|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-30-2008, 11:48 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 6
OS: xp
|
Here is my Deckard log. Please help!
I've been trying to get rid of a virtumonde infection with no success. I am not at all experienced in this sort of thing so any help would be greatly appreciated. Here's my log:
Deckard's System Scanner v20071014.68 Run by Mona on 2008-06-30 21:58:05 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 88: 2008-07-01 04:58:47 UTC - RP805 - Deckard's System Scanner Restore Point 87: 2008-07-01 01:11:48 UTC - RP804 - System Checkpoint 86: 2008-06-28 19:27:46 UTC - RP803 - Last known good configuration 85: 2008-06-28 19:26:49 UTC - RP802 - Restore Operation 84: 2008-06-28 19:26:46 UTC - RP801 - Spyware Doctor: Cleaning Threats -- First Restore Point -- 1: 2008-06-28 19:24:40 UTC - RP718 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Mona.exe) ------------------------------------------------ logfile has no content; running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-30 22:01:17 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\RegistrySmart\RegistrySmart.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\alg.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Mona\Desktop\dss.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Symantec Shared\COH\COH32.exe C:\Program Files\Webroot\Spy Sweeper\ssu.exe C:\Program Files\Trend Micro\HijackThis\Mona.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {2CD8C3A2-5C57-45A8-B727-A79DEAF68930} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {79076950-F022-4D2A-AF45-C9E2F0A9F931} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {A2A1F4D1-7AE5-44F2-A0CB-B04DB7E3AE6D} - C:\WINDOWS\system32\qoMdBTnm.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {C1CF1A7A-A6B3-DB4F-C97D-DCC868FE7E9B} - (no file) O2 - BHO: {ff20d78f-1c9b-da29-7314-647072ec26ed} - {de62ce27-0746-4137-92ad-b9c1f87d02ff} - C:\WINDOWS\system32\dgbblz.dll O2 - BHO: (no name) - {EEE94C3F-52C2-4CD4-ABF8-45A3A26AA8B2} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] "C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" -boot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1163339409921 O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.mumbojumbo.com/assets/mjolauncher.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://noofy57.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_05) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.22/ttinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3209.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,avgrsstx.dll O20 - Winlogon Notify: rqRJCVop - C:\WINDOWS\system32\rqRJCVop.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 14729 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BS_I2cIo - c:\windows\system32\drivers\bs_i2cio.sys <Not Verified; BIOSTAR Group; BIOSTAR I/O driver fle> R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path ManagerŪ (32-bit)> R2 SetupNT - c:\windows\system32\setupnt.sys S2 ousbehci (NEC PCI to USB Enhanced Host Controller) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver> S3 ousb2hub (OrangeWare USB 2.0 Root Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver> S3 SjyPkt - c:\windows\system32\drivers\sjypkt.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-30 03:30:10 424 --a------ C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job 2008-06-30 02:00:09 1496 --a------ C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job 2008-06-28 12:00:07 284 --a----c- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-06-19 18:10:00 298 --a----c- C:\WINDOWS\Tasks\Ad-Aware SE Personal.job 2008-06-13 18:12:00 262 --a----c- C:\WINDOWS\Tasks\Spybot - Search & Destroy.job -- Files created between 2008-05-30 and 2008-06-30 ----------------------------- 2008-06-30 20:30:29 0 d-------- C:\Program Files\Trend Micro 2008-06-28 10:50:36 104960 --a------ C:\WINDOWS\system32\dgbblz.dll 2008-06-28 10:50:33 104960 --a------ C:\WINDOWS\system32\juvmgfjt.dll 2008-06-28 10:47:41 94208 --a------ C:\WINDOWS\system32\aohvqxit.dll 2008-06-28 10:08:11 104960 --a------ C:\WINDOWS\system32\hovmuk.dll 2008-06-28 10:07:58 104960 --a------ C:\WINDOWS\system32\tyybhvcl.dll 2008-06-22 11:59:39 128512 --a------ C:\WINDOWS\system32\ljovwyay.dll 2008-06-22 11:56:41 121344 --a------ C:\WINDOWS\system32\bbionwvp.dll 2008-06-22 11:54:48 128512 --a------ C:\WINDOWS\system32\pqnhdpml.dll 2008-06-20 22:48:26 0 d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-20 22:47:18 0 d-------- C:\Program Files\RegistrySmart 2008-06-19 18:03:06 104960 --a------ C:\WINDOWS\system32\gjjlywsw.dll 2008-06-18 15:20:56 0 d-------- C:\Program Files\Lavasoft 2008-06-18 15:20:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19:52 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 15:12:56 667139 --ahs---- C:\WINDOWS\system32\mnTBdMoq.ini2 2008-06-18 15:12:37 299520 --a------ C:\WINDOWS\system32\qoMdBTnm.dll 2008-06-18 14:19:31 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:18:49 0 d-------- C:\Program Files\Webroot 2008-06-18 14:18:49 0 d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:17:49 164 --a------ C:\install.dat 2008-06-18 11:03:08 134656 --a------ C:\WINDOWS\system32\cdvhbflu.dll 2008-06-18 10:57:46 129536 --a------ C:\WINDOWS\system32\aileerpj.dll 2008-06-17 12:35:32 0 dr-h----- C:\Documents and Settings\Mona\Recent 2008-06-17 10:53:56 130560 --a------ C:\WINDOWS\system32\uaaydwub.dll 2008-06-17 10:47:56 124416 --a------ C:\WINDOWS\system32\fjflicqb.dll 2008-06-17 10:45:13 130560 --a------ C:\WINDOWS\system32\iqonqhjh.dll 2008-06-17 10:45:01 124416 --a------ C:\WINDOWS\system32\cbgttrcm.dll 2008-06-16 11:23:07 0 d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23:07 0 d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 10:44:19 131584 --a------ C:\WINDOWS\system32\vbunypvh.dll 2008-06-16 10:42:03 127488 --a------ C:\WINDOWS\system32\wxhrbsua.dll 2008-06-16 10:41:18 688708 --ahs---- C:\WINDOWS\system32\TCLkknpo.ini2 2008-06-15 16:29:27 0 d--h----- C:\$AVG8.VAULT$ 2008-06-15 16:24:19 0 d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-15 16:23:53 0 d-------- C:\Program Files\AVG 2008-06-15 16:23:49 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-06-14 22:08:43 130560 --a------ C:\WINDOWS\system32\dumumsaw.dll 2008-06-14 22:08:32 128 --a------ C:\Documents and Settings\Mona\services.exe 2008-06-14 22:07:25 133632 --a------ C:\WINDOWS\system32\gxwxnhma.dll 2008-06-14 00:04:18 692636 --ahs---- C:\WINDOWS\system32\eddMlnpo.ini2 -- Find3M Report --------------------------------------------------------------- 2008-06-30 22:01:37 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-06-30 14:57:36 0 d-------- C:\Program Files\Norton 360 2008-06-30 02:46:42 0 d-------- C:\Program Files\Bonjour 2008-06-18 15:19:52 0 d-------- C:\Program Files\Common Files 2008-06-17 11:58:59 0 d-------- C:\Program Files\MySpace 2008-06-17 10:39:37 0 d-------- C:\Program Files\Ahead 2008-06-16 10:48:38 0 d-------- C:\Program Files\STOPzilla! 