLSXS' failed during request for component '{5617BF49-9195-4C35-B9AD-F8D165DE25BB}' Event Record #/Type2441 / Warning Event Submitted/Written: 06/25/2008 07:05:00 PM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}', feature 'Disk1Compressed' failed during request for component '{5617BF49-9195-4C35-B9AD-F8D165DE25BB}' -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type15564 / Warning Event Submitted/Written: 06/26/2008 10:30:26 AM Event ID/Source: 36 / W32Time Event Description: The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. Event Record #/Type15545 / Error Event Submitted/Written: 06/25/2008 08:50:56 PM / 06/25/2008 08:51:23 PM Event ID/Source: 55 / Ntfs Event Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume F:. Event Record #/Type15544 / Error Event Submitted/Written: 06/25/2008 08:50:53 PM / 06/25/2008 08:51:23 PM Event ID/Source: 55 / Ntfs Event Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume F:. Event Record #/Type15536 / Error Event Submitted/Written: 06/25/2008 08:50:03 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Event Record #/Type15535 / Error Event Submitted/Written: 06/25/2008 08:49:53 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} -- End of Deckard's System Scanner: finished at 2008-06-26 19:41:48 ------------ ;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-06-26 21:50:55 PROTECTIONS: 1 MALWARE: 46 SUSPECTS: 0 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== AVG 7.5.524 7.5.524 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@trafficmp[1].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@casalemedia[1].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.casalemedia.com/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.doubleclick.net/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@doubleclick[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.atdmt.com/] 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@atdmt[1].txt 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\Eddie\Desktop\SDFix.zip[SDFix/apps/Process.exe] 00139535 Application/Processor HackTools No 0 Yes No G:\SDFix.zip[SDFix/apps/Process.exe] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.tradedoubler.com/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.fastclick.net/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@tribalfusion[2].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.tribalfusion.com/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@tribalfusion[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.mediaplex.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.mediaplex.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@mediaplex[2].txt 00145869 Cookie/SpyLog TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.spylog.com/] 00147814 Cookie/AspinallsOnlineCasino TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@pacificpoker[2].txt 00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.clickbank.net/] 00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@www.myaffiliateprogram[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@com[2].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.com.com/] 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@com[1].txt 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.yadro.ru/] 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.xiti.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@statcounter[2].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.statcounter.com/] 00167760 Cookie/Hitslink TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[counter.hitslink.com/] 00167760 Cookie/Hitslink TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@counter.hitslink[1].txt 00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.perf.overture.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@ad.yieldmanager[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[ad.yieldmanager.com/] 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.apmebf.com/] 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@apmebf[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@serving-sys[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@serving-sys[2].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@bs.serving-sys[2].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@bs.serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.bs.serving-sys.com/] 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@adtech[1].txt 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[server.iad.liveperson.net/] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[server.iad.liveperson.net/hc/30905001] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.advertising.com/] 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[statse.webtrendslive.com/] 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@statse.webtrendslive[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\Cookies\eddie@overture[1].