Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Help needed with popup windows
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 07-04-2008, 03:49 AM   #1 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Help needed with popup windows
I run Windows XP Pro Service Pack 2. I also have Symantec Antivirus running.

Last week I had a virus that removed my Control Panel, stopped Explorer seeing any local drive, disabled regedit, plus added “Virus Alert” to the clock and to System Properties / Registered to. Also, whenever I tried to open a site in Internet Explorer I got redirected to asiuoqgusdbaksd.com and the on to a random site.

Using several helpful sites I have removed all of these problems (I ran Adaware, ComboFix, SmitFraudFix and StopZilla). The remaining problems are that I get popup windows when in Internet Explorer going to sites such as vanquish.co.uk, adultfriendfinder, and others I don’t want popping up!! I have also had explorer.exe disappear a few times and not restart. This leaves me with no task bar or start menu until I log off and back on.

Whenever I restart the PC, Symantec is detecting and quarantining IEDEFENDER issues. The files associated with these seem to be the files within SmitFraudFix, so may be a red herring????

Below are the outputs from Deckard's System Scanner and hijackthis.

Thnks for ay help.

Regards
Eddie

Deckard's System Scanner v20071014.68
Run by eoreilly on 2008-07-04 10:45:33
Computer is in Normal Mode.
--------------------------------------------------------------------------------

System Drive C: has 8.56 GiB (less than 15%) free.


-- HijackThis (run as eoreilly.exe) --------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:42, on 04/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ABAserver\servers\cvbroker.exe
C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Symantec AntiVirus\VPC32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\eoreilly\Desktop\Virus Software\dss.exe
C:\DOCUME~1\eoreilly\Desktop\VIRUSS~1\eoreilly.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3B558A4F-7D3A-4607-9331-56BB3B959069} - C:\WINDOWS\system32\mlJYSlIC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {84C53226-C282-41FE-A4B4-8F05CC5EC24B} - C:\WINDOWS\system32\yayyWooM.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CertReg] C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [71148bfa] rundll32.exe "C:\WINDOWS\system32\tikpbeba.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\Software\..\Telephony: DomainName = rocketsoftware.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CorVu Broker (cvbroker) - Unknown owner - C:\ABAserver\servers\cvbroker.exe
O23 - Service: CorVu HTM Service (cvhtmsvc) - Unknown owner - C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\CorVuPreSales\Tomcat\bin\tomcat5.exe

--
End of file - 13503 bytes

-- Files created between 2008-06-04 and 2008-07-04 -----------------------------

2008-07-04 10:22:19 0 d-------- C:\gggggg
2008-07-03 16:25:43 91520 --a------ C:\WINDOWS\system32\tikpbeba.dll
2008-07-02 17:24:05 0 d-------- C:\Documents and Settings\eoreilly\Application Data\salesforce.com
2008-07-02 17:05:59 623104 --a------ C:\WINDOWS\system32\nsldapssl32v30.dll <Not Verified; Netscape Communications Corporation; Lightweight Directory Access Protocol DLL>
2008-07-02 17:05:55 1089536 --a------ C:\WINDOWS\system32\CcSkinny.dll <Not Verified; CallComm Technologies, Inc.; CallComm Skinny>
2008-07-02 16:40:37 0 d-------- C:\Program Files\Cisco Systems, Inc
2008-07-02 00:14:26 0 d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-07-02 00:10:27 0 d-------- C:\Program Files\Common Files\iS3
2008-07-02 00:10:24 0 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-07-01 19:10:27 5998 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-01 19:08:40 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-07-01 19:08:40 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-07-01 19:08:40 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-07-01 19:08:40 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-07-01 19:08:40 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-07-01 19:08:40 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-07-01 19:05:59 0 d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\Adobe
2008-07-01 18:25:32 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-01 16:32:58 0 d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\Identities
2008-07-01 16:32:58 0 d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\ATI
2008-07-01 16:32:57 0 d--h----- C:\Documents and Settings\corvu.EDDIEOREILLY\Templates
2008-07-01 16:32:57 0 dr------- C:\Documents and Settings\corvu.EDDIEOREILLY\Start Menu
2008-07-01 16:32:57 0 dr-h----- C:\Documents and Settings\corvu.EDDIEOREILLY\SendTo
2008-07-01 16:32:57 0 dr-h----- C:\Documents and Settings\corvu.EDDIEOREILLY\Recent
2008-07-01 16:32:57 0 d--h----- C:\Documents and Settings\corvu.EDDIEOREILLY\PrintHood
2008-07-01 16:32:57 0 d--h----- C:\Documents and Settings\corvu.EDDIEOREILLY\NetHood
2008-07-01 16:32:57 0 dr------- C:\Documents and Settings\corvu.EDDIEOREILLY\My Documents
2008-07-01 16:32:57 0 d--h----- C:\Documents and Settings\corvu.EDDIEOREILLY\Local Settings
2008-07-01 16:32:57 0 dr------- C:\Documents and Settings\corvu.EDDIEOREILLY\Favorites
2008-07-01 16:32:57 0 d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Desktop
2008-07-01 16:32:57 0 d--hs---- C:\Documents and Settings\corvu.EDDIEOREILLY\Cookies
2008-07-01 16:32:57 0 dr-h----- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data
2008-07-01 16:32:57 0 d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\SampleView
2008-07-01 16:32:57 0 d---s---- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\Microsoft
2008-07-01 16:32:55 786432 --ah----- C:\Documents and Settings\corvu.EDDIEOREILLY\NTUSER.DAT
2008-07-01 16:24:23 0 d-------- C:\Documents and Settings\eoreilly\Application Data\TmpRecentIcons
2008-07-01 16:20:28 1723 --a------ C:\WINDOWS\system32\clbinit.dll
2008-07-01 16:10:30 0 d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2008-07-01 16:10:12 0 d-------- C:\Program Files\AVS4YOU
2008-07-01 16:10:12 0 d-------- C:\Program Files\AviSynth 2.5
2008-07-01 16:10:03 0 d-------- C:\Program Files\Avi2Dvd
2008-07-01 14:05:11 0 d-------- C:\Documents and Settings\corvu\Application Data\Adobe
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Templates
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Local Settings
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Favorites
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Cookies
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Application Data
2008-07-01 13:53:17 0 d-------- C:\Documents and Settings\corvu\Application Data\Microsoft
2008-07-01 13:53:15 786432 --ah----- C:\Documents and Settings\corvu\NTUSER.DAT
2008-07-01 11:16:12 0 d-------- C:\Program Files\Trend Micro
2008-07-01 09:54:08 0 d-------- C:\Program Files\Lavasoft
2008-07-01 09:54:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-30 23:38:48 9629696 --a------ C:\Documents and Settings\eoreilly\ntuser.dat
2008-06-30 23:38:47 262144 --a------ C:\Documents and Settings\LocalService\ntuser.dat
2008-06-30 23:38:33 212016 --ahs---- C:\WINDOWS\system32\CIlSYJlm.ini2
2008-06-30 23:38:30 318208 --a------ C:\WINDOWS\system32\mlJYSlIC.dll
2008-06-30 22:32:45 81920 --a------ C:\WINDOWS\tovafrnm.exe
2008-06-30 22:32:45 200704 --a------ C:\WINDOWS\qegbdmwf.dll
2008-06-30 22:32:45 229376 --a------ C:\WINDOWS\pntqkflv.dll
2008-06-30 22:32:45 94208 --a------ C:\WINDOWS\eftl.exe
2008-06-30 19:55:54 0 d-------- C:\Program Files\Invoice2go 4.0
2008-06-29 14:13:57 0 d-------- C:\Program Files\WinAVI Video Converter
2008-06-16 16:34:28 0 d-------- C:\Documents and Settings\eoreilly\Application Data\dvdcss
2008-06-16 14:41:57 0 d-------- C:\Documents and Settings\eoreilly\Application Data\Nero
2008-06-16 14:35:34 0 d-------- C:\Program Files\Common Files\Nero
2008-06-16 14:35:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-06-04 10:04:08 0 d-------- C:\Documents and Settings\eoreilly\Application Data\OfficeUpdate12