2008-06-16 10:43:29 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-14 23:07:47 0 d-------- C:\Program Files\Windows Live 2008-06-14 23  21 0 d-------- C:\Program Files\Musicmatch2008-06-14 22:59:09 0 d-------- C:\Documents and Settings\Mona\Application Data\Adobe 2008-06-14 22:58:52 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-14 00:02:01 0 d-------- C:\Documents and Settings\Mona\Application Data\LimeWire 2008-05-28 19:13:30 0 d-------- C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-25 19:16:53 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-03 15:49:17 0 d-------- C:\Program Files\Label Maker Wizard 2008-04-30 21:34:07 4 --a----c- C:\WINDOWS\system32\26E350 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CD8C3A2-5C57-45A8-B727-A79DEAF68930}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] 06/17/2008 02:23 PM 349552 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] 04/22/2008 04:50 PM 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79076950-F022-4D2A-AF45-C9E2F0A9F931}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A2A1F4D1-7AE5-44F2-A0CB-B04DB7E3AE6D}] 06/18/2008 03:12 PM 299520 --a------ C:\WINDOWS\system32\qoMdBTnm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C1CF1A7A-A6B3-DB4F-C97D-DCC868FE7E9B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{de62ce27-0746-4137-92ad-b9c1f87d02ff}] 06/28/2008 10:50 AM 104960 --a------ C:\WINDOWS\system32\dgbblz.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE94C3F-52C2-4CD4-ABF8-45A3A26AA8B2}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll [06/17/2008 02:23 PM 349552] [-HKEY_CLASSES_ROOT\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [08/04/2004 12:56 AM C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [10/06/2003 02:16 PM C:\WINDOWS\system32\nwiz.exe] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [03/03/2004 02:30 PM] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [05/16/2003 03:10 AM] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [02/14/2008 04:40 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [03/26/2008 05:40 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [02/18/2008 12:37 PM] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [02/26/2008 07:50 AM] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/15/2008 04:24 PM] "RegistrySmart"="C:\Program Files\RegistrySmart\RegistrySmart.exe" [06/19/2008 03:36 PM] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/04/2008 08:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [08/04/2004 12:56 AM C:\WINDOWS\system32\rundll32.exe] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 09:24 AM] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [10/18/2006 09:05 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 1:15:54 AM] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [9/13/2007 2:50:44 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRJCVop] rqRJCVop.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMdBTnm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}] Auto\command- D:\Start.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe *Newly Created Service* - COMHOST -- Hosts ----------------------------------------------------------------------- 127.0.0.1 localhost #***Inserted By STOPzilla*** -- End of Deckard's System Scanner: finished at 2008-06-30 22:03:46 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-03-2008, 03:46 PM
|
#2 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,638
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Hello and welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ It appears that you have two antivirus programs installed. Quote:
------------------------------------------------------ Quote:
We suggest uninstalling it via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Manager<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folder if it still exists: C:\Program Files\Viewpoint ------------------------------------------------------ Please download Combofix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named, to the desktop, next to ComboFix.exe Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
||
|
|
|
|
07-06-2008, 12:00 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 6
OS: xp
|
Re: Here is my Deckard log. Please help!
Chemist, thank you for reponding. I've deleted AVG and kept Norton. I've followed your instructions and now have posted the ComboFix and HiJackThis logs.
Thanks for your help. ComboFix 08-07-05.1 - Mona 2008-07-05 22:27:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.218 [GMT -7:00] Running from: C:\Documents and Settings\Mona\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mona\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMe76f1f9f.txt C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\aileerpj.dll C:\WINDOWS\system32\aohvqxit.dll C:\WINDOWS\system32\bbionwvp.dll C:\WINDOWS\system32\buokgmff.ini C:\WINDOWS\system32\cbgttrcm.dll C:\WINDOWS\system32\cdvhbflu.dll C:\WINDOWS\system32\dgbblz.dll C:\WINDOWS\system32\dumumsaw.dll C:\WINDOWS\system32\eddMlnpo.ini C:\WINDOWS\system32\eddMlnpo.ini2 C:\WINDOWS\system32\fjflicqb.dll C:\WINDOWS\system32\fualellm.ini C:\WINDOWS\system32\gjjlywsw.dll C:\WINDOWS\system32\gkomoasf.dll C:\WINDOWS\system32\gxwxnhma.dll C:\WINDOWS\system32\hitvqhvh.ini C:\WINDOWS\system32\hovmuk.dll C:\WINDOWS\system32\iqonqhjh.dll C:\WINDOWS\system32\juvmgfjt.dll C:\WINDOWS\system32\ljovwyay.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mnTBdMoq.ini C:\WINDOWS\system32\mnTBdMoq.ini2 C:\WINDOWS\system32\pqnhdpml.dll C:\WINDOWS\system32\pvwnoibb.ini C:\WINDOWS\system32\qoMdBTnm.dll C:\WINDOWS\system32\TCLkknpo.ini C:\WINDOWS\system32\TCLkknpo.ini2 C:\WINDOWS\system32\tulhwmvv.dll C:\WINDOWS\system32\tyybhvcl.dll C:\WINDOWS\system32\uaaydwub.dll C:\WINDOWS\system32\vbunypvh.dll C:\WINDOWS\system32\vvmwhlut.ini C:\WINDOWS\system32\wxhrbsua.dll C:\WINDOWS\system32\xbdgxhhj.ini C:\WINDOWS\system32\zexvuy.dll C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-05 21:24 . 2008-07-05 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-30 21:57 . 2008-06-30 21:57 <DIR> d-------- C:\Deckard 2008-06-30 20:30 . 2008-06-30 20:30 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-30 20:29 . 2008-06-30 20:30 812,344 --a------ C:\Program Files\HJTInstall.exe 2008-06-28 11:20 . 2008-06-28 11:21 15,070,104 --a------ C:\Program Files\SpySweeperRegSetup_EN.exe 2008-06-20 22:48 . 2008-06-30 11:16 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-19 07:01 . 2008-06-18 18:36 294 --ahs---- C:\WINDOWS\system32\hxdyoeci.ini 2008-06-18 18:54 . 2008-06-18 18:55 1,917 --a------ C:\WINDOWS\imsins.BAK 2008-06-18 18:36 . 2008-06-18 18:36 74 --ahs---- C:\WINDOWS\system32\hxdyoeci.tmp 2008-06-18 15:20 . 2008-06-18 15:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-18 15:20 . 2008-06-18 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19 . 2008-06-18 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 14:19 . 2008-06-18 14:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:19 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-06-18 14:19 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-06-18 14:19 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-06-18 14:19 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Program Files\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:18 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-06-18 14:17 . 