|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-02-2008, 05:15 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 6
OS: xp
|
diallers found on laptop
HI it looks like my laptop has been attacked and a number of diallers have been installed. I usualy use firefox fo web browsing, but my partner prefers IE (?). This is starting to cause problems as it dials into porn sites. Here are the hijackthis and panda logs. Thanks for your help.
;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-10-02 23:49:35 PROTECTIONS: 1 MALWARE: 4 SUSPECTS: 7 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== AVG 7.5.516 7.5.516 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00132710 dialer.xd Dialers No 0 Yes No HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} 00246467 dialer.fie Dialers No 0 Yes No c:\windows\downloaded program files\gba1402.exe 00247608 dialer.flf Dialers No 0 Yes No c:\windows\downloaded program files\dba1402.exe 00259901 Dialer.GPO Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe 00259901 Dialer.GPO Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe 00259901 Dialer.GPO Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe 00259901 Dialer.GPO Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe 00259901 Dialer.GPO Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe ;=================================================================================================================================================================================== SUSPECTS Sent Location ;=================================================================================================================================================================================== No C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe No C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe ;=================================================================================================================================================================================== VULNERABILITIES Id Severity Description ;=================================================================================================================================================================================== ;=================================================================================================================================================================================== Logfile of HijackThis v1.99.1 Scan saved at 19:12:09, on 20/05/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\iTunes\iTunes.exe C:\DOCUME~1\Dave\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.v21.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://portal.v21.co.uk R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.v21.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by V21 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [links] links.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://207.226.177.98/dba1402.exe O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-05-2008, 06:50 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,604
OS: XP SP3
|
Re: diallers found on laptop
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. If you're not receiving help elsewhere, and still require assistance for this issue, and since it has been a few days since you first posted, please do this: ------------------------------------------------------ You are using an outdated version of HijackThis and running it from a temporary folder. HijackThis makes backups and needs to be in its own folder. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version. Please download HijackThis and Save it to your Desktop. Alternate link Double-click on the file you just downloaded. Click 'Run' or 'Install' and follow the prompts to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. If it does, just close it please. ------------------------------------------------------
|
|
|
|
|
10-07-2008, 03:02 PM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 6
OS: xp
|
Re: diallers found on laptop
Hi,
I've done as asked. Here is the copy of the rsit log.txt: Logfile of random's system information tool 1.04 (written by random/random) Run by Dave at 2008-10-07 21:44:16 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 26 GB (69%) free of 38 GB Total RAM: 222 MB (19% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:45:24, on 07/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\Logi_MwX.Exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Dave\Desktop\RSIT.exe C:\Documents and Settings\Dave\Desktop\Dave.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatch...s&qkw=%s&tbid= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/?tbid= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://portal.v21.co.uk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.v21.