|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-31-2008, 04:46 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit
|
Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
I'm having problems with this pop-up. Every time I start my computer this error pops up: "Error loading C:\Windows\System32\byXPIbxY.dll The specified module could not be found." I have run many spyware removal programs and virus scans and have found nothing. After running the Panda Activescan it showed that i have some virus's but they cannot be removed by that tool and my other virus scanner(Avast!) won't find it. Any help you could provide would be great, thanks. Deckard's System Scanner v20071014.68 Run by Dan on 2008-07-31 07:18:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 16: 2008-07-31 01:31:41 UTC - RP226 - Windows Update 15: 2008-07-31 01:25:29 UTC - RP225 - Installed Driver Detective 14: 2008-07-29 22:59:20 UTC - RP223 - Scheduled Checkpoint 13: 2008-07-29 02:41:10 UTC - RP222 - Scheduled Checkpoint 12: 2008-07-28 07:00:00 UTC - RP221 - Scheduled Checkpoint -- First Restore Point -- 1: 2008-07-18 18:45:48 UTC - RP210 - Scheduled Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-07-31 07:20:23 Platform: Windows Vista Service Pack 1 (6.00.6001) MSIE: Internet Explorer (7.00.6000.16386) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\System32\csrss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\csrss.exe C:\Windows\System32\services.exe C:\Windows\System32\lsass.exe C:\Windows\System32\lsm.exe C:\Windows\System32\winlogon.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\SLsvc.exe C:\Windows\System32\svchost.exe C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\System32\dlbccoms.exe C:\Windows\System32\PnkBstrA.exe C:\Windows\System32\svchost.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\taskeng.exe C:\Windows\System32\SearchIndexer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Windows\System32\taskeng.exe C:\Windows\System32\dwm.exe C:\Windows\explorer.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Users\Dan\Desktop\dss.exe C:\Windows\System32\VSSVC.exe C:\Windows\System32\svchost.exe C:\Windows\System32\SearchProtocolHost.exe C:\Windows\System32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE} - (no file) O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXPIbxY.dll,#1 O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkbMonitor.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL O21 - SSODL: fdxbameg - {711D8683-355D-407E-831F-916DE75307FB} - (no file) O21 - SSODL: fsrpknov - {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\System32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbc_device - Unknown owner - C:\Windows\System32\dlbccoms.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\System32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\stacsv.exe -- End of file - 10125 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" <Not Verified; Microsoft Corporation; Windows Live installer> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318} Description: IDT HDMI Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&2E1A2CDF&0&0001 Manufacturer: IDT Name: IDT HDMI PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&2E1A2CDF&0&0001 Service: STHDA -- Scheduled Tasks ------------------------------------------------------------- 2008-07-31 06:54:34 368 --a------ C:\Windows\Tasks\RegCure.job 2008-07-30 18:38:15 434 --a------ C:\Windows\Tasks\RegCure Program Check.job 2008-07-30 07:32:32 414 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{4755E1F3-CE53-494D-867D-0CB2680B2C16}.job -- Files created between 2008-06-30 and 2008-07-31 ----------------------------- 2008-07-30 21:26:39 0 d-------- C:\Program Files\Panda Security 2008-07-30 18:26:00 0 d-------- C:\Users\All Users\PC Drivers HeadQuarters 2008-07-21 16:44:17 0 d-------- C:\TempDVD 2008-07-21 16:44:17 0 d-------- C:\dvdsanta 2008-07-21 16:44:12 0 d-------- C:\Program Files\dvdSanta 2008-07-19 11:43:52 0 d-------- C:\Program Files\iPod 2008-07-19 11:43:51 0 d-------- C:\Program Files\iTunes 2008-07-19 11:42:18 0 d-------- C:\Program Files\QuickTime 2008-07-16 20:07:40 0 d-------- C:\Users\All Users\Ubisoft 2008-07-16 07:04:59 0 d-------- C:\Windows\RegCure 2008-07-16 06:48:31 0 d-------- C:\Program Files\RegCure 2008-07-14 20:31:46 0 d-------- C:\Program Files\Ubisoft 2008-07-13 18:37:27 116864 --a------ C:\Windows\system32\xsbyys.dll 2008-07-13 18:37:26 116864 --a------ C:\Windows\system32\gvixdfsf.dll 