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.overture.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.zedo.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@adultfriendfinder[1].txt 01048936 Generic Malware Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP374\A0111851.dll 01049370 Generic Malware Virus/Trojan No 0 Yes Yes C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\comver.dll 01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Application Data\Mozilla\Firefox\Profiles\sf6fvbn8.default\cookies.txt[.adserver.easyad.info/] 01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Eddie\Cookies\eddie@adserver.easyad[1].txt 02621359 Trj/Downloader.MDW Virus/Trojan No 1 Yes Yes C:\Program Files\Hijackthis\backups\backup-20080622-183127-605.dll 02634745 Application/Playmp3z HackTools No 0 Yes No C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\PLAY_MP3.exe 02649837 Application/Playmp3z HackTools No 0 No No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem43D.tmp.exe[PlayMP3.exe] 02664718 Adware/Zango Adware No 0 Yes No C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_2.exe 02664718 Adware/Zango Adware No 0 Yes No C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_3.exe 02763634 Trj/ClassLoader.AH Virus/Trojan No 0 Yes Yes C:\Documents and Settings\Eddie\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-31e0fadc[VaannnaaBaa.class] 02763635 Trj/ClassLoader.AH Virus/Trojan No 0 Yes Yes C:\Documents and Settings\Eddie\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-31e0fadc[Bnnnnn.class] 02763636 Trj/ClassLoader.AH Virus/Trojan No 0 Yes Yes C:\Documents and Settings\Eddie\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-31e0fadc[BnnnnBaa.class] 02885355 Adware/Zango Adware No 0 Yes No C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_4.exe 02885355 Adware/Zango Adware No 0 Yes No C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_5.exe 02895645 Application/Playmp3z HackTools No 0 Yes No C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem43D.tmp.exe 03105100 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115984.dll 03105100 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP373\A0111725.dll 03105102 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115985.dll 03106482 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115982.dll 03106482 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115986.dll 03106482 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP381\A0116623.dll 03128230 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP371\A0111680.dll ;=================================================================================================================================================================================== SUSPECTS Sent Location ;*********************************************************************************************************************************************************************************** |
|
|
|
|
06-26-2008, 09:18 AM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Download ComboFix from Here: * IMPORTANT !!! Place combofix.exe on your Desktop We will first use ComboFix to install the Microsoft Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-27-2008, 05:26 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Thanks again,
Here is the combo fix log and new Hijack log. ComboFix 08-06-25.3 - Eddie 2008-06-27 19:52:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.245 [GMT 9.5:30] Running from: C:\Documents and Settings\Eddie\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Eddie\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM4f32ead7.xml C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\pskt.ini C:\WINDOWS\system32\dLoUCJlm.ini C:\WINDOWS\system32\dLoUCJlm.ini2 C:\WINDOWS\system32\euwwdowp.dll C:\WINDOWS\system32\galnmmsb.ini C:\WINDOWS\system32\ltbqwmyi.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mlkbtawm.dll C:\WINDOWS\system32\mwatbklm.ini C:\WINDOWS\system32\PpqWFfhk.ini C:\WINDOWS\system32\PpqWFfhk.ini2 C:\WINDOWS\system32\tkmvkiga.ini C:\WINDOWS\system32\tuBKknnn.ini C:\WINDOWS\system32\tuBKknnn.ini2 C:\WINDOWS\system32\ulrlyxmq.ini C:\WINDOWS\system32\ushblgwd.ini C:\WINDOWS\system32\xkwtloma.dll . ((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 ))))))))))))))))))))))))))))))) . 2008-06-27 20:01 . 2008-06-27 20:02 110,419 --a------ C:\WINDOWS\BM4f32ead7.xml 2008-06-26 19:59 . 2008-06-26 20:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-26 19:38 . 2008-06-26 19:38 <DIR> d-------- C:\Deckard 2008-06-26 19:37 . 