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by V21 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O3 - Toolbar: &Inbox.com Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Belkin Wireless G Notebook Card Client Utility.lnk = C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Inbox Search - tbr:iemenu O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://207.226.177.98/gba1402.exe O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6281 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}] C:\PROGRA~1\Inbox\Toolbar\ctbr.dll [2007-08-18 1172480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Inbox.com Toolbar - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll [2007-08-18 1172480] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2004-06-17 155648] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-06-17 118784] "SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe [2004-06-03 32881] "UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-08-19 110592] "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-05 98394] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-05 688218] "REGSHAVE"=C:\Program Files\REGSHAVE\REGSHAVE.EXE [2002-02-04 53248] "Logitech Utility"=C:\WINDOWS\Logi_MwX.Exe [2003-12-17 19968] "AVG7_CC"=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe [2008-09-14 579072] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] C:\Program Files\CCleaner\ccleaner.exe [2008-09-29 1279216] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe [2004-10-13 229438] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2004-09-17 290816] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [2004-06-04 286720] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [2007-01-23 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe [2005-06-22 26112] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Belkin Wireless G Notebook Card Client Utility.lnk - C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxsrvc.dll [2004-06-17 344064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Disabled:AOL" "C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Disabled:AOL" "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Disabled:AOL 9.0" "C:\Program Files\Grisoft\AVG Free\avgw.exe"="C:\Program Files\Grisoft\AVG Free\avgw.exe:*:Enabled:AVG Free Edition for Windows" "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe"="C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe:*:Enabled:Ad-Aware SE Personal" "C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe" "C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe" "C:\Program Files\Grisoft\AVG7\avgemc.exe"="C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe" "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox" "C:\Program Files\Mozilla Thunderbird\thunderbird.exe"="C:\Program Files\Mozilla Thunderbird\thunderbird.exe:*:Enabled:Mozilla Thunderbird" "C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Disabled:Internet Explorer" "C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe"="C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe:*:Disabled:Sunbelt Kerio Firewall GUI" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0" "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL" "C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL" ======List of files/folders created in the last 1 months====== 2008-10-07 21:44:16 ----D---- C:\rsit 2008-10-02 22:17:13 ----D---- C:\Program Files\Panda Security 2008-10-02 21:34:52 ----D---- C:\Program Files\Trend Micro 2008-10-02 21:14:02 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-10-02 21:13:21 ----A---- C:\WINDOWS\wininit.ini 2008-09-29 22:03:22 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-29 21:33:36 ----D---- C:\Program Files\NoAdware5.0 2008-09-29 21:19:08 ----D---- C:\Program Files\CCleaner 2008-09-22 21:09:56 ----D---- C:\Program Files\LG Electronics 2008-09-22 20:51:57 ----D---- C:\Documents and Settings\Dave\Application Data\LGSync 2008-09-22 20:46:06 ----D---- C:\Documents and Settings\Dave\Application Data\LG Electronics 2008-09-21 12:07:47 ----D---- C:\Program Files\PC Connectivity Solution 2008-09-21 12:05:08 ----D---- C:\Documents and Settings\All Users\Application Data\Installations 2008-09-14 23:49:06 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-09-14 22:07:50 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2008-09-14 22  22 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$2008-09-14 22:03:31 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$ 2008-09-14 21:19:49 ----D---- C:\WINDOWS\system32\CatRoot_bak 2008-09-12 22:07:10 ----RA---- C:\WINDOWS\system32\mdmxsdk.dll 2008-09-12 22:07:10 ----RA---- C:\WINDOWS\system32\HSFCI009.dll 2008-09-12 22:07:10 ----D---- C:\Program Files\CONEXANT 2008-09-12 21:04:46 ----A---- C:\WINDOWS\RTacDbg.txt 2008-09-12 20:56:17 ----A---- C:\WINDOWS\system32\results.txt 2008-09-12 20:55:38 ----D---- C:\WINDOWS\OPTIONS 2008-09-12 20:55:38 ----D---- C:\Program Files\Belkin ======List of files/folders modified in the last 1 months====== 2008-10-07 21:44:21 ----D---- C:\WINDOWS\Prefetch 2008-10-07 21:42:56 ----RD---- C:\Program Files 2008-10-07 20:28:48 ----D---- C:\Program Files\Mozilla Firefox 2008-10-07 20:16:08 ----D---- C:\WINDOWS\Temp 2008-10-07 20:15:35 ----D---- C:\WINDOWS 2008-10-05 22:33:57 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-10-05 20:59:20 ----D---- C:\WINDOWS\system32\CatRoot2 2008-10-03 00:31:15 ----HD---- C:\Config.Msi 2008-10-03 00:31:13 ----SHD---- C:\WINDOWS\Installer 2008-10-03 00:29:19 ----D---- C:\Program Files\Common Files 2008-10-03 00:29:13 ----D---- C:\WINDOWS\system32\drivers 2008-10-03 00:29:12 ----D---- C:\WINDOWS\system32 2008-10-02 22:20:48 ----HD---- C:\WINDOWS\inf 2008-10-02 21:13:30 ----D---- C:\Program Files\Mozilla Thunderbird 2008-09-29 22:11:27 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-09-29 22:11:26 ----RHD---- C:\$VAULT$.AVG 2008-09-29 21:20:50 ----D---- C:\WINDOWS\Debug 2008-09-29 21:19:19 ----D---- C:\Program Files\Yahoo! 