2008-07-13 12:44:28 0 d-------- C:\Users\All Users\ATI 2008-07-10 21:24:04 116352 --a------ C:\Windows\system32\sjupkd.dll 2008-07-10 21:24:03 116352 --a------ C:\Windows\system32\svnrnwvt.dll 2008-07-10 21:23:22 168608 --ahs---- C:\Windows\system32\llTtDcdd.ini2 2008-07-10 16:51:39 116352 --a------ C:\Windows\system32\ldayvk.dll 2008-07-10 16:51:38 116352 --a------ C:\Windows\system32\eyykqlhl.dll 2008-07-10 16:50:58 164085 --ahs---- C:\Windows\system32\NnTtwyay.ini2 2008-07-10 06:51:48 347 --ahs---- C:\Windows\system32\mlRqqtwa.ini2 2008-07-09 22:12:00 1220 --ahs---- C:\Windows\system32\iPrCKRqr.ini2 2008-07-09 20:59:12 1461 --ahs---- C:\Windows\system32\bJPWxGgh.ini2 2008-07-09 18:22:10 1459 --ahs---- C:\Windows\system32\vEddJkkj.ini2 2008-07-09 08:44:23 163840 --a------ C:\Windows\enxw.exe 2008-07-09 08:39:46 0 -rahs---- C:\MSDOS.SYS 2008-07-09 08:39:46 0 -rahs---- C:\IO.SYS 2008-07-08 23:15:09 348160 --a------ C:\Windows\fsrpknov.dll 2008-07-08 23:14:46 0 d-------- C:\Program Files\PCHealthCenter 2008-07-06 22:05:32 0 d-------- C:\Program Files\DAEMON Tools Toolbar 2008-07-06 22:02:52 717296 --a------ C:\Windows\system32\drivers\sptd.sys 2008-07-03 18:19:38 0 d-------- C:\Program Files\E.M. DVD Copy 2008-07-01 18:05:16 0 d-------- C:\Users\All Users\WindowsSearch 2008-07-01 11:07:12 0 d-------- C:\Users\All Users\FLEXnet 2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-30 21:54:06 0 d-------- C:\Program Files\DNA 2008-06-30 21:54:06 0 d-------- C:\Program Files\BitTorrent -- Find3M Report --------------------------------------------------------------- 2008-07-31 00:54:15 0 d-------- C:\Program Files\Spyware Doctor 2008-07-30 18:36:07 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-29 22:01:09 0 d-------- C:\Program Files\Warcraft III 2008-07-26 11:01:08 0 d-------- C:\Program Files\World of Warcraft 2008-07-21 20:08:56 0 d-------- C:\Users\Dan\AppData\Roaming\BitTorrent 2008-07-16 22:13:42 0 d-------- C:\Users\Dan\AppData\Roaming\DNA 2008-07-16 18:08:30 0 d-------- C:\Program Files\ATI 2008-07-14 20:49:20 0 d-------- C:\Users\Dan\AppData\Roaming\Ubisoft 2008-07-13 12:41:08 0 d-------- C:\Program Files\ATI Technologies 2008-07-09 19:56:05 0 d-------- C:\Users\Dan\AppData\Roaming\DAEMON Tools 2008-07-08 17:28:10 0 d-------- C:\Program Files\Windows Mail 2008-07-03 18:17:04 0 d-------- C:\Users\Dan\AppData\Roaming\Download Manager 2008-07-01 17:19:29 0 d-------- C:\Users\Dan\AppData\Roaming\Ahead 2008-07-01 15:41:07 0 d-------- C:\Program Files\BitLord2 2008-07-01 11:54:47 0 d-------- C:\Users\Dan\AppData\Roaming\Adobe 2008-07-01 11:04:17 0 d-------- C:\Program Files\Common Files\Adobe 2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files 2008-06-27 07:10:38 0 d-------- C:\Users\Dan\AppData\Roaming\Nikon 2008-06-27 07:09:42 0 d-------- C:\Program Files\Common Files\Nikon 2008-06-24 22:23:35 0 d-------- C:\Users\Dan\AppData\Roaming\WinRAR 2008-06-18 23:17:14 0 d-------- C:\Users\Dan\AppData\Roaming\ArcSoft 2008-06-12 22:52:43 0 d-------- C:\Program Files\Nikon 2008-05-31 20:51:42 0 d-------- C:\Program Files\Bethesda Softworks 2008-05-03 19:42:39 669184 --a------ C:\Windows\system32\pbsvc.exe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [07/19/2008 07:38 AM] "RtHDVCpl"="RtHDVCpl.exe" [09/18/2007 11:50 PM C:\Windows\RtHDVCpl.exe] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM] "MSServer"="C:\Windows\system32\byXPIbxY.dll" [] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [06/02/2008 06:19 PM] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 12:38 AM] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/19/2008 12:33 AM] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [01/19/2008 12:33 AM] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 12:33 AM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [3/22/1999] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [4/1/2008 3:17:27 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "fsrpknov"= {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll [07/09/2008 05:09 AM 348160] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\Windows\system32\ddcDtTll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] C:\Windows\ehome\ehTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}] AutoRun\command- wd_windows_tools\setup.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-07-31 07:21:34 ------------ |
|
     |
| Sponsored Links |
|
08-05-2008, 12:06 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hello and welcome to TSF.