2008-06-28 11:22 164 --a------ C:\install.dat 2008-06-16 16:23 . 2008-06-16 16:23 1,657,164 --ahs---- C:\WINDOWS\system32\mbmjgaep.tmp 2008-06-16 11:23 . 2008-07-04 01:57 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23 . 2008-06-16 11:23 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 11:23 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-16 11:23 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-16 11:23 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-16 11:23 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-14 22:08 . 2008-06-18 08:32 128 --a------ C:\Documents and Settings\Mona\services.exe 2008-06-14 22:07 . 2008-06-30 01:54 110,484 --a------ C:\WINDOWS\BMe76f1f9f.xml 2008-06-10 15:56 . 2008-04-14 04:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-06 05:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-06 05:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-06 04:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-06 04:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-01 05:35 --------- d-----w C:\Program Files\Norton 360 2008-06-30 09:46 --------- d-----w C:\Program Files\Bonjour 2008-06-19 01:55 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-17 18:58 --------- d-----w C:\Program Files\MySpace 2008-06-17 17:39 --------- d-----w C:\Program Files\Ahead 2008-06-16 17:48 --------- d-----w C:\Program Files\STOPzilla! 2008-06-16 17:43 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-16 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-06-15 06:07 --------- d-----w C:\Program Files\Windows Live 2008-06-15 06:06 --------- d-----w C:\Program Files\Musicmatch 2008-06-15 05:58 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-14 07:02 --------- d-----w C:\Documents and Settings\Mona\Application Data\LimeWire 2008-05-29 02:13 --------- d-----w C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-26 02:16 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-26 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-26 02:12 2,400,784 ----a-w C:\Program Files\WLinstaller.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-03 22:48 924,392 -c--a-w C:\Program Files\setup.exe 2008-03-18 03:10 9,525,462 -c--a-w C:\Program Files\aep292.exe 2008-03-11 23:13 199,021,300 -c--a-w C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip 2008-03-11 02:08 606,168 -c--a-w C:\Program Files\AmazonMP3Installer.exe 2007-02-03 00:07 722,176 ----a-w C:\Documents and Settings\Mona\gotomypc_428.exe 2006-09-09 01:51 563,712 ----a-w C:\Documents and Settings\Mona\gotomypc_370.exe 2006-03-14 05:38 563,712 ----a-w C:\Documents and Settings\Mona\370_gotomypc.exe 2005-08-18 04:11 8,192 -csha-w C:\Program Files\Thumbs.db 2004-09-24 18:23 204 -c--a-w C:\Program Files\princess.gif 2004-09-24 18:23 201 -c--a-w C:\Program Files\prince.gif 2004-09-24 18:23 1,458 -c--a-w C:\Program Files\reggie1_emoticon.bmp 2004-09-24 08:01 3,603,880 -c--a-w C:\Program Files\ssfsetup648_1761519317.exe 2004-09-04 03:23 462,919 ----a-w C:\Documents and Settings\Mona\gotomypc.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16 49152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16 5058560] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [2004-03-03 14:30 131072] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 03:10 57344] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-14 16:40 1836544] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [2008-03-26 17:40 2577120] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 12:37 51048] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 07:50 988512] "nwiz"="nwiz.exe" [2003-10-06 14:16 741376 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 18:23 443968] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-09-13 14:50:44 745472] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 BS_I2cIo;BS_I2cIo;C:\WINDOWS\System32\drivers\BS_I2cIo.sys [2003-11-20 16:04] R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 11:43] R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 12:37] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53] S2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2003-06-01 14:10] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2003-06-01 14:10] S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}] \Shell\Auto\command - D:\Start.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-07-04 01:10:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job" - C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe "2008-06-28 19:00:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-30 10:30:10 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job" - C:\Program Files\RegistrySmart\RegistrySmart.ex - C:\Program Files\RegistrySmart "2008-06-14 01:12:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy.job" - C:\PROGRA~1\SPYBOT~1\SpybotSD.exe "2008-06-30 09:00:09 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . - - - - ORPHANS REMOVED - - - - HKLM-Run-e45c2c03 - C:\WINDOWS\system32\tulhwmvv.dll Notify-rqRJCVop - rqRJCVop.dll MSConfigStartUp-BearShare - C:\Program Files\BearShare\BearShare.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-05 22:34:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-07-05 22:40:26 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-06 05:40:06 Pre-Run: 52,489,089,024 bytes free Post-Run: 52,564,873,216 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptOut C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 256 --- E O F --- 2008-06-11 04:05:34 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:44:13 PM, on 7/5/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] "C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" -boot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1163339409921 O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.mumbojumbo.com/assets/mjolauncher.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://noofy57.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.22/ttinst.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3209.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 11879 bytes |
|
|
|
|
07-06-2008, 03:53 PM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,638
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Hello again, noofy57. Please tell us how your system is behaving after doing the following.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please go to: VirusTotal
Are you familiar with this zipped file? Do you know what it belongs to? Please let us know. C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript into ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. If you use dial-up for the internet, skip this step and let me know. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: VirusTotal results C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
|
07-07-2008, 06:05 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 6
OS: xp
|
Re: Here is my Deckard log. Please help!