-- Find3M Report ---------------------------------------------------------------

2008-07-04 08:56:05 256 --a------ C:\WINDOWS\system32\pool.bin
2008-07-04 08:54:38 0 d-------- C:\Program Files\Symantec AntiVirus
2008-07-02 1701 0 d-------- C:\Program Files\Cisco Systems
2008-07-02 17:05:34 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-02 16:33:08 0 d-------- C:\Documents and Settings\eoreilly\Application Data\Newsbin
2008-07-02 00:10:27 0 d-------- C:\Program Files\Common Files
2008-06-29 12:56:55 0 d-------- C:\Program Files\Common Files\AVSMedia
2008-06-24 19:42:19 0 d-------- C:\Program Files\EPSON Print CD
2008-06-16 14:35:34 0 d-------- C:\Program Files\Nero
2008-06-16 13:48:44 0 d-------- C:\Documents and Settings\eoreilly\Application Data\AdobeUM
2008-06-16 13:41:13 0 d-------- C:\Program Files\Common Files\Ahead
2008-06-13 16:42:18 0 d-------- C:\Documents and Settings\eoreilly\Application Data\Adobe
2008-06-04 18:26:56 0 d-------- C:\Documents and Settings\eoreilly\Application Data\Ahead
2008-06-01 13:33:00 0 d-------- C:\Program Files\Ahead
2008-05-28 13:48:14 0 d-------- C:\Program Files\AC3Filter
2008-05-28 12:48:59 0 d-------- C:\Program Files\Xvid
2008-05-28 10:29:40 0 d-------- C:\Program Files\DivX
2008-05-28 10:25:17 0 d-------- C:\Program Files\InterActual
2008-05-27 13:23:13 0 d-------- C:\Program Files\Common Files\Adobe
2008-05-27 0922 0 d-------- C:\Documents and Settings\eoreilly\Application Data\Roxio
2008-05-21 13:34:59 1327 --a------ C:\WINDOWS\EntPack.dat
2008-05-21 08:02:03 0 d-------- C:\Program Files\Alcohol Soft
2008-05-20 20:42:30 0 d-------- C:\Documents and Settings\eoreilly\Application Data\U3
2008-05-13 02:53:16 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-13 02:50:16 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-05-13 02:50:16 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-05-13 02:50:08 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:50:08 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:50:06 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:49:02 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-06 08:35:49 0 d-------- C:\Program Files\Windows Grep
2008-04-27 10:35:28 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-04-27 10:33:36 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-04-16 19:56:46 524288 --a------ C:\WINDOWS\opuc.dll <Not Verified; Microsoft Corporation; 2007 Microsoft Office system>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3B558A4F-7D3A-4607-9331-56BB3B959069}]
30/06/2008 23:38 318208 --a------ C:\WINDOWS\system32\mlJYSlIC.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84C53226-C282-41FE-A4B4-8F05CC5EC24B}]
C:\WINDOWS\system32\yayyWooM.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [20/05/2005 10:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [06/05/2005 23:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [14/03/2007 03:43]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [10/05/2006 19:12]
"PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.exe" [14/02/2006 19:56]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [31/03/2006 17:01]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [28/03/2006 22:13]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [22/12/2003 19:12]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [23/03/2006 19:38]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [21/04/2006 17:30]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [21/12/2005 00:51]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [10/03/2006 01:38]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [15/02/2006 16:43]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" []
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [11/09/2006 05:40]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [11/09/2006 05:40]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [16/02/2007 11:54]
"@"="" []
"CertReg"="C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe" [31/07/2002 15:29]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [08/05/2007 17:24]
"Media Codec Update Service"="C:\Program Files\Essentials Codec Pack\update.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [29/05/2007 16:33]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [07/10/2007 20:48]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" []
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [28/04/2008 17:14]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [18/02/2008 17:29]
"71148bfa"="C:\WINDOWS\system32\tikpbeba.dll" [03/07/2008 16:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 12:34]
"GoToMeeting"="C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe" [05/11/2007 13:00]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [11/09/2006 05:40]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 09:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [28/02/2007 20:57:12]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{84C53226-C282-41FE-A4B4-8F05CC5EC24B}"= C:\WINDOWS\system32\yayyWooM.dll [ ]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\mlJYSlIC
"Notification Packages"= scecli AsWlnPkg