 I see that you are using BitTorrent, which is a p2p file sharing program. I would like to warn you that the nature of P2P filesharing is so that even if one is using a "clean" program, many of the files downloaded from non-documented sources have the potential of being infected. So, regardless of whether one is using a "clean" program, one may still be prone to infection by malware because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. Also by default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple, file sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. I recommend very strongly that you remove it from your system via Add/Remove Programs in Control Panel. =================================== Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:
Please disable Windows Defender too. To disable Windows Defender:
=================================== Please right click on HijackThis and click Run as administrator Click on "do a system scan only" Place a checkmark next to these lines: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com O2 - BHO: (no name) - {684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE} - (no file) O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXPIbxY.dll,#1 O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing) O21 - SSODL: fdxbameg - {711D8683-355D-407E-831F-916DE75307FB} - (no file) O21 - SSODL: fsrpknov - {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll Then close all windows except HijackThis and click Fix Checked ================================== Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
__________________
My services are free. However, you can donate to TSF to help keep it running.   Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-05-2008, 05:55 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi, thanks for helping me out. I posted the mbam log first followed by the HijackThis log. Hopefully all this worked.
 Malwarebytes' Anti-Malware 1.24 Database version: 1028 Windows 6.0.6001 Service Pack 1 5:46:14 PM 8/5/2008 mbam-log-8-5-2008 (17-46-14).txt Scan type: Quick Scan Objects scanned: 37948 Time elapsed: 2 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 18 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 14 Files Infected: 15 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{42e2b43f-3954-48ec-b549-5c05cb7dbd0a} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{07895222-50a5-4598-acb1-806ef2a9babc} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{c5ebee4a-e9ab-4efd-8672-f0166f8ac2c3} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{abbafc19-c497-4ec0-9a4d-e19c6c5cf8a3} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{30d9b3f9-a597-447e-9152-22c0988bc44b} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5b3cfc71-5900-4ef9-8b07-aca8b9acfefe} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5c15e2bc-595f-42e7-8a3d-f34b8b8e6723} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7c69df2c-b0ec-41f0-a61a-923676fc6cf7} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7f3611c2-2dba-4a15-acdf-0f9c33efc3d7} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bd9410e1-0650-4329-b35a-2d6654cf7be7} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ea87d749-5f8b-4bc6-909d-e22658172f3b} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sqvgnrpx.baql (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sqvgnrpx.bwbf (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sqvgnrpx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\videoPl.chl (Trojan.Zlob) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{684bfe7f-f5b2-4ab3-a95e-eb5036a2d286} (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\rhc50nj0ejaa (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Windows\System32\717305 (Trojan.BHO) -> Quarantined and deleted successfully. Files Infected: C:\Windows\enxw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Windows\System32\gvixdfsf.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\trzC3F7.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\System32\xsbyys.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\rhc50nj0ejaa\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Program Files\rhc50nj0ejaa\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Windows\fsrpknov.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. Deckard's System Scanner v20071014.68 Run by Dan on 2008-08-05 17:50:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Dan.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:50:32 PM, on 8/5/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Windows\system32\Dwm.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\dlbccoms.exe C:\Windows\system32\PnkBstrA.