Hi Chemist. I followed your instructions again, but was unable to access the Kapersky Online Scanner. I got a message that said the Internet server or proxy server couldn't be located. Do you have another way for me to run this scan? Meanwhile, I've pasted the Virus Totals and the ComboFix.txt file below. I'll run the HijackThis log after I am able to run the Kapersky scan.
By the way, the zip file you asked about is for MS PhotoDraw V2. Thanks. ComboFix 08-07-05.1 - Mona 2008-07-07 14:38:44.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.208 [GMT -7:00] Running from: C:\Documents and Settings\Mona\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mona\Desktop\CFScript.txt * Created a new restore point FILE :: File:: C:\WINDOWS\system32\hxdyoeci.iniC:\WINDOWS\system32\hxdyoeci.tmpC:\Documents and Settings\Mona\services.exeC:\WINDOWS\BMe76f1f9f.xmlC:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.jobRegistry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}]Folder:: C:\Documents and Settings\All Users\Application Data\Avg8C:\Documents and Settings\All Users\Application Data\Viewpoint . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMe76f1f9f.xml . ((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))) . 2008-07-05 21:24 . 2008-07-05 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-06-30 21:57 . 2008-06-30 21:57 <DIR> d-------- C:\Deckard 2008-06-30 20:30 . 2008-06-30 20:30 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-30 20:29 . 2008-06-30 20:30 812,344 --a------ C:\Program Files\HJTInstall.exe 2008-06-28 11:20 . 2008-06-28 11:21 15,070,104 --a------ C:\Program Files\SpySweeperRegSetup_EN.exe 2008-06-20 22:48 . 2008-06-30 11:16 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-19 07:01 . 2008-06-18 18:36 294 --ahs---- C:\WINDOWS\system32\hxdyoeci.ini 2008-06-18 18:54 . 2008-06-30 03:00 1,917 --a------ C:\WINDOWS\imsins.BAK 2008-06-18 18:36 . 2008-06-18 18:36 74 --ahs---- C:\WINDOWS\system32\hxdyoeci.tmp 2008-06-18 15:20 . 2008-06-18 15:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-18 15:20 . 2008-06-18 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19 . 2008-06-18 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 14:19 . 2008-06-18 14:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:19 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-06-18 14:19 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-06-18 14:19 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-06-18 14:19 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Program Files\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:18 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-06-18 14:17 . 2008-06-28 11:22 164 --a------ C:\install.dat 2008-06-16 16:23 . 2008-06-16 16:23 1,657,164 --ahs---- C:\WINDOWS\system32\mbmjgaep.tmp 2008-06-16 11:23 . 2008-07-04 01:57 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23 . 2008-06-16 11:23 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 11:23 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-16 11:23 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-16 11:23 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-16 11:23 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-14 22:08 . 2008-06-18 08:32 128 --a------ C:\Documents and Settings\Mona\services.exe 2008-06-10 15:56 . 2008-06-13 06:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-07 21:37 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-07 05:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-06 05:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-06 04:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-01 05:35 --------- d-----w C:\Program Files\Norton 360 2008-06-30 09:46 --------- d-----w C:\Program Files\Bonjour 2008-06-19 01:55 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-17 18:58 --------- d-----w C:\Program Files\MySpace 2008-06-17 17:39 --------- d-----w C:\Program Files\Ahead 2008-06-16 17:48 --------- d-----w C:\Program Files\STOPzilla! 2008-06-16 17:43 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-16 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-06-15 06:07 --------- d-----w C:\Program Files\Windows Live 2008-06-15 06:06 --------- d-----w C:\Program Files\Musicmatch 2008-06-15 05:58 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-14 07:02 --------- d-----w C:\Documents and Settings\Mona\Application Data\LimeWire 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-29 02:13 --------- d-----w C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-26 02:16 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-26 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-26 02:12 2,400,784 ----a-w C:\Program Files\WLinstaller.exe 2008-05-16 18:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-03 22:48 924,392 -c--a-w C:\Program Files\setup.exe 2008-04-26 18:23 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-22 23:51 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-18 03:10 9,525,462 -c--a-w C:\Program Files\aep292.exe 2008-03-11 23:13 199,021,300 -c--a-w C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip 2008-03-11 02:08 606,168 -c--a-w C:\Program Files\AmazonMP3Installer.exe 2007-02-03 00:07 722,176 ----a-w C:\Documents and Settings\Mona\gotomypc_428.exe 2006-09-09 01:51 563,712 ----a-w C:\Documents and Settings\Mona\gotomypc_370.exe 2006-03-14 05:38 563,712 ----a-w C:\Documents and Settings\Mona\370_gotomypc.exe 2005-08-18 04:11 8,192 -csha-w C:\Program Files\Thumbs.db 2004-09-24 18:23 204 -c--a-w C:\Program Files\princess.gif 2004-09-24 18:23 201 -c--a-w C:\Program Files\prince.gif 2004-09-24 18:23 1,458 -c--a-w C:\Program Files\reggie1_emoticon.bmp 2004-09-24 08:01 3,603,880 -c--a-w C:\Program Files\ssfsetup648_1761519317.exe 2004-09-04 03:23 462,919 ----a-w C:\Documents and Settings\Mona\gotomypc.exe . ((((((((((((((((((((((((((((( snapshot@2008-07-05_22.39.47.56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-06 05:33:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-07 15:53:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-07-07 15:54:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_184.