2008-06-26 19:37 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-25 20:53 . 2008-06-25 20:53 67,672 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2008-06-25 19:51 . 2008-06-25 19:51 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-24 17:52 . 2008-06-24 17:52 91,136 --a------ C:\WINDOWS\system32\weruwbqm.dll 2008-06-22 12:19 . 2008-06-25 20:26 211 --a------ C:\WINDOWS\wininit.ini 2008-06-22 11:47 . 2008-06-25 07:25 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-22 11:47 . 2008-06-25 07:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-19 07:08 . 2008-06-25 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-13 19:43 . 2008-06-13 19:43 <DIR> d-------- C:\Program Files\The Creative Assembly 2008-06-11 16:27 . 2008-06-13 22:40 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 06:59 . 2008-06-11 07:34 <DIR> d-------- C:\Program Files\The Creative Assembly(2) 2008-06-09 13:30 . 2008-06-18 08:00 483 --a------ C:\WINDOWS\eReg.dat 2008-06-09 13:29 . 2008-06-09 13:29 <DIR> d-------- C:\Program Files\Maxis 2008-06-04 08:17 . 2008-06-04 08:17 <DIR> d-------- C:\Program Files\Lionhead Studios Ltd 2008-06-02 17:28 . 2008-06-23 11:12 <DIR> d-------- C:\Documents and Settings\Eddie\Incomplete 2008-05-31 13:49 . 2008-06-13 17:45 <DIR> d-------- C:\Documents and Settings\Eddie\Contacts . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 23:43 --------- d-----w C:\Documents and Settings\Eddie\Application Data\AVG7 2008-06-26 22:41 --------- d-----w C:\Program Files\Warcraft III 2008-06-26 12:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-25 09:38 --------- d-----w C:\Program Files\Windows Live 2008-06-25 09:38 --------- d-----w C:\Program Files\MSN Messenger 2008-06-24 10:34 --------- d-----w C:\Documents and Settings\Eddie\Application Data\DMCache 2008-06-23 11:05 --------- d-----w C:\Program Files\PokerStars 2008-06-23 01:38 --------- d-----w C:\Documents and Settings\Eddie\Application Data\LimeWire 2008-06-22 08:11 --------- d-----w C:\Program Files\GameSpy Arcade 2008-06-22 08:10 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-17 22:32 --------- d-----w C:\Documents and Settings\Eddie\Application Data\uTorrent 2008-06-15 08:03 --------- d-----w C:\Program Files\DivX 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 04:25 --------- d-----w C:\Program Files\LucasArts 2008-06-04 00:20 --------- d-----w C:\Program Files\Lexmark X1100 Series 2008-06-03 22:37 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-06-01 08:27 --------- d-----w C:\Program Files\UltimateBet 2008-05-31 13:00 --------- d-----w C:\Program Files\PartyGaming 2008-05-30 12:19 --------- d-----w C:\Documents and Settings\Eddie\Application Data\Petroglyph 2008-05-28 05:20 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-25 04:03 --------- d-----w C:\Program Files\WarRock 2008-05-18 02:41 --------- d-----w C:\Documents and Settings\Eddie\Application Data\InstallShield 2008-05-17 13:14 --------- d-----w C:\Program Files\Full Tilt Poker 2008-05-14 18:43 --------- d-----w C:\Program Files\Common Files\DirectX 2008-05-11 07:07 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-05-11 07:03 --------- d-----w C:\Program Files\PopCap Games 2008-05-11 07:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2008-05-11 02:46 --------- d-----w C:\Documents and Settings\Eddie\Application Data\Zylom 2008-05-11 02:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-05-11 00:28 --------- d-----w C:\Documents and Settings\Eddie\Application Data\PlayFirst 2008-05-10 11:47 4,096 ----a-w C:\WINDOWS\system32\drivers\nocashio.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-05 10:05 --------- d-----w C:\Documents and Settings\Eddie\Application Data\IDM 2008-05-05 07:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-01 08:23 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\System32\igfxtray.exe" [2005-10-14 15:49 94208] "igfxhkcmd"="C:\WINDOWS\System32\hkcmd.exe" [2005-10-14 15:46 77824] "igfxpers"="C:\WINDOWS\System32\igfxpers.exe" [2005-10-14 15:50 114688] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 09:26 579584] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 17:38 172032] "DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 20:56 40960] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-20 00:13 57344] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "BM4f32ead7"="C:\WINDOWS\system32\weruwbqm.dll" [2008-06-24 17:52 91136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-26 09:26 219136] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-02 06:02 8699904] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Documents and Settings\\Eddie\\Desktop\\utorrent.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Documents and Settings\\Eddie\\My Documents\\Downloads\\Programs\\installer-5455-862-Dragon-Ball-Z-MuGEN-Edition-2-English.