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Dan\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Dan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe -- End of file - 7793 bytes -- Files created between 2008-07-05 and 2008-08-05 ----------------------------- 2008-08-05 17:40:17 0 d-------- C:\Users\All Users\Malwarebytes 2008-08-05 17:40:17 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-05 17:31:54 0 d-------- C:\Program Files\Trend Micro 2008-08-05 16:49:37 0 d-------- C:\Program Files\Apple Software Update 2008-08-05 16:48:59 0 d-------- C:\Program Files\iPod 2008-08-05 16:48:58 0 d-------- C:\Program Files\iTunes 2008-07-31 23:54:49 0 d-------- C:\Users\All Users\ATI 2008-07-31 23:39:31 0 d-------- C:\Users\Dan\{3e3343be-02ec-498e-82b5-b9d266ae2b31} 2008-07-30 21:26:39 0 d-------- C:\Program Files\Panda Security 2008-07-30 18:26:00 0 d-------- C:\Users\All Users\PC Drivers HeadQuarters 2008-07-21 16:44:17 0 d-------- C:\TempDVD 2008-07-21 16:44:17 0 d-------- C:\dvdsanta 2008-07-21 16:44:12 0 d-------- C:\Program Files\dvdSanta 2008-07-19 11:42:18 0 d-------- C:\Program Files\QuickTime 2008-07-16 20:07:40 0 d-------- C:\Users\All Users\Ubisoft 2008-07-16 07:04:59 0 d-------- C:\Windows\RegCure 2008-07-16 06:48:31 0 d-------- C:\Program Files\RegCure 2008-07-14 20:31:46 0 d-------- C:\Program Files\Ubisoft 2008-07-10 21:24:04 116352 --a------ C:\Windows\system32\sjupkd.dll 2008-07-10 21:24:03 116352 --a------ C:\Windows\system32\svnrnwvt.dll 2008-07-10 21:23:22 168608 --ahs---- C:\Windows\system32\llTtDcdd.ini2 2008-07-10 16:51:39 116352 --a------ C:\Windows\system32\ldayvk.dll 2008-07-10 16:51:38 116352 --a------ C:\Windows\system32\eyykqlhl.dll 2008-07-10 16:50:58 164085 --ahs---- C:\Windows\system32\NnTtwyay.ini2 2008-07-10 06:51:48 347 --ahs---- C:\Windows\system32\mlRqqtwa.ini2 2008-07-09 22:12:00 1220 --ahs---- C:\Windows\system32\iPrCKRqr.ini2 2008-07-09 20:59:12 1461 --ahs---- C:\Windows\system32\bJPWxGgh.ini2 2008-07-09 18:22:10 1459 --ahs---- C:\Windows\system32\vEddJkkj.ini2 2008-07-09 08:39:46 0 -rahs---- C:\MSDOS.SYS 2008-07-09 08:39:46 0 -rahs---- C:\IO.SYS 2008-07-06 22:05:32 0 d-------- C:\Program Files\DAEMON Tools Toolbar 2008-07-06 22:02:52 717296 --a------ C:\Windows\system32\drivers\sptd.sys -- Find3M Report --------------------------------------------------------------- 2008-08-05 17:40:19 0 d-------- C:\Users\Dan\AppData\Roaming\Malwarebytes 2008-08-05 07:51:45 0 d-------- C:\Program Files\Spyware Doctor 2008-08-04 17:20:04 0 d-------- C:\Program Files\World of Warcraft 2008-08-01 09:44:18 0 d-------- C:\Program Files\ATI 2008-07-31 23:42:01 0 d-------- C:\Program Files\ATI Technologies 2008-07-30 18:36:07 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-29 22:01:09 0 d-------- C:\Program Files\Warcraft III 2008-07-16 22:13:42 0 d-------- C:\Users\Dan\AppData\Roaming\DNA 2008-07-14 20:49:20 0 d-------- C:\Users\Dan\AppData\Roaming\Ubisoft 2008-07-09 19:56:05 0 d-------- C:\Users\Dan\AppData\Roaming\DAEMON Tools 2008-07-08 17:28:10 0 d-------- C:\Program Files\Windows Mail 2008-07-07 06:44:31 0 d-------- C:\Program Files\E.M. DVD Copy 2008-07-03 18:17:04 0 d-------- C:\Users\Dan\AppData\Roaming\Download Manager 2008-07-01 17:19:29 0 d-------- C:\Users\Dan\AppData\Roaming\Ahead 2008-07-01 15:41:07 0 d-------- C:\Program Files\BitLord2 2008-07-01 11:54:47 0 d-------- C:\Users\Dan\AppData\Roaming\Adobe 2008-07-01 11:04:17 0 d-------- C:\Program Files\Common Files\Adobe 2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files 2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-30 21:54:06 0 d-------- C:\Program Files\DNA 2008-06-27 07:10:38 0 d-------- C:\Users\Dan\AppData\Roaming\Nikon 2008-06-27 07:09:42 0 d-------- C:\Program Files\Common Files\Nikon 2008-06-24 22:23:35 0 d-------- C:\Users\Dan\AppData\Roaming\WinRAR 2008-06-18 23:17:14 0 d-------- C:\Users\Dan\AppData\Roaming\ArcSoft 2008-06-12 22:52:43 0 d-------- C:\Program Files\Nikon -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [07/19/2008 07:38 AM] "RtHDVCpl"="RtHDVCpl.exe" [09/18/2007 11:50 PM C:\Windows\RtHDVCpl.exe] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 12:38 AM] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/30/2008 10:47 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/19/2008 12:33 AM] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [01/19/2008 12:33 AM] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 12:33 AM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [3/22/1999] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [4/1/2008 3:17:27 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\Windows\system32\ddcDtTll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] C:\Windows\ehome\ehTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}] AutoRun\command- wd_windows_tools\setup.exe *Newly Created Service* - PAVBOOT [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-08-05 17:50:53 ------------ |
|
|
|
|
08-06-2008, 12:36 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
Please download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix Link 1 Link 2 Link 3 **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Right click on ComboFix.exe and run as administrator & follow the prompts.
Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-07-2008, 12:44 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
That shouldn't be a problem. Did you right click combofix.exe and choose "run as Administrator"?