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16 49152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16 5058560] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [2004-03-03 14:30 131072] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 03:10 57344] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-14 16:40 1836544] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [2008-03-26 17:40 2577120] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 12:37 51048] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 07:50 988512] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024] "nwiz"="nwiz.exe" [2003-10-06 14:16 741376 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 18:23 443968] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-09-13 14:50:44 745472] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 BS_I2cIo;BS_I2cIo;C:\WINDOWS\System32\drivers\BS_I2cIo.sys [2003-11-20 16:04] R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 11:43] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53] S2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2003-06-01 14:10] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2003-06-01 14:10] S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66b570a4-a49f-11d9-a398-00e04cd2fd95}] \Shell\Auto\command - D:\Start.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-07-04 01:10:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job" - C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe "2008-06-28 19:00:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-30 10:30:10 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job" - C:\Program Files\RegistrySmart\RegistrySmart.ex - C:\Program Files\RegistrySmart "2008-06-14 01:12:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy.job" - C:\PROGRA~1\SPYBOT~1\SpybotSD.exe "2008-06-30 09:00:09 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-07 14:42:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-07 14:44:16 ComboFix-quarantined-files.txt 2008-07-07 21:43:51 ComboFix2.txt 2008-07-06 05:40:27 Pre-Run: 52,308,086,784 bytes free Post-Run: 52,362,674,176 bytes free 201 --- E O F --- 2008-07-07 04:19:35 File imsins.BAK received on 07.07.2008 23:21:33 (CET) Current status: finished Result: 0/33 (0%) Compact Print results Email: Antivirus Version Last Update Result AhnLab-V3 2008.7.4.1 2008.07.07 - AntiVir 7.8.0.64 2008.07.07 - Authentium 5.1.0.4 2008.07.06 - Avast 4.8.1195.0 2008.07.07 - AVG 7.5.0.516 2008.07.07 - BitDefender 7.2 2008.07.07 - CAT-QuickHeal 9.50 2008.07.07 - ClamAV 0.93.1 2008.07.07 - DrWeb 4.44.0.09170 2008.07.07 - eSafe 7.0.17.0 2008.07.07 - eTrust-Vet 31.6.5934 2008.07.07 - Ewido 4.0 2008.07.07 - F-Prot 4.4.4.56 2008.07.07 - F-Secure 7.60.13501.0 2008.07.03 - Fortinet 3.14.0.0 2008.07.07 - GData 2.0.7306.1023 2008.07.07 - Ikarus T3.1.1.26.0 2008.07.07 - Kaspersky 7.0.0.125 2008.07.07 - McAfee 5333 2008.07.07 - Microsoft 1.3704 2008.07.07 - NOD32v2 3248 2008.07.07 - Norman 5.80.02 2008.07.07 - Panda 9.0.0.4 2008.07.07 - Prevx1 V2 2008.07.07 - Rising 20.51.60.00 2008.07.06 - Sophos 4.31.0 2008.07.07 - Sunbelt 3.1.1509.1 2008.07.04 - Symantec 10 2008.07.07 - TheHacker 6.2.96.374 2008.07.07 - TrendMicro 8.700.0.1004 2008.07.07 - VBA32 3.12.6.8 2008.07.07 - VirusBuster 4.5.11.0 2008.07.07 - Webwasher-Gateway 6.6.2 2008.07.07 - Additional information File size: 1917 bytes MD5...: 2d006764d6ac4779984365785fe3ada5 SHA1..: c25ecf0a18252ca83e6b28783ddd7b9a32f4a64b SHA256: 9242f79cc9980224511c9719cb7e04688cc23b70c4968e1bb3f5a2f162851da8 SHA512: 2f48689f053f721b50a74f2c1afdcf439088edf43caca309c5850bb2c4f6d46c1e346c20e05c56550a8746ee9d842d65ecab664842b894abc767ed88bea3ab40 PEiD..: - PEInfo: - File mbmjgaep.tmp received on 07.07.2008 23:26:56 (CET) Current status: finished Result: 0/33 (0%) Compact Print results Email: Antivirus Version Last Update Result AhnLab-V3 2008.7.8.0 2008.07.07 - AntiVir 7.8.0.64 2008.07.07 - Authentium 5.1.0.4 2008.07.06 - Avast 4.8.1195.0 2008.07.07 - AVG 7.5.0.516 2008.07.07 - BitDefender 7.2 2008.07.07 - CAT-QuickHeal 9.50 2008.07.07 - ClamAV 0.93.1 2008.07.07 - DrWeb 4.44.0.09170 2008.07.07 - eSafe 7.0.17.0 2008.07.07 - eTrust-Vet 31.6.5929 2008.07.05 - Ewido 4.0 2008.07.07 - F-Prot 4.4.4.56 2008.07.07 - F-Secure 7.60.13501.0 2008.07.03 - Fortinet 3.14.0.0 2008.07.07 - GData 2.0.7306.1023 2008.07.07 - Ikarus T3.1.1.26.0 2008.07.07 - Kaspersky 7.0.0.125 2008.07.07 - McAfee 5333 2008.07.07 - Microsoft 1.3704 2008.07.07 - NOD32v2 3248 2008.07.07 - Norman 5.80.02 2008.07.07 - Panda 9.0.0.4 2008.07.07 - Prevx1 V2 2008.07.07 - Rising 20.51.60.00 2008.07.06 - Sophos 4.31.0 2008.07.07 - Sunbelt 3.1.1509.1 2008.07.04 - Symantec 10 2008.07.07 - TheHacker 6.2.96.374 2008.07.07 - TrendMicro 8.700.0.1004 2008.07.07 - VBA32 3.12.6.8 2008.07.07 - VirusBuster 4.5.11.0 2008.07.07 - Webwasher-Gateway 6.6.2 2008.07.07 - Additional information File size: 1657164 bytes MD5...: 385a09c5aa991b00f94992e0c001bf8b SHA1..: 85200781840031d5305c25a4f045a17a734d3d7a SHA256: 556230e946345e0f826be23f72f37fab238ef76a6f97ba2ac50e3b54bc9b023a SHA512: 5c93be331455b20e83ae732b73fd3e6fcf220639f78892b522fb6cee8733adf042c62f5fc632b51e4d5f5653584bdaefe6aed7ea7512cbb01ede300d8689b624 PEiD..: - PEInfo: - File setup.exe received on 07.07.2008 23:28:59 (CET) Current status: finished Result: 0/33 (0%) Compact Print results Email: Antivirus Version Last Update Result AhnLab-V3 2008.7.8.0 2008.07.07 - AntiVir 7.8.0.64 2008.07.07 - Authentium 5.1.0.4 2008.07.06 - Avast 4.8.1195.0 2008.07.07 - AVG 7.5.0.516 2008.07.07 - BitDefender 7.2 2008.07.07 - CAT-QuickHeal 9.50 2008.07.07 - ClamAV 0.93.1 2008.07.07 - DrWeb 4.44.0.09170 2008.07.07 - eSafe 7.0.17.0 2008.07.07 - eTrust-Vet 31.6.5934 2008.07.07 - Ewido 4.0 2008.07.07 - F-Prot 4.4.4.56 2008.07.07 - F-Secure 7.60.13501.0 2008.07.03 - Fortinet 3.14.0.0 2008.07.07 - GData 2.0.7306.1023 2008.07.07 - Ikarus T3.1.1.26.0 2008.07.07 - Kaspersky 7.0.0.125 2008.07.07 - McAfee 5333 2008.07.07 - Microsoft 1.3704 2008.07.07 - NOD32v2 3248 2008.07.07 - Norman 5.80.02 2008.07.07 - Panda 9.0.0.4 2008.07.07 - Prevx1 V2 2008.07.07 - Rising 20.51.60.00 2008.07.06 - Sophos 4.31.0 2008.07.07 - Sunbelt 3.1.1509.1 2008.07.04 - Symantec 10 2008.07.07 - TheHacker 6.2.96.374 2008.07.07 - TrendMicro 8.700.0.1004 2008.07.07 - VBA32 3.12.6.8 2008.07.07 - VirusBuster 4.5.11.0 2008.07.07 - Webwasher-Gateway 6.6.2 2008.07.07 - Additional information File size: 924392 bytes MD5...: 653d37a00fd0a36db117e69d9db9940d SHA1..: 8bfb03b5638b5d04354d03151eafa98416087191 SHA256: e76265c9368e9827fac90de7e5ea85c79405f5b07031d4673927f45c9dcc8760 SHA512: 2914daf969a2ff5f5e8b2216bc77292824a85948432845060566dc8c5831f0c442d3abf3fbf7c47c0dd3a70adbf339b0281e019f0bcfe9a195151930eb6fb5f7 PEiD..: - PEInfo: PE Structure information( base data )entrypointaddress.: 0x4032d3timedatestamp.....: 0x43429117 (Tue Oct 04 14:26:31 2005)machinetype.......: 0x14c (I386)( 5 sections )name viradd virsiz rawdsiz ntrpy md5.text 0x1000 0x59ca 0x5a00 6.46 415d0ae9b0c2be5b45e2bcbd11fb407e.rdata 0x7000 0x10e8 0x1200 5.02 f870f90a47f7a2270ce674aad4684865.data 0x9000 0x1b3f4 0x400 5.12 1579dbc69ba4f679db829794dbb7c6be.ndata 0x25000 0x9000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e.rsrc 0x2e000 0x5000 0x4200 5.87 76c2be9b60af4f9f71383e1a9728dd04( 8 imports ) > KERNEL32.dll: SetFileTime, CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, CreateFileA, GetFileSize, GetModuleFileNameA, GetTickCount, GetCurrentProcess, CopyFileA, ExitProcess, lstrcpynA, CloseHandle, GetWindowsDirectoryA, GetTempPathA, GetUserDefaultLangID, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, SetEndOfFile, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, lstrcpyA, lstrlenA, lstrcatA, GetSystemDirectoryA, lstrcmpiA, GetEnvironmentVariableA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, SetErrorMode, GetModuleHandleA, LoadLibraryA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, MulDiv, GetPrivateProfileStringA, WriteFile, ReadFile, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetCommandLineA> USER32.dll: EndDialog, ScreenToClient, GetWindowRect, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, LoadCursorA, SetCursor, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, RegisterClassA, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxA, CharPrevA, DispatchMessageA, PeekMessageA, CreateDialogParamA, DestroyWindow, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfA, SendMessageTimeoutA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, TrackPopupMenu, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, FindWindowExA> GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject> SHELL32.dll: SHGetMalloc, SHGetPathFromIDListA, SHBrowseForFolderA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation> ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA> COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create> ole32.dll: OleInitialize, OleUninitialize, CoCreateInstance> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA( 0 exports ) |
|
|
|
|
07-07-2008, 08:16 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,638
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Hello again, noofy57. Thanks for letting me know about the zip file.
Never heard that complaint about server problems before while running Kaspersky. I will give you a link to a different version Kaspersky scanner shortly, but you may still have the same problem. Just let me know. We have another problem. CFScript didn't work right. Please do the following exactly as described: Delete combofix.exe from your desktop. Please download Combofix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. Get help here Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
Referring to the picture above, drag CFScript into ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior Last edited by chemist; 07-07-2008 at 08:24 PM. |
|
|
|
|
|
07-08-2008, 05:26 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 6
OS: xp
|
Re: Here is my Deckard log. Please help!
Hello Chemist. I was able to run the Kaspersky scan this time. Thank you. I've posted my new ComboFixt.txt log, Kasperksky scan and HijackThis log below. My computer has been behaving very well. I haven't seen any pop ups, nor has my browser been redirected. Also, it's not taking as long to load when I first fire up my pc.