2008-09-23 19:59:15 ----DC---- C:\WINDOWS\system32\DRVSTORE 2008-09-23 19:40:54 ----D---- C:\Program Files\HP 2008-09-23 19:08:16 ----HD---- C:\Program Files\InstallShield Installation Information 2008-09-22 22:37:48 ----D---- C:\Documents and Settings\Dave\Application Data\Mozilla 2008-09-22 21:11:14 ----D---- C:\WINDOWS\system32\CatRoot 2008-09-17 22:33:58 ----RSH---- C:\boot.ini 2008-09-17 21:42:50 ----D---- C:\Program Files\Common Files\Teleca Shared 2008-09-14 23:49:08 ----D---- C:\WINDOWS\WinSxS 2008-09-14 23:48:18 ----HD---- C:\WINDOWS\$hf_mig$ 2008-09-14 22:07:57 ----D---- C:\Program Files\Messenger 2008-09-14 22 30 ----RSHD---- C:\WINDOWS\system32\dllcache2008-09-14 22:04:09 ----D---- C:\Program Files\Internet Explorer 2008-09-12 21:04:43 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 Avg7Core;AVG7 Kernel; C:\WINDOWS\System32\Drivers\avg7core.sys [2008-09-14 821856] R1 Avg7RsW;AVG7 Wrap Driver; C:\WINDOWS\System32\Drivers\avg7rsw.sys [2007-03-14 4224] R1 Avg7RsXP;AVG7 Resident Driver XP; C:\WINDOWS\System32\Drivers\avg7rsxp.sys [2007-03-14 27776] R1 AvgClean;AVG7 Clean Driver; C:\WINDOWS\System32\Drivers\avgclean.sys [2008-09-14 10760] R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-09-12 21035] R2 ASCTRM;ASCTRM; C:\WINDOWS\system32\drivers\ASCTRM.sys [2005-06-22 8552] R2 AvgTdi;AVG Network Redirector; C:\WINDOWS\System32\Drivers\avgtdi.sys [2007-03-14 4960] R2 MASPINT;MASPINT; C:\WINDOWS\system32\drivers\MASPINT.sys [2000-03-29 8096] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043] R3 Belkin701F;Belkin Wireless G Notebook Card Service v7; C:\WINDOWS\system32\DRIVERS\BLKWGNv7.sys [2006-10-19 303616] R3 CAMCAUD;Conexant AMC 3D Environmental Audio; C:\WINDOWS\system32\drivers\camcaud.sys [2004-10-14 292864] R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camchal.sys [2004-10-14 276480] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2004-04-05 13872] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2004-03-10 1041536] R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2004-03-10 199552] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-06-17 708989] R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-06-28 69760] R3 SjyPkt;SjyPkt; \??\C:\WINDOWS\System32\Drivers\SjyPkt.sys [] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-05 185824] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2004-03-10 682624] S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys [] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-03-18 51088] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-03-18 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-03-18 21744] S3 LHidFlt2;Logitech HID/USB Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys [2003-12-17 25505] S3 LHidUsb;Logitech USB Receiver device driver; C:\WINDOWS\System32\Drivers\LHidUsb.Sys [2003-12-17 37887] S3 LMouFlt2;Logitech Mouse Class Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys [2003-12-17 70801] S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] S3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584] S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584] S3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-17 35913] S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20050901.036\symidsco.sys [] S3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2004-11-08 85504] S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2007-07-11 12416] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616] S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2007-07-11 21632] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] S3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2004-09-20 3210496] S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys [] S3 w810mdfl;Sony Ericsson W810 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w810mdfl.sys [] S3 w810mdm;Sony Ericsson W810 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w810mdm.sys [] S3 w810mgmt;Sony Ericsson W810 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w810mgmt.sys [] S3 w810obex;Sony Ericsson W810 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w810obex.sys [] S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Avg7Alrt;AVG7 Alert Manager Server; C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe [2008-09-14 418816] R2 Avg7UpdSvc;AVG7 Update Service; C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe [2007-03-14 49664] R2 AVGEMS;AVG E-mail Scanner; C:\PROGRA~1\Grisoft\AVG7\avgemc.exe [2008-09-14 406528] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\SHARED\HPQWMI.exe [2004-07-27 98304] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 iPodService;iPodService; C:\Program Files\iPod\bin\iPodService.exe [2005-12-21 323584] S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864] -----------------EOF----------------- |
|
|
|
|
10-07-2008, 03:13 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,604
OS: XP SP3
|
Re: diallers found on laptop
Hello davec67.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ Please download ComboFix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named to your Desktop. Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
10-08-2008, 01:47 PM
|
#5 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 6
OS: xp
|
Re: diallers found on laptop
Hi, here is the combofix log and anew hijackthis log. Thanks.