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=addAdmin.vbs

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys]
@="driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance ASChannel
HPZ12 Pml Driver HPZ12 Net Driver HPZ12


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e556234-3cb7-11dd-b5b7-0017a4cfae5f}]
AutoRun\command- G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592844-3dd0-11dd-b5b8-001a6b139563}]
AutoRun\command- G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592845-3dd0-11dd-b5b8-001a6b139563}]
AutoRun\command- G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592846-3dd0-11dd-b5b8-001a6b139563}]
AutoRun\command- G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f44e79f7-82e0-11dc-b56a-0017a4cfae5f}]
AutoRun\command- G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd3cff2f-864d-11dc-b56c-001a6b139563}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe




-- End of Deckard's System Scanner: finished at 2008-07-04 10:46:30 ------------
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 07-04-2008, 05:44 AM   #2 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
and attached is the extra.txt..
Attached Files
File Type: txt extra.txt (27.7 KB, 0 views)
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 04:09 AM   #3 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Bump, still same issue with poups and losing Taskbar.
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 10:33 AM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
Combofix is not a tool which should be used unless under the direct supervision of a trained helper.

Since you've already run it, post the last log produced, it should be located at C:\ComboFix.txt
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 12:11 PM   #5 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Sorry, I have cleaned up Combfix and it's associated files.

Do you want me to redownload and run again?
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 12:14 PM   #6 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
I'd like you to do this:

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return.

Once the Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.



Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 01:12 PM   #7 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
ComboFix 08-07-05.1 - eoreilly 2008-07-07 19:41:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.242 [GMT 1:00]
Running from: C:\Documents and Settings\eoreilly\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\eoreilly\g2mdlhlpx.exe
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\CY_TO_TIF.bat
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@300cforums[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@adtech[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@advertising[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@adviva[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@cdcovers.adonspot[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@cdcovers[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@clickshift[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@connextra[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@connextra[3].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@connextra[4].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@connextra[5].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@doubleclick[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@ebay.co[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@ebay[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@ebayobjects[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@ecustomeropinions[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@halifax-online.co[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@intranet.rocketsoftware[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@lloydstsb.co[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@lloydstsb[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@m3[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@mi.lloydstsb[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@mpx03.rocketsoftware[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@mysky.sky[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@mysky.sky[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@new.egg[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@online.lloydstsb.co[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@peach.bskyb[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@quantserve[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@questionmarket[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@radiotimes[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@revsci[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@salesforce[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@secure.ingdirect.co[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@server.lon.liveperson[3].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@sky[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@statse.webtrendslive[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@statse.webtrendslive[3].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@uk.ebayrtm[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@usenetserver[1].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@www.300cforums[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@www.chrysler.co[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@www.newzbin[2].txt
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\eoreilly@www.radiotimes[1].txt
C:\WINDOWS\admintxt.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\eftl.exe
C:\WINDOWS\pntqkflv.dll
C:\WINDOWS\system32\abebpkit.ini
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\CIlSYJlm.ini
C:\WINDOWS\system32\CIlSYJlm.ini2
C:\WINDOWS\system32\clbinit.dll
C:\WINDOWS\system32\disbbeyv.ini
C:\WINDOWS\system32\jeixvshu.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJYSlIC.dll
C:\WINDOWS\system32\tbpnthvm.ini
C:\WINDOWS\system32\vjacffkf.ini
C:\WINDOWS\system32\vlinjmru.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Service_clbdriver


((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 )))))))))))))))))))))))))))))))
.