ComboFix 08-07-07.3 - Mona 2008-07-08 13:02:02.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.221 [GMT -7:00] Running from: C:\Documents and Settings\Mona\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Mona\Desktop\CFScript.txt * Created a new restore point FILE :: C:\Documents and Settings\Mona\services.exe C:\WINDOWS\system32\hxdyoeci.ini C:\WINDOWS\system32\hxdyoeci.tmp C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Avg8 C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Documents and Settings\Mona\services.exe C:\WINDOWS\system32\hxdyoeci.ini C:\WINDOWS\system32\hxdyoeci.tmp C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job . ((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 ))))))))))))))))))))))))))))))) . 2008-07-07 14:55 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-30 21:57 . 2008-06-30 21:57 <DIR> d-------- C:\Deckard 2008-06-30 20:30 . 2008-06-30 20:30 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-30 20:29 . 2008-06-30 20:30 812,344 --a------ C:\Program Files\HJTInstall.exe 2008-06-28 11:20 . 2008-06-28 11:21 15,070,104 --a------ C:\Program Files\SpySweeperRegSetup_EN.exe 2008-06-20 22:48 . 2008-06-30 11:16 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\RegistrySmart 2008-06-18 18:54 . 2008-06-30 03:00 1,917 --a------ C:\WINDOWS\imsins.BAK 2008-06-18 15:20 . 2008-06-18 15:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-18 15:20 . 2008-06-18 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-18 15:19 . 2008-06-18 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-18 14:19 . 2008-06-18 14:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-06-18 14:19 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-06-18 14:19 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-06-18 14:19 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-06-18 14:19 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Program Files\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\Webroot 2008-06-18 14:18 . 2008-06-18 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-06-18 14:18 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-06-18 14:17 . 2008-06-28 11:22 164 --a------ C:\install.dat 2008-06-16 16:23 . 2008-06-16 16:23 1,657,164 --ahs---- C:\WINDOWS\system32\mbmjgaep.tmp 2008-06-16 11:23 . 2008-07-04 01:57 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-16 11:23 . 2008-06-16 11:23 <DIR> d-------- C:\Documents and Settings\Mona\Application Data\PC Tools 2008-06-16 11:23 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-16 11:23 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-16 11:23 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-16 11:23 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-10 15:56 . 2008-06-13 06:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-08 20:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-08 06:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-07 21:55 --------- d-----w C:\Program Files\Java 2008-07-06 05:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-01 05:35 --------- d-----w C:\Program Files\Norton 360 2008-06-30 09:46 --------- d-----w C:\Program Files\Bonjour 2008-06-19 01:55 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-17 18:58 --------- d-----w C:\Program Files\MySpace 2008-06-17 17:39 --------- d-----w C:\Program Files\Ahead 2008-06-16 17:48 --------- d-----w C:\Program Files\STOPzilla! 2008-06-16 17:43 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-16 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-06-15 06:07 --------- d-----w C:\Program Files\Windows Live 2008-06-15 06:06 --------- d-----w C:\Program Files\Musicmatch 2008-06-15 05:58 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-14 07:02 --------- d-----w C:\Documents and Settings\Mona\Application Data\LimeWire 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-29 02:13 --------- d-----w C:\Documents and Settings\Mona\Application Data\Windows Live Writer 2008-05-26 02:16 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-26 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-26 02:12 2,400,784 ----a-w C:\Program Files\WLinstaller.exe 2008-05-16 18:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-03 22:48 924,392 -c--a-w C:\Program Files\setup.exe 2008-04-26 18:23 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-22 23:51 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-18 03:10 9,525,462 -c--a-w C:\Program Files\aep292.exe 2008-03-11 23:13 199,021,300 -c--a-w C:\Program Files\25dc4d236d00087cde56a67fd0657387d03cd67a7d4.zip 2008-03-11 02:08 606,168 -c--a-w C:\Program Files\AmazonMP3Installer.exe 2007-02-03 00:07 722,176 ----a-w C:\Documents and Settings\Mona\gotomypc_428.exe 2006-09-09 01:51 563,712 ----a-w C:\Documents and Settings\Mona\gotomypc_370.exe 2006-03-14 05:38 563,712 ----a-w C:\Documents and Settings\Mona\370_gotomypc.exe 2005-08-18 04:11 8,192 -csha-w C:\Program Files\Thumbs.db 2004-09-24 18:23 204 -c--a-w C:\Program Files\princess.gif 2004-09-24 18:23 201 -c--a-w C:\Program Files\prince.gif 2004-09-24 18:23 1,458 -c--a-w C:\Program Files\reggie1_emoticon.bmp 2004-09-24 08:01 3,603,880 -c--a-w C:\Program Files\ssfsetup648_1761519317.exe 2004-09-04 03:23 462,919 ----a-w C:\Documents and Settings\Mona\gotomypc.exe . ((((((((((((((((((((((((((((( snapshot@2008-07-05_22.39.47.56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-06 05:33:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-07-08 20:08:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys - 2008-02-22 08:23:35 135,168 -c--a-w C:\WINDOWS\system32\java.exe + 2008-03-25 08:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2008-02-22 08:23:39 135,168 -c--a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 08:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe - 2008-02-22 09:33:32 139,264 -c--a-w C:\WINDOWS\system32\javaws.exe + 2008-03-25 09:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-02-26 01:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16 49152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16 5058560] "NvMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" [2004-03-03 14:30 131072] "Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 03:10 57344] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-14 16:40 1836544] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "PC Pitstop Optimize Scheduler"="C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" [2008-03-26 17:40 2577120] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 12:37 51048] "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 07:50 988512] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "nwiz"="nwiz.exe" [2003-10-06 14:16 741376 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 18:23 443968] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2007-09-13 14:50:44 745472] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 BS_I2cIo;BS_I2cIo;C:\WINDOWS\System32\drivers\BS_I2cIo.sys [2003-11-20 16:04] R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 11:43] R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 12:37] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53] S2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2003-06-01 14:10] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2003-06-01 14:10] S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-07-04 01:10:00 C:\WINDOWS\Tasks\Ad-Aware SE Personal.job" - C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe "2008-06-28 19:00:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-14 01:12:00 C:\WINDOWS\Tasks\Spybot - Search & Destroy.job" - C:\PROGRA~1\SPYBOT~1\SpybotSD.exe "2008-06-30 09:00:09 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job" - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex - A:\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-08 13:08:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-07-08 13:14:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-08 20:14:25 ComboFix2.txt 2008-07-07 21:44:18 ComboFix3.txt 2008-07-06 05:40:27 Pre-Run: 52,228,894,720 bytes free Post-Run: 52,302,536,704 bytes free 226 --- E O F --- 2008-07-07 04:19:35 ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, July 08, 2008 3:30:17 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 8/07/2008 Kaspersky Anti-Virus database records: 928985 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 149384 Number of viruses found: 17 Number of infected objects: 57 Number of suspicious objects: 0 Duration of the scan process: 01:42:26 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\ccSubSDK\submissions.idx Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.DAT Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\volatile.DAT Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\{6D820340-35CC-4359-9004-67D1E0992A0E}.DAT Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\{AD9F3321-CB42-473C-9E70-E57E7DC02DB4}.DAT Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-07-08_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\Shl_{0421C30D-E956-4209-AD1D-F75CD7F7E649}.ldb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\Shl_{0421C30D-E956-4209-AD1D-F75CD7F7E649}.sds Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\LightningSand.CFD Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\24AA9539.