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-07-2008, 09:22 PM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Is the operating system 64 bit?
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-09-2008, 03:06 AM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,245
OS: N/A
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Kindly download a fresh copy of ComboFix > http://download.bleepingcomputer.com/sUBs/ComboFix.exe
__________________
|
|
|
|
|
08-13-2008, 08:43 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
My operating system is 32-bit. I'm adding a log file from the new combofix i downloaded. also, the issue with the pop-up is gone.
|
|
|
|
|
08-14-2008, 01:55 AM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
Thank you for the log. While I am reviewing it, I'll copy it here for convenience. Please remember to copy/paste the logs in the thread next time. ComboFix 08-08-13.02 - Dan 2008-08-13 19:25:43.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2382 [GMT -7:00] Running from: C:\Users\Dan\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\#SharedObjects\DGD663TC\interclick.com C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\#SharedObjects\DGD663TC\interclick.com\ud.sol C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\Windows\System32\bJPWxGgh.ini C:\Windows\System32\bJPWxGgh.ini2 C:\Windows\system32\brqcdgio.ini C:\Windows\system32\eyykqlhl.dll C:\Windows\system32\fxeqfuve.ini C:\Windows\System32\iPrCKRqr.ini C:\Windows\System32\iPrCKRqr.ini2 C:\Windows\system32\ldayvk.dll C:\Windows\System32\llTtDcdd.ini C:\Windows\System32\llTtDcdd.ini2 C:\Windows\System32\mlRqqtwa.ini C:\Windows\System32\mlRqqtwa.ini2 C:\Windows\System32\NnTtwyay.ini C:\Windows\System32\NnTtwyay.ini2 C:\Windows\system32\rilualtn.ini C:\Windows\system32\siqwlrlk.ini C:\Windows\system32\sjupkd.dll C:\Windows\system32\svnrnwvt.dll C:\Windows\System32\vEddJkkj.ini C:\Windows\System32\vEddJkkj.ini2 C:\Windows\system32\xwhqahre.ini ----- BITS: Possible infected sites ----- http://images.metaservices.microsoft.com:80 . ((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))) . 2008-08-07 18:48 . 2008-08-08 16:48 <DIR> d-------- C:\Users\Dan\AppData\Roaming\BitTorrent 2008-08-07 18:47 . 2008-08-07 18:47 <DIR> d-------- C:\Program Files\BitTorrent 2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Users\Dan\AppData\Roaming\Malwarebytes 2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-05 17:40 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-08-05 17:40 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys 2008-08-05 17:31 . 2008-08-05 17:31 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-05 16:49 . 2008-08-05 16:49 <DIR> d-------- C:\Program Files\Apple Software Update 2008-08-05 16:48 . 2008-08-05 16:49 <DIR> d-------- C:\Program Files\iTunes 2008-08-05 16:48 . 2008-08-05 16:48 <DIR> d-------- C:\Program Files\iPod 2008-07-31 23:54 . 2008-07-31 23:54 <DIR> d-------- C:\Users\All Users\ATI 2008-07-31 23:54 . 2008-07-31 23:54 <DIR> d-------- C:\ProgramData\ATI 2008-07-31 07:18 . 2008-07-31 07:18 <DIR> d-------- C:\Deckard 2008-07-30 21:26 . 2008-07-30 21:26 <DIR> d-------- C:\Program Files\Panda Security 2008-07-30 21:26 . 2008-06-19 17:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys 2008-07-30 18:26 . 2008-07-30 18:26 <DIR> d-------- C:\Users\All Users\PC Drivers HeadQuarters 2008-07-30 18:26 . 2008-07-30 18:26 <DIR> d-------- C:\ProgramData\PC Drivers HeadQuarters 2008-07-25 01:36 . 2008-07-25 01:36 524,288 --a------ C:\Windows\System32\DivXsm.exe 2008-07-25 01:36 . 2008-07-25 01:36 4,816 --a------ C:\Windows\System32\divxsm.tlb 2008-07-23 09:50 . 2008-07-23 09:50 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll 2008-07-23 09:48 . 2008-07-23 09:48 1,044,480 --a------ C:\Windows\System32\libdivx.dll 2008-07-23 09:48 . 2008-07-23 09:48 200,704 --a------ C:\Windows\System32\ssldivx.dll 2008-07-23 09:47 . 2008-07-23 09:47 416 --a------ C:\Windows\System32\dtu100.dll.manifest 2008-07-23 09:47 . 2008-07-23 09:47 416 --a------ C:\Windows\System32\dpl100.dll.manifest 2008-07-23 09:46 . 2008-07-23 09:46 12,288 --a------ C:\Windows\System32\DivXWMPExtType.dll 2008-07-21 16:46 . 2008-07-21 17:38 26 --a------ C:\Windows\dvdSanta.INI 2008-07-21 16:44 . 2008-07-21 16:44 <DIR> d-------- C:\TempDVD 2008-07-21 16:44 . 2008-07-31 07:04 <DIR> d-------- C:\Program Files\dvdSanta 2008-07-21 16:44 . 2008-07-21 17:41 <DIR> d-------- C:\dvdsanta 2008-07-19 11:42 . 2008-07-19 11:42 <DIR> d-------- C:\Program Files\QuickTime 2008-07-16 20:07 . 2008-07-16 20:07 <DIR> d-------- C:\Users\All Users\Ubisoft 2008-07-16 20:07 . 2008-07-16 20:07 <DIR> d-------- C:\ProgramData\Ubisoft 2008-07-16 07:04 . 