2008-07-07 19:58 . 2008-07-07 19:58 294 ---hs---- C:\WINDOWS\system32\vjacffkf.ini
2008-07-07 08:24 . 2008-07-07 08:24 89,088 --a------ C:\WINDOWS\system32\fkffcajv.dll
2008-07-04 10:22 . 2008-07-04 10:22 <DIR> d-------- C:\gggggg
2008-07-04 09:51 . 2008-07-04 09:51 <DIR> d-------- C:\Deckard
2008-07-02 17:24 . 2008-07-02 17:24 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\salesforce.com
2008-07-02 17:05 . 2007-04-16 14:42 1,089,536 --a------ C:\WINDOWS\system32\CcSkinny.dll
2008-07-02 17:05 . 1999-02-17 01:14 623,104 --a------ C:\WINDOWS\system32\nsldapssl32v30.dll
2008-07-02 17:05 . 2000-08-28 23:00 516,173 --a------ C:\WINDOWS\system32\MSVCP60D.DLL
2008-07-02 17:05 . 2000-07-14 23:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-07-02 17:05 . 2007-05-18 20:10 233,472 --a------ C:\WINDOWS\system32\ccCmeTsp.tsp
2008-07-02 17:05 . 1998-06-16 23:00 94,285 --a------ C:\WINDOWS\system32\MSVCIRTD.DLL
2008-07-02 16:40 . 2008-07-02 16:40 <DIR> d-------- C:\Program Files\Cisco Systems, Inc
2008-07-02 00:14 . 2008-07-02 06:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-07-02 00:10 . 2008-07-02 00:10 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-07-02 00:10 . 2008-07-02 08:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-07-01 19:10 . 2008-07-01 19:10 5,998 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-01 19:08 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-07-01 19:08 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-07-01 19:08 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-07-01 19:08 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-07-01 19:08 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-07-01 19:08 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-07-01 18:25 . 2008-07-01 18:25 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-01 16:32 . 2006-07-11 07:35 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\SampleView
2008-07-01 16:32 . 2006-07-11 07:35 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\ATI
2008-07-01 16:32 . 2008-07-01 16:32 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY
2008-07-01 16:24 . 2008-07-01 16:24 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\TmpRecentIcons
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\AVS4YOU
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\Avi2Dvd
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2008-07-01 13:53 . 2008-07-01 16:10 <DIR> d---s---- C:\Documents and Settings\corvu
2008-07-01 11:16 . 2008-07-01 11:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-01 09:54 . 2008-07-01 09:54 <DIR> d-------- C:\Program Files\Lavasoft
2008-07-01 09:54 . 2008-07-01 18:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-30 22:33 . 2004-08-04 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-30 22:32 . 2008-06-30 17:44 200,704 --a------ C:\WINDOWS\qegbdmwf.dll
2008-06-30 22:32 . 2008-06-30 17:44 155,648 --a------ C:\WINDOWS\gxvpsafm.dll.sav
2008-06-30 22:32 . 2008-06-30 17:44 81,920 --a------ C:\WINDOWS\tovafrnm.exe
2008-06-30 19:56 . 2008-11-24 07:13 1,966,080 --a------ C:\WINDOWS\system32\cdintf251.dll
2008-06-30 19:55 . 2008-06-30 22:37 <DIR> d-------- C:\Program Files\Invoice2go 4.0
2008-06-29 14:13 . 2008-06-29 14:14 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-06-17 10:13 . 2008-02-18 17:21 402,728 --a------ C:\WINDOWS\system32\ImageDrive.cpl
2008-06-16 16:34 . 2008-06-17 11:34 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\dvdcss
2008-06-16 14:41 . 2008-06-16 14:41 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\Nero
2008-06-16 14:40 . 2008-06-16 14:40 1,024 --a------ C:\.rnd
2008-06-16 14:35 . 2008-06-16 14:39 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-06-16 14:35 . 2008-06-16 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-06-13 09:04 . 2008-06-13 09:04 244 --ah----- C:\sqmnoopt02.sqm
2008-06-13 09:04 . 2008-06-13 09:04 232 --ah----- C:\sqmdata02.sqm
2008-06-10 22:57 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 22:57 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-07 18:57 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-07 14:06 --------- d-----w C:\Program Files\Windows Grep
2008-07-07 10:34 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Newsbin
2008-07-02 16:06 --------- d-----w C:\Program Files\Cisco Systems
2008-07-02 16:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 11:56 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-06-24 18:42 --------- d-----w C:\Program Files\EPSON Print CD
2008-06-17 09:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-06-16 13:35 --------- d-----w C:\Program Files\Nero
2008-06-16 12:48 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\AdobeUM
2008-06-16 12:41 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-04 17:26 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Ahead
2008-06-04 09:04 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\OfficeUpdate12
2008-06-01 12:33 --------- d-----w C:\Program Files\Ahead
2008-05-28 12:48 --------- d-----w C:\Program Files\AC3Filter
2008-05-28 11:48 --------- d-----w C:\Program Files\Xvid
2008-05-28 09:29 --------- d-----w C:\Program Files\DivX
2008-05-28 09:25 --------- d-----w C:\Program Files\InterActual
2008-05-27 12:23 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-27 08:06 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Roxio
2008-05-27 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Roxio
2008-05-21 07:02 --------- d-----w C:\Program Files\Alcohol Soft
2008-05-20 21:12 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 19:42 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\U3
2008-05-15 15:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\FreeRIP
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-16 18:56 524,288 ----a-w C:\WINDOWS\opuc.dll
2007-07-27 09:40 28,672 ----a-w C:\Documents and Settings\eoreilly\atwbxdet.dll
2008-02-11 12:31 56 --sha-w C:\WINDOWS\SMINST\hpboot.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"GoToMeeting"="C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe" [2007-11-05 13:00 31816]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 05:40 218032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 19:12 90112]
"PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-02-14 19:56 122880]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 17:01 761946]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 22:13 454656]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 19:12 17920]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 17:30 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-21 00:51 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-03-10 01:38 806912]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 16:43 892928]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 05:40 218032]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 05:40 86960]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
"CertReg"="C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe" [2002-07-31 15:29 204800]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 16:33 52840]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-10-07 20:48 125368]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-04-28 17:14 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 17:29 2221352]
"71148bfa"="C:\WINDOWS\system32\fkffcajv.dll" [2008-07-07 08:24 89088]
"MsmqIntCert"="mqrt.dll" [2007-07-06 13:46 177152 C:\WINDOWS\system32\mqrt.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-02-28 20:57:12 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=addAdmin.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mqsvc.exe"=
"C:\\WINDOWS\\SMINST\\Scheduler.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"C:\\WINDOWS\\system32\\mstsc.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\sopvod.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e556234-3cb7-11dd-b5b7-0017a4cfae5f}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592844-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592845-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592846-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f44e79f7-82e0-11dc-b56a-0017a4cfae5f}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2008-07-07 18:59:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
- - - - ORPHANS REMOVED - - - -

BHO-{84C53226-C282-41FE-A4B4-8F05CC5EC24B} - C:\WINDOWS\system32\yayyWooM.dll
Toolbar-SITEguard - (no file)
HKLM-Run-Media Codec Update Service - C:\Program Files\Essentials Codec Pack\update.exe
HKLM-Run-NeroCheck - C:\WINDOWS\system32\NeroCheck.exe
ShellExecuteHooks-{84C53226-C282-41FE-A4B4-8F05CC5EC24B} - C:\WINDOWS\system32\yayyWooM.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-07 19:58:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????S??????R?@?????,?@

scanning hidden files ...