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\Caplio Software\\RGateLXP.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Warcraft III\\War3.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:wc3 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundTimestampRequest"= 1 (0x1) "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) "AllowOutboundDestinationUnreachable"= 1 (0x1) "AllowOutboundSourceQuench"= 1 (0x1) "AllowOutboundParameterProblem"= 1 (0x1) "AllowOutboundTimeExceeded"= 1 (0x1) "AllowRedirect"= 1 (0x1) "AllowOutboundPacketTooBig"= 1 (0x1) . Contents of the 'Scheduled Tasks' folder "2008-06-21 03:35:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . - - - - ORPHANS REMOVED - - - - BHO-{B1393157-10BB-4E07-8998-17140C7BD80C} - C:\WINDOWS\system32\khfFWqpP.dll BHO-{F86B11F3-0CE1-475F-9541-5329BF7B3597} - C:\WINDOWS\system32\rqRIabbc.dll WebBrowser-{E1BACF55-35E1-4E47-9247-2D48660E5545} - (no file) ShellExecuteHooks-{F86B11F3-0CE1-475F-9541-5329BF7B3597} - C:\WINDOWS\system32\rqRIabbc.dll Notify-rqRIabbc - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-27 20:01:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\BM4f32ead7.xml 110419 bytes scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe . ************************************************************************** . Completion time: 2008-06-27 20:10:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-27 10:40:44 Pre-Run: 7,914,815,488 bytes free Post-Run: 7,919,828,992 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 198 --- E O F --- 2008-06-21 12:40:58 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:12:38 PM, on 27/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Eddie\Desktop\Security\Eddie.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BM4f32ead7] Rundll32.exe "C:\WINDOWS\system32\weruwbqm.dll",s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7626 bytes |
|
|
|
|
06-27-2008, 11:54 AM
|
#6 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Good job. Things should be improving.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
06-28-2008, 12:17 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Hi,
Here is the new combo log txt and Hijack file. Still running real slow though. ComboFix 08-06-25.3 - Eddie 2008-06-28 12:16:56.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.197 [GMT 9.5:30] Running from: C:\Documents and Settings\Eddie\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Eddie\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\PLAY_MP3.exe C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_2.exe C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_3.exe C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_4.exe C:\Documents and Settings\Eddie\My Documents\Downloads\Programs\Setup_5.exe C:\WINDOWS\BM4f32ead7.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\weruwbqm.dll . ((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 ))))))))))))))))))))))))))))))) . 2008-06-26 19:59 . 2008-06-26 20:00 <DIR> d-------- C:\Program Files\Panda Security 2008-06-26 19:38 . 2008-06-26 19:38 <DIR> d-------- C:\Deckard 2008-06-26 19:37 . 2008-06-26 19:37 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-25 20:53 . 2008-06-25 20:53 67,672 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2008-06-25 19:51 . 2008-06-25 19:51 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-22 12:19 . 2008-06-25 20:26 211 --a------ C:\WINDOWS\wininit.ini 2008-06-22 11:47 . 2008-06-25 07:25 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-22 11:47 . 2008-06-25 07:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-19 07:08 . 2008-06-25 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-13 19:43 . 2008-06-13 19:43 <DIR> d-------- C:\Program Files\The Creative Assembly 2008-06-11 16:27 . 2008-06-13 22:40 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 06:59 . 2008-06-11 07:34 <DIR> d-------- C:\Program Files\The Creative Assembly(2) 2008-06-09 13:30 . 2008-06-18 08:00 483 --a------ C:\WINDOWS\eReg.dat 2008-06-09 13:29 . 2008-06-09 13:29 <DIR> d-------- C:\Program Files\Maxis 2008-06-04 08:17 . 2008-06-04 08:17 <DIR> d-------- C:\Program Files\Lionhead Studios Ltd 2008-06-02 17:28 . 2008-06-23 11:12 <DIR> d-------- C:\Documents and Settings\Eddie\Incomplete 2008-05-31 13:49 . 2008-06-13 17:45 <DIR> d-------- C:\Documents and Settings\Eddie\Contacts . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-28 02:30 --------- d-----w C:\Documents and Settings\Eddie\Application Data\AVG7 2008-06-27 17:19 --------- d-----w C:\Program Files\Warcraft III 2008-06-26 12:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-25 09:38 --------- d-----w C:\Program Files\Windows Live 2008-06-25 09:38 --------- d-----w C:\Program Files\MSN Messenger 2008-06-24 10:34 --------- d-----w C:\Documents and Settings\Eddie\Application Data\DMCache 2008-06-23 11:05 --------- d-----w C:\Program Files\PokerStars 2008-06-23 01:38 --------- d-----w C:\Documents and Settings\Eddie\Application Data\LimeWire 2008-06-22 08:11 --------- d-----w C:\Program Files\GameSpy Arcade 2008-06-22 08:10 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-17 22:32 --------- d-----w C:\Documents and Settings\Eddie\Application Data\uTorrent 2008-06-15 08:03 --------- d-----w C:\Program Files\DivX 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 04:25 --------- d-----w C:\Program Files\LucasArts 2008-06-04 00:20 --------- d-----w C:\Program Files\Lexmark X1100 Series 2008-06-03 22:37 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-06-01 08:27 --------- d-----w C:\Program Files\UltimateBet 2008-05-31 13:00 --------- d-----w C:\Program Files\PartyGaming 2008-05-30 12:19 --------- d-----w C:\Documents and Settings\Eddie\Application Data\Petroglyph 2008-05-28 05:20 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-25 04:03 --------- d-----w C:\Program Files\WarRock 2008-05-18 02:41 --------- d-----w C:\Documents and Settings\Eddie\Application Data\InstallShield 2008-05-17 13:14 --------- d-----w C:\Program Files\Full Tilt Poker 2008-05-14 18:43 --------- d-----w C:\Program Files\Common Files\DirectX 2008-05-11 07:07 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-05-11 07:03 --------- d-----w C:\Program Files\PopCap Games 2008-05-11 07:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2008-05-11 02:46 --------- d-----w C:\Documents and Settings\Eddie\Application Data\Zylom 2008-05-11 02:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-05-11 00:28 --------- d-----w C:\Documents and Settings\Eddie\Application Data\PlayFirst 2008-05-10 11:47 4,096 ----a-w C:\WINDOWS\system32\drivers\nocashio.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-05 10:05 --------- d-----w C:\Documents and Settings\Eddie\Application Data\IDM 2008-05-05 07:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters . ((((((((((((((((((((((((((((( snapshot@2008-06-27_20.10.30.56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-27 10:31:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-28 02:51:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-01 08:23 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\System32\igfxtray.exe" [2005-10-14 15:49 94208] "igfxhkcmd"="C:\WINDOWS\System32\hkcmd.exe" [2005-10-14 15:46 77824] "igfxpers"="C:\WINDOWS\System32\igfxpers.exe" [2005-10-14 15:50 114688] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-06-28 12:01 580096] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 17:38 172032] "DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 20:56 40960] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-20 00:13 57344] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-26 09:26 219136] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-02 06:02 8699904] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Documents and Settings\\Eddie\\Desktop\\utorrent.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Documents and Settings\\Eddie\\My Documents\\Downloads\\Programs\\installer-5455-862-Dragon-Ball-Z-MuGEN-Edition-2-English.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\Caplio Software\\RGateLXP.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Warcraft III\\War3.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:wc3 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundTimestampRequest"= 1 (0x1) "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) "AllowOutboundDestinationUnreachable"= 1 (0x1) "AllowOutboundSourceQuench"= 1 (0x1) "AllowOutboundParameterProblem"= 1 (0x1) "AllowOutboundTimeExceeded"= 1 (0x1) "AllowRedirect"= 1 (0x1) "AllowOutboundPacketTooBig"= 1 (0x1) . Contents of the 'Scheduled Tasks' folder "2008-06-21 03:35:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-28 12:39:35 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-06-28 12:49:51 - machine was rebooted [Eddie] ComboFix-quarantined-files.txt 2008-06-28 03:19:48 ComboFix2.txt 2008-06-27 10:40:50 Pre-Run: 7,851,069,440 bytes free Post-Run: 7,853,600,768 bytes free 172 --- E O F --- 2008-06-21 12:40:58 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:42:07 PM, on 28/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\igfxsrvc.exe C:\Documents and Settings\Eddie\Desktop\Security\Eddie.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7318 bytes |
|
|
|
|
06-28-2008, 08:26 AM
|
#8 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
We do have a few more steps to go in the cleaning. Let's see if that makes a difference.