2008-07-16 07:06 <DIR> d-------- C:\Windows\RegCure 2008-07-16 06:48 . 2008-07-16 07:06 <DIR> d-------- C:\Program Files\RegCure 2008-07-14 20:49 . 2008-07-14 20:49 <DIR> d-------- C:\Users\Dan\AppData\Roaming\Ubisoft 2008-07-14 20:31 . 2008-07-14 20:31 <DIR> d-------- C:\Program Files\Ubisoft 2008-07-14 17:55 . 2008-07-10 21:23 322,304 --a------ C:\Windows\System32\trzEE7F.tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 02:28 19,822 ----a-w C:\Windows\system32\drivers\stwrte.log 2008-08-14 02:27 --------- d-----w C:\Users\Dan\AppData\Roaming\DNA 2008-08-14 02:21 --------- d---a-w C:\ProgramData\TEMP 2008-08-13 12:50 --------- d-----w C:\Program Files\Spyware Doctor 2008-08-12 03:40 --------- d-----w C:\Program Files\World of Warcraft 2008-08-12 03:11 --------- d-----w C:\Program Files\Warcraft III 2008-08-12 01:34 --------- d-----w C:\Users\Dan\AppData\Roaming\Apple Computer 2008-08-12 01:05 20 ---h--w C:\Users\All Users\PKP_DLdu.DAT 2008-08-12 01:05 20 ---h--w C:\ProgramData\PKP_DLdu.DAT 2008-08-08 05:34 --------- d-----w C:\Program Files\DivX 2008-08-01 16:44 --------- d-----w C:\Program Files\ATI 2008-08-01 06:42 --------- d-----w C:\Program Files\ATI Technologies 2008-07-31 01:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys 2008-07-10 06:11 --------- d-----w C:\Program Files\DAEMON Tools Toolbar 2008-07-10 02:56 --------- d-----w C:\Users\Dan\AppData\Roaming\DAEMON Tools 2008-07-09 15:05 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-09 00:28 --------- d-----w C:\Program Files\Windows Mail 2008-07-07 13:44 --------- d-----w C:\Program Files\E.M. DVD Copy 2008-07-07 05:02 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-07-04 01:17 --------- d-----w C:\Users\Dan\AppData\Roaming\Download Manager 2008-07-02 01:05 --------- d-----w C:\ProgramData\WindowsSearch 2008-07-02 00:19 --------- d-----w C:\Users\Dan\AppData\Roaming\Ahead 2008-07-01 22:41 --------- d-----w C:\Program Files\BitLord2 2008-07-01 18:07 --------- d-----w C:\ProgramData\FLEXnet 2008-07-01 18:04 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-01 17:57 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-07-01 04:54 --------- d-----w C:\Program Files\DNA 2008-06-27 14:10 --------- d-----w C:\Users\Dan\AppData\Roaming\Nikon 2008-06-27 14:09 --------- d-----w C:\Program Files\Common Files\Nikon 2008-06-19 06:17 --------- d-----w C:\Users\Dan\AppData\Roaming\ArcSoft 2008-06-13 05:39 20 ---h--w C:\Users\All Users\PKP_DLec.DAT 2008-06-13 05:39 20 ---h--w C:\ProgramData\PKP_DLec.DAT 2008-05-04 02:43 22,328 ----a-w C:\Users\Dan\AppData\Roaming\PnkBstrK.sys 2008-04-15 19:31 859,282 ----a-w C:\Users\Dan\1280_StarCraft2GameplayVideo_EnglishUS2-avi-downloader.exe 2008-03-24 04:09 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 00:33 125952] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 00:33 202240] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-08-07 18:47 341824] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064] "RtHDVCpl"="RtHDVCpl.exe" [2007-09-18 23:50 4702208 C:\Windows\RtHDVCpl.exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-03-22 65588] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2008-04-01 15:17:27 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKLM\~\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-08-07 18:47 341824 C:\Program Files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-19 00:33 125952 C:\Windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1883384528-1375300349-1264342087-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{7C162ADF-1C1B-47FA-B131-0BBF78CB11F6}"= UDP:C:\Windows\System32\dlbccoms.exe:Photo Printer 720 Server "{338801CC-B447-4EEA-8270-8EB42E00C69B}"= TCP:C:\Windows\System32\dlbccoms.exe:Photo Printer 720 Server "{F9981515-F3E2-48FF-BB9D-9293DD5D4B06}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{C9CA26EA-6F0B-4A59-8671-AC7D8B71D82D}"= UDP:C:\Program Files\World of Warcraft\WoW-2.4.0-enUS-downloader.exe:Blizzard Downloader "{8476BFA0-F1F6-412D-85E9-1EEECA75B9EE}"= TCP:C:\Program Files\World of Warcraft\WoW-2.4.0-enUS-downloader.exe:Blizzard Downloader "{45664F0A-71F1-4EDF-A422-0C99D21238A2}"= UDP:3724:Blizzard Downloader: 3724 "{73340249-416A-4FB4-9CE0-C103F1B4C4D6}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3 "{5D148400-DFDB-462C-8679-4ED926130D1A}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3 "TCP Query User{8D14627C-FC3D-484F-B7D4-72FEF5FD7FC9}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= UDP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter "UDP Query User{B6EFEA90-12E4-4775-8431-16C20C99886C}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= TCP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter "TCP Query User{FF86588F-60B9-4EE3-ADA2-810640E1ED51}C:\\users\\dan\\appdata\\local\\temp\\nero web\\setupxu.exe"= UDP:C:\users\dan\appdata\local\temp\nero web\setupxu.exe:setupxu.exe "UDP Query User{84058707-87DD-455E-9602-1A063834B8BE}C:\\users\\dan\\appdata\\local\\temp\\nero web\\setupxu.exe"= TCP:C:\users\dan\appdata\local\temp\nero web\setupxu.exe:setupxu.exe "TCP Query User{50255DEF-93D9-4DC8-9831-7F8C6BD15E5D}C:\\program files\\bitlord2\\bitlord.exe"= UDP:C:\program files\bitlord2\bitlord.exe: "UDP Query User{B110ECCF-8AD1-4E43-8E9F-E41EADB10998}C:\\program files\\bitlord2\\bitlord.exe"= TCP:C:\program files\bitlord2\bitlord.exe: "{EB631120-5462-4E54-B7A1-E7297A7F6962}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{E09D8E5D-D931-46B7-8786-53E06B8C1B2F}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{DCFD25CE-CA98-40D3-BB73-EA56A0EEB889}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{C8723816-016E-4715-ABB7-FA9966314478}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{BF6B159F-D78E-488F-9B9B-80EDE1E7A7D2}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{2A0EFE6E-3F50-4CE9-974C-D1A81415916C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{FCF4D7AD-EC54-485E-B0CC-27E03A31C213}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{279FFD02-8668-4CEA-9849-B8776C9A21DC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{65435975-6C9B-4C77-A66E-807739A1F7B8}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{9EC658D9-DED3-4DF1-A320-A50EB7C92A84}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{1E160DAF-3BE2-4CE8-B7C3-FE9C37124245}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{C5DEF5D6-AD8C-44FB-869F-8AB4D1C47AA3}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{A133A347-EBA9-4FC9-AF17-D644B9291248}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{DCFC2324-3814-4FA8-ADAB-06259361CE43}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{CC3981C6-DD33-4924-B4D7-E64CFEE9BFFC}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{E6E75669-1A4A-4B02-B911-05C6E13A3144}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{90CAEE53-668A-41D7-89B4-EF786C9791D0}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{A8B1125B-1726-46D6-AF58-B7073E740CA0}C:\\program files\\bitlord2\\bitlord.exe"= UDP:C:\program files\bitlord2\bitlord.exe: "UDP Query User{AAD0C4B9-8DD5-4A4E-98BF-8547F8709410}C:\\program files\\bitlord2\\bitlord.exe"= TCP:C:\program files\bitlord2\bitlord.exe: "{8CA0057B-6A67-41C5-A84A-75676A11FEDC}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{13F61980-5E80-4233-91CC-AF061707BC83}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{347AC052-3409-4977-B971-BF326D64263D}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent "{92E1911D-CBC4-4D61-845D-2A2FD6FB1525}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent "{9BAB9E59-9A30-40B0-83AE-5019E25B9845}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{46331AB7-01B5-450D-AAE7-CE52A0C4F779}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{587DF2A9-0006-4F93-A4D1-4D7C26B81A65}"= UDP:C:\Program Files\DNA\btdna.exe:DNA (TCP-In) "{314183C2-7CD3-4C2F-B0C0-005AA2F67B7A}"= TCP:C:\Program Files\DNA\btdna.exe:DNA (UDP-In) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 07:35] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 07:37] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 07:36] R2 dlbc_device;dlbc_device;C:\Windows\system32\dlbccoms.exe [2007-03-01 15:52] R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-02 23:22] S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;C:\Windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 03:12] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}] \shell\AutoRun\command - wd_windows_tools\setup.exe . Contents of the 'Scheduled Tasks' folder 2008-08-14 C:\Windows\Tasks\RegCure Program Check.job - C:\Program Files\RegCure\RegCure.exe [2007-08-02 01:20] 2008-07-31 C:\Windows\Tasks\RegCure.job - C:\Program Files\RegCure\RegCure.exe [2007-08-02 01:20] 2008-08-13 C:\Windows\Tasks\User_Feed_Synchronization-{4755E1F3-CE53-494D-867D-0CB2680B2C16}.job - C:\Windows\system32\msfeedssync.exe [2008-01-19 00:33] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://sympatico.msn.ca/ R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com R1 -: HKCU-Internet Settings,ProxyOverride = *.local O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 -: eBay Search - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 19:29:08 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\Users\Dan\AppData\Local\Temp\WPDNSE scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\audiodg.exe C:\Windows\System32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\System32\PnkBstrA.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Windows\System32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\System32\wbem\WMIADAP.exe C:\Windows\System32\dllhost.exe . ************************************************************************** . Completion time: 2008-08-13 19:33:14 - machine was rebooted [Dan] ComboFix-quarantined-files.txt 2008-08-14 02:33:05 Pre-Run: 103,231,737,856 bytes free Post-Run: 103,407,611,904 bytes free 260 --- E O F --- 2008-07-31 01:33:06