C:\WINDOWS\system32\vjacffkf.ini 294 bytes

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.exe
-> C:\WINDOWS\system32\fkffcajv.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\scardsvr.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ABAserver\servers\cvbroker.exe
C:\CorVuPreSales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\scsiaccess.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-07-07 20:09:49 - machine was rebooted [eoreilly]
ComboFix-quarantined-files.txt 2008-07-07 19:09:04

Pre-Run: 9,229,004,800 bytes free
Post-Run: 9,117,765,632 bytes free

306 --- E O F --- 2008-06-20 09:25:55
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 01:13 PM   #8 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:13:06, on 07/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ABAserver\servers\cvbroker.exe
C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\eoreilly\Desktop\Virus Software\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CertReg] C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [71148bfa] rundll32.exe "C:\WINDOWS\system32\fkffcajv.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\Software\..\Telephony: DomainName = rocketsoftware.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CorVu Broker (cvbroker) - Unknown owner - C:\ABAserver\servers\cvbroker.exe
O23 - Service: CorVu HTM Service (cvhtmsvc) - Unknown owner - C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\CorVuPreSales\Tomcat\bin\tomcat5.exe

--
End of file - 12929 bytes
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 01:55 PM   #9 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  2. Insert what is usually your G drive (USB stick, external hdd?)
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Quote:
    http://www.techsupportforum.com/security-center/hijackthis-log-help/265837-help-needed-popup-windows.html#post1577500

    File::
    C:\WINDOWS\system32\vjacffkf.ini

    FileLook::
    G:\EuroSummit2008.exe

    DirLook::
    C:\gggggg

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "71148bfa"=-

    Collect::
    C:\WINDOWS\system32\fkffcajv.dll
    C:\WINDOWS\qegbdmwf.dll
    C:\WINDOWS\gxvpsafm.dll.sav
    C:\WINDOWS\tovafrnm.exe

    Suspect::
    G:\EuroSummit2008.exe
    Save this as CFScript.txt




    Referring to the picture above, drag CFScript.txt into ComboFix.exe


  4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  5. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

    Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.
  6. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.

    ---------------------------------------------------------------------------------------------
  7. Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 04:24 PM   #10 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
The file has uploaded successfully.

The file G:\EuroSummit2008.exe was on a on a stick I received from a trade show and has now been deleted. I attached the stick to my PC, but I guess it will have found nothing.

Log as requested.

Thanks for the help
Eddie

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:23:28, on 07/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ABAserver\servers\cvbroker.exe
C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\eoreilly\Desktop\Virus Software\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CertReg] C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\Software\..\Telephony: DomainName = rocketsoftware.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CorVu Broker (cvbroker) - Unknown owner - C:\ABAserver\servers\cvbroker.exe
O23 - Service: CorVu HTM Service (cvhtmsvc) - Unknown owner - C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\CorVuPreSales\Tomcat\bin\tomcat5.exe

--
End of file - 12942 bytes
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 04:25 PM   #11 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
and the Combofix log

ComboFix 08-07-05.1 - eoreilly 2008-07-07 22:58:04.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.442 [GMT 1:00]
Running from: C:\Documents and Settings\eoreilly\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\eoreilly\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\vjacffkf.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\gxvpsafm.dll.sav
C:\WINDOWS\qegbdmwf.dll
C:\WINDOWS\system32\fkffcajv.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\vjacffkf.ini
C:\WINDOWS\tovafrnm.exe
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 )))))))))))))))))))))))))))))))
.