========================================== Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
--------------------------------------------------------------------------------------------- Please download ATF Cleaner by Atribune.
For Technical Support, double-click the e-mail address located at the bottom of each menu. --------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- As far as a slow machine goes, some machines never fully recover from an infection, no matter how we try to clean them. However, let's look at some of the info DSS has given us: Quote:
If your system seems sluggish, it could be due to low RAM: Please read the following article. http://www.techsupportforum.com/secu...ning-slow.html Please visit Crucial where you can either input your model number or download a small application that will tell you exactly the type of RAM you need. Having less than the minimum free space on the OS drive can also cause Windows to run more slowly. If possible, move some data (pictures, videos, documents) to another storage medium such as CD-R, DVD-R or external drive to gain some space. Also consider uninstalling unused, non-essential applications. Tell me how the machine is behaving.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
06-28-2008, 08:08 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Here are the latest logs.
One other thing I forgot to mention is that on start up I get a CHKDISK option. The message is Check File System on F. The type of file system is NTFS. Sunday, June 29, 2008 11:29:13 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 28/06/2008 Kaspersky Anti-Virus database records: 896282 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ F:\ Scan Statistics Total number of scanned objects 167389 Number of viruses found 12 Number of infected objects 26 Number of suspicious objects 0 Duration of the scan process 01:53:52 Infected Object Name Virus Name Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem43D.tmp.exe/data0002 Infected: not-a-virus:AdWare.Win32.Agent.jb skipped C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem43D.tmp.exe NSIS: infected - 1 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem441.tmp.exe/data0002 Infected: not-a-virus:AdWare.Win32.Agent.ahl skipped C:\Deckard\System Scanner\backup\DOCUME~1\Eddie\LOCALS~1\Temp\tem441.tmp.exe NSIS: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Eddie\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Eddie\Desktop\Dylans Games\daemon4121-lite.exe/stream/data0050 Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\Documents and Settings\Eddie\Desktop\Dylans Games\daemon4121-lite.exe/stream Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\Documents and Settings\Eddie\Desktop\Dylans Games\daemon4121-lite.exe NSIS: infected - 2 skipped C:\Documents and Settings\Eddie\Desktop\Security\backups\backup-20080624-202001-719.dll Object is locked skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/PLAY_MP3.exe Infected: not-a-virus:AdWare.Win32.Agent.zk skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/Setup_2.exe Infected: not-a-virus:AdTool.Win32.Zango.d skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/Setup_3.exe Infected: not-a-virus:AdTool.Win32.Zango.d skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/Setup_4.exe Infected: not-a-virus:AdTool.Win32.Zango.e skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/Setup_5.exe Infected: not-a-virus:AdTool.Win32.Zango.e skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip/weruwbqm.dll Infected: Trojan.Win32.Monderc.gen skipped C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip ZIP: infected - 6 skipped C:\Documents and Settings\Eddie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Eddie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Eddie\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Eddie\Local Settings\Temp\hpotdd002.log Object is locked skipped C:\Documents and Settings\Eddie\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Eddie\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Eddie\My Documents\My Music\My Music\Nokia Music Manager\im a believer music only.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped C:\Documents and Settings\Eddie\ntuser.dat Object is locked skipped C:\Documents and Settings\Eddie\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Hijackthis\backups\backup-20080622-183120-936.dll Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mlkbtawm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zde skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP347\A0103699.exe Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP353\A0104584.exe Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP357\A0105224.exe Infected: not-a-virus:AdWare.Win32.Shopper.r skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP371\A0111680.dll Infected: Trojan.Win32.Monder.yc skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP373\A0111725.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP373\A0111736.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP374\A0112742.dll Infected: Trojan.Win32.Monderc.gen skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP375\A0114934.dll Infected: Trojan.Win32.Monderc.gen skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0114966.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.zcz skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115972.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115982.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115984.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115985.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP376\A0115986.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP381\A0116623.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP382\A0116644.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP383\A0116664.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP383\A0116665.dll Object is locked skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP383\A0116666.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.zde skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP384\A0117785.dll Infected: Trojan.Win32.Monderc.gen skipped C:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP389\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\_restore{33FD38D5-28D8-4D19-ADB0-DAC2D9C1D0FD}\RP389\change.log Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:31:16 AM, on 29/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Eddie\Desktop\Security\Eddie.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7422 bytes |
|
|
|
|
06-28-2008, 09:19 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
What is your F drive? Have you allowed the chkdsk to complete?