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\C154C89F.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mona\Application Data\Symantec\NPMDataStore\CIMStore.xml Object is locked skipped C:\Documents and Settings\Mona\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Mona\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Mona\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Mona\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mona\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mona\ntuser.dat Object is locked skipped C:\Documents and Settings\Mona\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Norton 360\Log\AutoProtect.log Object is locked skipped C:\Program Files\Norton 360\Log\AVContext.log Object is locked skipped C:\Program Files\Norton 360\Log\AVManual.log Object is locked skipped C:\Program Files\Norton 360\Log\Backup.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log Object is locked skipped C:\Program Files\Norton 360\Log\CUInternetTempFiles.log Object is locked skipped C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log Object is locked skipped C:\Program Files\Norton 360\Log\EmailScan.log Object is locked skipped C:\Program Files\Norton 360\Log\HomeNetworking.log Object is locked skipped C:\Program Files\Norton 360\Log\InternetSecurity.log Object is locked skipped C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log Object is locked skipped C:\Program Files\Norton 360\Log\ISIOTraffic.log Object is locked skipped C:\Program Files\Norton 360\Log\ISNewNetwork.log Object is locked skipped C:\Program Files\Norton 360\Log\LiveUpdate.log Object is locked skipped C:\Program Files\Norton 360\Log\NCO.log Object is locked skipped C:\Program Files\Norton 360\Log\RegClean.log Object is locked skipped C:\Program Files\Norton 360\Log\VABrowserSettings.log Object is locked skipped C:\Program Files\Norton 360\Log\VAIPAddresses.log Object is locked skipped C:\Program Files\Norton 360\Log\WDFScanner.log Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\12036F8D Infected: not-a-virus:AdWare.Win32.PurityScan.ap skipped C:\Program Files\Norton AntiVirus\Quarantine\7B680193 Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped C:\Program Files\Norton AntiVirus\Quarantine\7B6B2B90 Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\aileerpj.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\aohvqxit.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\bbionwvp.dll.vir Infected: Trojan-Clicker.Win32.Agent.auw skipped C:\QooBox\Quarantine\C\WINDOWS\system32\cbgttrcm.dll.vir Infected: Trojan.Win32.Monder.yo skipped C:\QooBox\Quarantine\C\WINDOWS\system32\cdvhbflu.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\dgbblz.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\dumumsaw.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\fjflicqb.dll.vir Infected: Trojan.Win32.Monder.yo skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gjjlywsw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zuk skipped C:\QooBox\Quarantine\C\WINDOWS\system32\gxwxnhma.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\hovmuk.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\iqonqhjh.dll.vir Infected: Trojan.Win32.Monder.ys skipped C:\QooBox\Quarantine\C\WINDOWS\system32\juvmgfjt.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ljovwyay.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\pqnhdpml.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zjy skipped C:\QooBox\Quarantine\C\WINDOWS\system32\qoMdBTnm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zdn skipped C:\QooBox\Quarantine\C\WINDOWS\system32\tyybhvcl.dll.vir Infected: Trojan.Win32.Monder.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\uaaydwub.dll.vir Infected: Trojan.Win32.Monder.ys skipped C:\QooBox\Quarantine\C\WINDOWS\system32\vbunypvh.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wxhrbsua.dll.vir Infected: Trojan.Win32.Mondera.gen skipped C:\ss_dys_xmas.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.Quick.a skipped C:\ss_dys_xmas.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\ss_dys_xmas.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.EZula.u skipped C:\ss_dys_xmas.exe/WISE0020.BIN Infected: not-a-virus:AdWare.Win32.Gator.3103 skipped C:\ss_dys_xmas.exe/WISE0021.BIN Infected: Trojan-Dropper.Win32.Small.jh skipped C:\ss_dys_xmas.exe WiseSFX: infected - 5 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP789\A0211744.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP795\A0214180.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP795\A0219559.dll Infected: Trojan.Win32.Monder.yn skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP801\A0230865.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP802\A0233130.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP802\A0234177.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP802\A0234188.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP804\A0238373.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239784.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239785.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239786.dll Infected: Trojan-Clicker.Win32.Agent.auw skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239787.dll Infected: Trojan.Win32.Monder.yo skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239788.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239789.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239790.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239791.dll Infected: Trojan.Win32.Monder.yo skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239792.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.zuk skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239794.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239795.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239796.dll Infected: Trojan.Win32.Monder.ys skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239797.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239798.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239799.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.zjy skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239800.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.zdn skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239802.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239803.dll Infected: Trojan.Win32.Monder.ys skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239804.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP812\A0239805.dll Infected: Trojan.Win32.Mondera.gen skipped C:\System Volume Information\_restore{E05FAEB9-64A1-412C-9879-28262DD3C053}\RP817\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\etc\Hosts.bak Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\JET9CEB.tmp Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_24c.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:33:35 PM, on 7/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe" O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] "C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe" -boot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1163339409921 O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.mumbojumbo.com/assets/mjolauncher.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://noofy57.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.22/ttinst.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3209.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 11801 bytes |
|
|
|
|
07-08-2008, 07:04 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,638
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
Good job! Everything worked that time.
Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky log, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now. Delete the following File if it still exists: C:\ss_dys_xmas.exe If deletion fails, try in Safe Mode. Let me know if it resists deletion. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
07-09-2008, 02:40 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: The OC, California
Posts: 6
OS: xp
|
Re: Here is my Deckard log. Please help!
Chemist, thank you for all of your help. I'm very grateful. Everything seems to be working perfectly. I've uninstalled ComboFix as you instructed and deleted C:\ss_dys_xmas.exe with no problems. In regard to the the free spyware protection programs you suggeted, should I download all of them, or is there a specific few I should use?
Again, thank you so much. You've saved me a lot of stress and money! Mona |
|
|
|
|
07-09-2008, 03:30 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,638
OS: XP SP3
|
Re: Here is my Deckard log. Please help!
I would install all of them, but especially IE-Spyad and MVPS Hosts file. Spybot can be a bit tricky for less savy users. The more you install, the more layers of protection you have against malware infecting your system.
You're very welcome! 
|
|
|
|
| Thread Tools | |
|
|