2008-07-04 10:22 . 2008-07-04 10:22 <DIR> d-------- C:\gggggg
2008-07-04 09:51 . 2008-07-04 09:51 <DIR> d-------- C:\Deckard
2008-07-02 17:24 . 2008-07-02 17:24 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\salesforce.com
2008-07-02 17:05 . 2007-04-16 14:42 1,089,536 --a------ C:\WINDOWS\system32\CcSkinny.dll
2008-07-02 17:05 . 1999-02-17 01:14 623,104 --a------ C:\WINDOWS\system32\nsldapssl32v30.dll
2008-07-02 17:05 . 2000-08-28 23:00 516,173 --a------ C:\WINDOWS\system32\MSVCP60D.DLL
2008-07-02 17:05 . 2000-07-14 23:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-07-02 17:05 . 2007-05-18 20:10 233,472 --a------ C:\WINDOWS\system32\ccCmeTsp.tsp
2008-07-02 17:05 . 1998-06-16 23:00 94,285 --a------ C:\WINDOWS\system32\MSVCIRTD.DLL
2008-07-02 16:40 . 2008-07-02 16:40 <DIR> d-------- C:\Program Files\Cisco Systems, Inc
2008-07-02 00:14 . 2008-07-02 06:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-07-02 00:10 . 2008-07-02 00:10 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-07-02 00:10 . 2008-07-02 08:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-07-01 19:10 . 2008-07-01 19:10 5,998 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-01 19:08 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-07-01 19:08 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-07-01 19:08 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-07-01 19:08 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-07-01 19:08 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-07-01 19:08 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-07-01 18:25 . 2008-07-01 18:25 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-01 16:32 . 2006-07-11 07:35 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\SampleView
2008-07-01 16:32 . 2006-07-11 07:35 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY\Application Data\ATI
2008-07-01 16:32 . 2008-07-01 16:32 <DIR> d-------- C:\Documents and Settings\corvu.EDDIEOREILLY
2008-07-01 16:24 . 2008-07-01 16:24 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\TmpRecentIcons
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\AVS4YOU
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Program Files\Avi2Dvd
2008-07-01 16:10 . 2008-07-01 16:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2008-07-01 13:53 . 2008-07-01 16:10 <DIR> d---s---- C:\Documents and Settings\corvu
2008-07-01 11:16 . 2008-07-01 11:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-01 09:54 . 2008-07-01 09:54 <DIR> d-------- C:\Program Files\Lavasoft
2008-07-01 09:54 . 2008-07-01 18:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-30 22:33 . 2004-08-04 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-30 19:56 . 2008-11-24 07:13 1,966,080 --a------ C:\WINDOWS\system32\cdintf251.dll
2008-06-30 19:55 . 2008-06-30 22:37 <DIR> d-------- C:\Program Files\Invoice2go 4.0
2008-06-29 14:13 . 2008-06-29 14:14 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-06-17 10:13 . 2008-02-18 17:21 402,728 --a------ C:\WINDOWS\system32\ImageDrive.cpl
2008-06-16 16:34 . 2008-06-17 11:34 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\dvdcss
2008-06-16 14:41 . 2008-06-16 14:41 <DIR> d-------- C:\Documents and Settings\eoreilly\Application Data\Nero
2008-06-16 14:40 . 2008-06-16 14:40 1,024 --a------ C:\.rnd
2008-06-16 14:35 . 2008-06-16 14:39 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-06-16 14:35 . 2008-06-16 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-06-13 09:04 . 2008-06-13 09:04 244 --ah----- C:\sqmnoopt02.sqm
2008-06-13 09:04 . 2008-06-13 09:04 232 --ah----- C:\sqmdata02.sqm
2008-06-10 22:57 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 22:57 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-07 22:07 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-07 21:53 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Newsbin
2008-07-07 21:11 --------- d-----w C:\Program Files\EPSON Print CD
2008-07-07 14:06 --------- d-----w C:\Program Files\Windows Grep
2008-07-02 16:06 --------- d-----w C:\Program Files\Cisco Systems
2008-07-02 16:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 11:56 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-06-17 09:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-06-16 13:35 --------- d-----w C:\Program Files\Nero
2008-06-16 12:48 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\AdobeUM
2008-06-16 12:41 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-04 17:26 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Ahead
2008-06-04 09:04 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\OfficeUpdate12
2008-06-01 12:33 --------- d-----w C:\Program Files\Ahead
2008-05-28 12:48 --------- d-----w C:\Program Files\AC3Filter
2008-05-28 11:48 --------- d-----w C:\Program Files\Xvid
2008-05-28 09:29 --------- d-----w C:\Program Files\DivX
2008-05-28 09:25 --------- d-----w C:\Program Files\InterActual
2008-05-27 12:23 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-27 08:06 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\Roxio
2008-05-27 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Roxio
2008-05-21 07:02 --------- d-----w C:\Program Files\Alcohol Soft
2008-05-20 21:12 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 19:42 --------- d-----w C:\Documents and Settings\eoreilly\Application Data\U3
2008-05-15 15:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\FreeRIP
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-16 18:56 524,288 ----a-w C:\WINDOWS\opuc.dll
2007-07-27 09:40 28,672 ----a-w C:\Documents and Settings\eoreilly\atwbxdet.dll
2008-02-11 12:31 56 --sha-w C:\WINDOWS\SMINST\hpboot.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\EuroSummit2008.exe -- Invalid filepath or file no longer exist

---- Directory of C:\gggggg ----

2000-08-31 08:00 28672 -ra------ C:\gggggg\nircmd.com


((((((((((((((((((((((((((((( snapshot@2008-07-07_20.08.15.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-07 18:56:03 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-07 22:05:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-07-07 18:57:19 234,499 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-07-07 22:07:15 234,500 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"GoToMeeting"="C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe" [2007-11-05 13:00 31816]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 05:40 218032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 19:12 90112]
"PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-02-14 19:56 122880]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 17:01 761946]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 22:13 454656]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 19:12 17920]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 17:30 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-21 00:51 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-03-10 01:38 806912]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 16:43 892928]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 05:40 218032]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 05:40 86960]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
"CertReg"="C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe" [2002-07-31 15:29 204800]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 16:33 52840]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-10-07 20:48 125368]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-04-28 17:14 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 17:29 2221352]
"MsmqIntCert"="mqrt.dll" [2007-07-06 13:46 177152 C:\WINDOWS\system32\mqrt.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-02-28 20:57:12 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=addAdmin.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mqsvc.exe"=
"C:\\WINDOWS\\SMINST\\Scheduler.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"C:\\WINDOWS\\system32\\mstsc.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\sopvod.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 PersonalSecureDrive;PersonalSecureDrive;C:\WINDOWS\system32\drivers\psd.sys [2005-11-29 17:56]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 09:00]
R2 cvbroker;CorVu Broker;C:\ABAserver\servers\cvbroker.exe [2006-08-16 19:01]
R2 cvhtmsvc;CorVu HTM Service;C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe [2007-11-30 09:47]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-21 12:19]
S3 GTwinUSB;GTwinUSB;C:\WINDOWS\system32\Drivers\GTwinUSB.sys [2004-06-28 12:06]
S3 MsDtsServer;SQL Server Integration Services;C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2007-03-23 21:13]
S3 ReportServer;SQL Server Reporting Services (MSSQLSERVER);C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2007-03-23 21:13]
S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys [2007-01-18 11:24]
S3 Tomcat5;Apache Tomcat;C:\CorVuPreSales\Tomcat\bin\tomcat5.exe [2006-09-12 16:11]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 06:17]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e556234-3cb7-11dd-b5b7-0017a4cfae5f}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592844-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592845-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4592846-3dd0-11dd-b5b8-001a6b139563}]
\Shell\AutoRun\command - G:\EuroSummit2008.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f44e79f7-82e0-11dc-b56a-0017a4cfae5f}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2008-07-07 21:59:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-07 23:08:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????S??????R?@?????,?@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\scardsvr.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\scsiaccess.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Completion time: 2008-07-07 23:18:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-07 22:18:12
ComboFix2.txt 2008-07-07 19:09:52