ComboFix 08-10-08.01 - Dave 2008-10-08 20:31:06.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.72 [GMT 1:00] Running from: C:\Documents and Settings\Dave\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dave\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\video activex access . ((((((((((((((((((((((((( Files Created from 2008-09-08 to 2008-10-08 ))))))))))))))))))))))))))))))) . 2008-10-07 21:44 . 2008-10-07 21:45 <DIR> d-------- C:\rsit 2008-10-02 22:21 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-10-02 22:17 . 2008-10-02 22:17 <DIR> d-------- C:\Program Files\Panda Security 2008-10-02 21:34 . 2008-10-02 21:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-02 21:14 . 2008-10-02 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-10-02 21:13 . 2008-10-02 21:13 164 --a------ C:\WINDOWS\wininit.ini 2008-09-29 22:03 . 2008-09-29 23:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-29 21:33 . 2008-09-29 21:58 <DIR> d-------- C:\Program Files\NoAdware5.0 2008-09-29 21:19 . 2008-09-29 21:19 <DIR> d-------- C:\Program Files\CCleaner 2008-09-22 21:09 . 2008-09-22 21:09 <DIR> d-------- C:\Program Files\LG Electronics 2008-09-22 21:09 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys 2008-09-22 21:09 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys 2008-09-22 20:51 . 2008-09-22 20:51 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LGSync 2008-09-22 20:46 . 2008-09-22 21:42 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LG Electronics 2008-09-22 20:45 . 2005-09-26 22:55 419,240 --a------ C:\WINDOWS\system32\Vsflex7L.ocx 2008-09-22 20:45 . 2000-05-22 00:00 244,416 --a------ C:\WINDOWS\system32\Msflxgrd.ocx 2008-09-21 12:07 . 2008-09-21 12:07 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-21 12:05 . 2008-09-21 12:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-09-14 21:19 . 2008-09-17 23:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-09-12 22:07 . 2008-09-12 22:07 <DIR> d-------- C:\Program Files\CONEXANT 2008-09-12 22:07 . 2004-03-10 12:35 1,041,536 -ra------ C:\WINDOWS\system32\drivers\HSF_DP.sys 2008-09-12 22:07 . 2004-03-10 12:37 682,624 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys 2008-09-12 22:07 . 2004-03-10 12:40 199,552 -ra------ C:\WINDOWS\system32\drivers\HSFHWICH.sys 2008-09-12 22:07 . 2004-03-10 12:23 129,012 -ra------ C:\WINDOWS\system32\drivers\HSFProf.cty 2008-09-12 22:07 . 2003-04-09 15:01 90,112 -ra------ C:\WINDOWS\system32\mdmxsdk.dll 2008-09-12 22:07 . 2003-12-17 13:51 32,218 -ra------ C:\WINDOWS\system32\HSFCI009.dll 2008-09-12 22:07 . 2003-04-09 14:48 11,043 -ra------ C:\WINDOWS\system32\drivers\mdmxsdk.sys 2008-09-12 20:56 . 2006-10-19 10:42 303,616 --------- C:\WINDOWS\system32\drivers\BLKWGNv7.SYS 2008-09-12 20:56 . 2008-09-12 21:00 21,035 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-12 20:55 . 2008-09-12 20:55 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-09-12 20:55 . 2008-09-12 20:55 <DIR> d-------- C:\Program Files\Belkin 2008-09-12 20:55 . 2002-10-02 09:57 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 20:13 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-29 20:19 --------- d-----w C:\Program Files\Yahoo! 2008-09-23 18:40 --------- d-----w C:\Program Files\HP 2008-09-23 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-20 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2008-09-17 20:42 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-09-02 19:41 10,112 ----a-w C:\Documents and Settings\Dave\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-17 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-14 579072] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 C:\WINDOWS\LOGI_MWX.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-14 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G Notebook Card Client Utility.lnk - C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [2008-09-12 1556480] HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-09-29 16:11 1279216 C:\Program Files\CCleaner\CCleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] --a--c--- 2004-10-13 18:34 229438 C:\Program Files\HPQ\Default Settings\Cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-09-17 17:19 290816 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2004-06-04 13:38 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2007-01-23 23:33 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a--c--- 2005-06-22 20:30 26112 C:\Program Files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R3 Belkin701F;Belkin Wireless G Notebook Card Service v7;C:\WINDOWS\system32\DRIVERS\BLKWGNv7.sys [2006-10-19 303616] R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 13532] *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe MSConfigStartUp-Google Desktop Search - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe MSConfigStartUp-HP Component Manager - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe MSConfigStartUp-HP Software Update - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe MSConfigStartUp-PCSuiteTrayApplication - C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE MSConfigStartUp-PcSync - C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe MSConfigStartUp-Sony Ericsson PC Suite - C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Dave\Application Data\Mozilla\Firefox\Profiles\jvpgyowx.