Open NOTEPAD.exe and copy/paste the text in the codebox below into it: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Eddie\Desktop\Dylans Games\daemon4121-lite.exe" "C:\Documents and Settings\Eddie\Desktop\Security\[4]-Submit_2008-06-28@12.16.zip" "C:\Documents and Settings\Eddie\My Documents\My Music\My Music\Nokia Music Manager\im a believer music only.mp3" "C:\Program Files\Hijackthis\backups\backup-20080622-183120-936.dll" "C:\Documents and Settings\Eddie\Desktop\Security\backups\backup-20080624-202001-719.dll" ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( %systemdrive%\Deckard ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-29-2008, 01:12 AM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Ran the fix.bat. Came back with the message "succesfully deleted" press any key to continue.
F drive is a partition of the C drive. I have run the CHKDISK a few times but it comes up every tine I reboot. Thanks again, ps, machine is running better now and no pop ups. |
|
|
|
|
06-29-2008, 08:23 AM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Ok, let's see if we can figure out that chkdsk.
Open notepad and copy/paste the text in the quotebox below into it: Code:
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\Session Manager" /v BootExecute > C:\look.txt Start notepad C:\look.txt It should look like this:  Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-29-2008, 06:12 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Go to Start> Run> bring up a command prompt by typing in CMD, and click OK
At the command prompt type: fsutil dirty query f: Press Enter. This queries the drive, and more than likely it will tell you that it is dirty. Next, type CHKNTFS /X F: Press Enter. The X tells Windows to NOT check that particular drive on the next reboot. At this time, manually reboot your computer, it should not do a Chkdsk and take you directly to Windows. Once Windows has fully loaded, bring up another CMD prompt Run Chkdsk manually by typing Chkdsk /r f: Press Enter This should take you through 5 stages of the scan and will unset that dirty bit. Finally, type fsutil dirty query f: Windows should confirm that the dirty bit is not set on that drive. Let me know.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
06-30-2008, 07:58 AM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
Great, glad that worked out.
Some final instructions for you.... Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-01-2008, 04:23 AM
|
#17 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 9
OS: XP S2
|
Re: Hijacked for the 1st time. Please help.
Hi,
Done as instructed above. Scotty from Winpatrol is now on watch. How do I know what to allow and what to deny, eg any windows updates will require my acceptance. I have also created a restore point with the new clean PC but notice any restore points for months prior are no longer able to be accessed (not that I want to ) but am concerned my current restore dated tpday will also not be able to be accesswed in a months time or whenever I may need it. Final scan for your perusal. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:46:56 PM, on 1/07/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\igfxpers.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\igfxsrvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe C:\Documents and Settings\Eddie\Desktop\Security\Eddie.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\My Pictures BACKUP\Internet Download Manager\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Eddie\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7642 bytes |
|
|
|
|
07-01-2008, 08:29 AM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,583
OS: 2000 Pro; XP Pro; XP Home
|
Re: Hijacked for the 1st time. Please help.
If you performed combofix /u there will only be one restore point, a new one just created by combofix. All others should have been flushed. This is standard procedure post-infection. Leaving old, potentially infected restore points on a machine can undo all the removal work if those restore points were used at some point in the future.
Scotty gives pretty self-explanatory messages. They give file paths, file names, etc. Be sure to read the links I gave you to WinPatrol FAQ and Features. If it's an application you know making the change, allow it. If you're unsure, google what's in the message.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