Pre-Run: 6,294,142,976 bytes free
Post-Run: 6,297,722,880 bytes free

252 --- E O F --- 2008-06-20 09:25:55
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-07-2008, 05:08 PM   #12 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
Thanks for uploading the file. Please delete [4]-Submit_2008-07-07@22.57.zip from your desktop.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 6 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. You may disconnect from the internet once you begin the scan.


Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

How is the machine behaving now?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 05:49 AM   #13 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Sorry for the delay in responding. I followed your advice and updated Java, only to find that the permutation of latest Java, Tomcat and my application were not working together. It took a couple of days to work out.....But that should help the customers that will come across this issue when they upgrade!!

My PC is working as it was before the original infection. Thank you for that.

I have run Kaspersky and the log is below.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, July 10, 2008 12:41:56 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 10/07/2008
Kaspersky Anti-Virus database records: 932721
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 181813
Number of viruses found: 14
Number of infected objects: 34
Number of suspicious objects: 0
Duration of the scan process: 03:50:40

Infected Object Name / Virus Name / Last Action
C:\CorVuPreSales\Tomcat\logs\admin.2008-07-09.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\catalina.2008-07-09.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\host-manager.2008-07-09.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\jakarta_service_20080709.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\localhost.2008-07-09.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\manager.2008-07-09.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\stderr_20080709.log Object is locked skipped
C:\CorVuPreSales\Tomcat\logs\stdout_20080709.log Object is locked skipped
C:\Deckard\System Scanner\20080704104527\backup\DOCUME~1\eoreilly\LOCALS~1\Temp\NERO14961\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Deckard\System Scanner\20080704104527\backup\WINDOWS\temp\hsperfdata_SYSTEM\2256 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\369ce144ebbd4ffc1aaca20523a441b1_ff957b72-839f-41ca-b45a-7cdff160ba11 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4b3d1cbc68436d66ac0f72a3f01c39de_ff957b72-839f-41ca-b45a-7cdff160ba11 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6572d2a1358194c73070e94316a43c4a_ff957b72-839f-41ca-b45a-7cdff160ba11 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c049d387ec7c6f3ddc35e33961cd3feb_ff957b72-839f-41ca-b45a-7cdff160ba11 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0ACC0000\4AEE37D2.VBN Infected: Trojan.Win32.Monder.alm skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300000\4F75BDEA.VBN Infected: Trojan.Win32.Monderb.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300001\4F75BE10.VBN Infected: Rootkit.Win32.Clbd.dc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300002\4F75BE27.VBN Infected: Trojan.Win32.Monderb.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300003\4F75BE39.VBN Infected: Rootkit.Win32.Clbd.dc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300004\4F75BE4F.VBN Infected: Trojan.Win32.Monderb.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300005\4F75BE62.VBN Infected: Rootkit.Win32.Clbd.dc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F300007\4F75BE8C.VBN Infected: Rootkit.Win32.Clbd.dc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F8C0003\4FFDDE5E.VBN Infected: Trojan.Win32.Monder.alh skipped
C:\Documents and Settings\corvu.EDDIEOREILLY\Desktop\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\corvu.EDDIEOREILLY\Desktop\SmitfraudFix.exe RAR: infected - 1 skipped
C:\Documents and Settings\eoreilly\Application Data\Microsoft\Outlook\outitems.log Object is locked skipped
C:\Documents and Settings\eoreilly\Application Data\Microsoft\Outlook\Rocket.NK2 Object is locked skipped
C:\Documents and Settings\eoreilly\Application Data\Microsoft\Outlook\Rocket.srs Object is locked skipped
C:\Documents and Settings\eoreilly\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
C:\Documents and Settings\eoreilly\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Desktop\Virus Software\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\eoreilly\Desktop\Virus Software\SmitfraudFix.exe RAR: infected - 1 skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\Working\database_1E25_7E52_7114_8B55\dfsr.db Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\Working\database_1E25_7E52_7114_8B55\fsr.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\Working\database_1E25_7E52_7114_8B55\fsrtmp.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Messenger\eddie.oreilly@corvu.co.uk\SharingMetadata\Working\database_1E25_7E52_7114_8B55\tmp.edb Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Outlook\2007.pst Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Outlook\eddie2.pst Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Outlook\outlook.ost Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Microsoft\Windows Live Contacts\eddie.oreilly@corvu.co.uk\real\members.stg Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Outlook\2006.pst Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Outlook\Outlook0.ost/Offline store/Root - Mailbox/IPM_SUBTREE/Egg,Shutterfly&Ping/25 Feb 2006 04:14 from PayPal Account Review Department:Notifica/RR-0922-014.exe Infected: Trojan-Downloader.Win32.Small.ckw skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Outlook\Outlook0.ost MailMSMaill: infected - 1 skipped
C:\Documents and Settings\eoreilly\Local Settings\Application Data\Outlook\Ranjana.pst Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\History\History.IE5\MSHist012008071020080711\index.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\G2MIMessenger_g2mlauncher.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\G2MIMessenger_msnmsgr.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\G2MOutlookAddin.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\G2MOutlookAddin_util.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\log8.tmp\G2MStart.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\citrixlogs\gotomeeting\198\log8.tmp\GoToMeeting.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\ExchangePerflog_8484fa31d39df4da8b50786c.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\G2MCodec.log Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\JET62B.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\Perflib_Perfdata_1080.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\Perflib_Perfdata_10e4.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\Perflib_Perfdata_1574.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\UDMC4C4.ldb Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\UDMC4C4.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF213C.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF2158.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF2DCF.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF2E31.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF3914.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF39F4.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF7B66.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DF95B0.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temp\~DFD08.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\Content.Word\~WRF0548.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\Local Settings\Temporary Internet Files\Content.Word\~WRS1477.tmp Object is locked skipped
C:\Documents and Settings\eoreilly\My Documents\Blackberry\Backup-(2007-06-12).ipd Object is locked skipped
C:\Documents and Settings\eoreilly\My Documents\Blackberry\Backup-(2007-06-26)-1.ipd Object is locked skipped
C:\Documents and Settings\eoreilly\My Documents\Blackberry\Backup-(2007-06-26).ipd Object is locked skipped
C:\Documents and Settings\eoreilly\My Documents\Blackberry\Backup-(2007-06-27).ipd Object is locked skipped
C:\Documents and Settings\eoreilly\My Documents\Blackberry\Backup-(2007-07-19).ipd Object is locked skipped
C:\Documents and Settings\eoreilly\ntuser.dat Object is locked skipped
C:\Documents and Settings\eoreilly\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Eddie\Software\Invoice2go\ver1.454.0.exe Infected: Trojan-Downloader.Win32.Zlob.qdx skipped
C:\Eddie\Software\Nero 8 Ultra Edition 8.3.2.1b\Nero-8.3.2.1b_eng_update.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Eddie\Software\Nero 8 Ultra Edition 8.3.2.1b\Nero-8.3.2.1b_eng_update.exe 7-Zip: infected - 1 skipped
C:\Eddie\Software\Video Editor\SetupSmack_1_0_39.exe/file02 Infected: not-a-virus:RiskTool.Win32.HideRun.d skipped
C:\Eddie\Software\Video Editor\SetupSmack_1_0_39.exe Inno: infected - 1 skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\EPSON\EPSON PhotoQuicker3.5\Config\User\eoreilly.pq3 Object is locked skipped
C:\Program Files\Nero\Nero8\Nero BackItUp\BIU4.txt Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0639NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0643NAV~.TMP Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\pntqkflv.dll.vir Infected: Trojan.Win32.Vapsup.hkm skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mlJYSlIC.dll.vir Infected: Trojan.Win32.Monderb.gen skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP481\A0062863.dll Infected: Trojan.Win32.Vapsup.hlq skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP482\A0062950.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP482\A0063004.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP482\A0063004.exe RAR: infected - 1 skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP482\A0063014.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP483\A0063099.dll Infected: Trojan.Win32.Vapsup.hmh skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP484\A0063134.dll Infected: Trojan.Win32.Vapsup.hlq skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP486\A0063563.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP488\A0063680.exe Infected: not-a-virus:Monitor.Win32.Ardamax.k skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP494\A0064808.dll Infected: Trojan.Win32.Vapsup.hkm skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP494\A0064810.dll Infected: Trojan.Win32.Monderb.gen skipped
C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP506\change.log Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Credenti.evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\msmq\storage\QMLog Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\hsperfdata_SYSTEM\1988 Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\Desktop.ini Object is locked skipped
E:\System Volume Information\Folder.htt Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\Protect.ed Object is locked skipped
E:\System Volume Information\Warning.bmp Object is locked skipped
E:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP506\change.log Object is locked skipped