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-14-2008, 02:16 AM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
If you've removed BitTorrent, please remove its associated folders too: C:\Users\Dan\AppData\Roaming\BitTorrent C:\Program Files\BitTorrent Delete the following file: C:\Windows\System32\trzEE7F.tmp ============================== Using Internet Explorer, visit http://www.kaspersky.nl/scanforvirus-en/kavwebscan.html Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
08-18-2008, 07:22 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
here are the results from running the kaspersky scan as well as a fresh hijackthis log. things are good with my computer, the pop-up does not show up on start up anymore. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Monday, August 18, 2008 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, August 19, 2008 01:54:14 Records in database: 1107997 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Files scanned: 175559 Threat name: 9 Infected objects: 14 Suspicious objects: 0 Duration of the scan: 01:23:44 File name / Threat name / Threats count C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.WinAntiVirus.ay 1 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.Agent.u 2 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: Trojan.Win32.Agent.tws 1 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:Porn-Downloader.Win32.Agent.v 1 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.h 1 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.k 1 C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\software.php Infected: Trojan.Win32.Vapsup.ioc 1 C:\QooBox\Quarantine\C\Windows\System32\eyykqlhl.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\Windows\System32\ldayvk.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\Windows\System32\sjupkd.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\Windows\System32\svnrnwvt.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full\DVDSanta.v4.5.retail-FOSI\fo-dvs45.exe Infected: Trojan.Win32.Pakes.jwo 1 C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full.rar Infected: Trojan.Win32.Pakes.jwo 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:18:43 PM, on 8/18/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\dlbccoms.exe C:\Windows\system32\PnkBstrA.exe C:\Windows\system32\svchost.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Users\Dan\AppData\Local\Temp\jkos-Dan\binaries\ScanningProcess.exe C:\Users\Dan\AppData\Local\Temp\jkos-Dan\binaries\ScanningProcess.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe -- End of file - 9231 bytes |
|
|
|
|
08-19-2008, 12:38 AM
|
#15 (permalink) | |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
Quote:
========================================= I can still see a p2p file sharing program, i.e. BitTorrent DNA, running. With reference to my post #2, I would strongly recommend that you remove BitTorrent DNA as well. ======================================== The following are reported by Kaspersky as infected. Perhaps downloaded via BitTorrent? Please delete them. C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full\DVDSanta.v4.5.retail-FOSI\fo-dvs45.exe C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full.rar Also delete the DSS from your desktop. The other items will be addressed when you uninstall Combofix. Your log is clean and you're good to go.
A colleague of ours has excellent information and tips on the prevention of malware here for your future reference. Please respond to this thread one more time so we can mark this thread as resolved. Happy Surfing! 
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
|
08-19-2008, 11:38 PM
|
#17 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 6,342
OS: XP Home SP3, XP MCE SP3, XP Pro SP3
|
Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
You're welcome. Glad we could help.
Stay safe!
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
| Thread Tools | |
|
|
Everything looks good. I cleaned everything up that you told me to. Thank you very much for your help. 