Scan process completed.
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 08:34 AM   #14 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
And the new HijackThis log, please?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 12:23 PM   #15 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Sorry.......

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:23:12, on 10/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ABAserver\servers\cvbroker.exe
C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\CorVuPreSales\Tomcat\bin\tomcat5.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\CorVuPreSales\Tomcat\bin\tomcat5w.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\eoreilly\Desktop\Virus Software\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CertReg] C:\Program Files\Common Files\Gemplus\CertReg\certreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ApacheTomcatMonitor] "C:\CorVuPreSales\Tomcat\bin\tomcat5w.exe" //MS//Tomcat5
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\Software\..\Telephony: DomainName = rocketsoftware.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = rocketsoftware.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CorVu Broker (cvbroker) - Unknown owner - C:\ABAserver\servers\cvbroker.exe
O23 - Service: CorVu HTM Service (cvhtmsvc) - Unknown owner - C:\CorVuPresales\Tomcat\webapps\HyperVu\WEB-INF\cgi\servers\cvhtmsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\CorVuPreSales\Tomcat\bin\tomcat5.exe

--
End of file - 13595 bytes
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 12:32 PM   #16 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
Thanks...looks fine. So, you had to roll back to the older Java to work with Tomcat? I'm sure Sun would like to know about the issues you had with it's new release.

Kaspersky has identified this old email as infected:

C:\Documents and Settings\eoreilly\Local Settings\Application Data\Outlook\Outlook0.ost
/Offline store/Root - Mailbox/IPM_SUBTREE/Egg,Shutterfly&Ping/25 Feb 2006 04:14 from PayPal Account Review Department



Nero gets flagged due to an opt-out toolbar included in the installer.


Symantec empties it's quarantine on a schedule, or you can access the quarantine from within the application interface to empty it now.

Other than that...the items found are in ComboFix quarantine or System Restore, which will be addressed when uninstalling ComboFix

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 01:07 PM   #17 (permalink)
Registered User
 
Join Date: Jul 2008
Posts: 11
OS: XP


Re: Help needed with popup windows
Thank you for your time and patience.

Regards
Eddie
corfew is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-10-2008, 02:06 PM   #18 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home


Re: Help needed with popup windows
Hi Eddie -

You're welcome for the help.

Surf Safely, and Think Prevention!

Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 05:34 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85