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava14.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJPI142_05.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPOJI610.dll FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 20:33:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-08 20:37:03 ComboFix-quarantined-files.txt 2008-10-08 19:36:59 Pre-Run: 27,445,936,128 bytes free Post-Run: 27,436,466,176 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 153 --- E O F --- 2008-09-17 22:09:30 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:39:27, on 08/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\Logi_MwX.Exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Dave\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/?tbid= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.v21.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O3 - Toolbar: &Inbox.com Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Belkin Wireless G Notebook Card Client Utility.lnk = C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Inbox Search - tbr:iemenu O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 5867 bytes |
|
|
|
|
10-08-2008, 05:45 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,604
OS: XP SP3
|
Re: diallers found on laptop
Hello again, davec67. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
File::
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe
c:\windows\downloaded program files\dba1402.exe
c:\windows\downloaded program files\gba1402.exe
C:\WINDOWS\wininit.ini
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{FF3F0F03-0F01-131A-A3F9-08F02B23E0CC}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06]
Folder::
C:\Program Files\NoAdware5.0
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report new HijackThis log report on system behavior Last edited by chemist; 10-08-2008 at 05:47 PM. |
|
|
|
|
10-13-2008, 05:42 PM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 6
OS: xp
|
Re: diallers found on laptop
As requested, although I'm not sure what you mean by 'report on system behavior':
ComboFix 08-10-08.01 - Dave 2008-10-13 20:33:14.3 - NTFSx86 Running from: C:\Documents and Settings\Dave\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dave\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe c:\windows\downloaded program files\dba1402.exe c:\windows\downloaded program files\gba1402.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-09-13 to 2008-10-13 ))))))))))))))))))))))))))))))) . 2008-10-07 21:44 . 2008-10-07 21:45 <DIR> d-------- C:\rsit 2008-10-02 22:21 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-10-02 22:17 . 2008-10-02 22:17 <DIR> d-------- C:\Program Files\Panda Security 2008-10-02 21:34 . 2008-10-02 21:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-02 21:14 . 2008-10-02 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-09-29 22:03 . 2008-09-29 23:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-29 21:19 . 2008-09-29 21:19 <DIR> d-------- C:\Program Files\CCleaner 2008-09-22 21:09 . 2008-09-22 21:09 <DIR> d-------- C:\Program Files\LG Electronics 2008-09-22 21:09 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys 2008-09-22 21:09 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys 2008-09-22 20:51 . 2008-09-22 20:51 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LGSync 2008-09-22 20:46 . 2008-09-22 21:42 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LG Electronics 2008-09-22 20:45 . 2005-09-26 22:55 419,240 --a------ C:\WINDOWS\system32\Vsflex7L.ocx 2008-09-22 20:45 . 2000-05-22 00:00 244,416 --a------ C:\WINDOWS\system32\Msflxgrd.ocx 2008-09-21 12:07 . 2008-09-21 12:07 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-21 12:05 . 2008-09-21 12:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-09-14 21:19 . 2008-09-17 23:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 20:13 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-29 20:19 --------- d-----w C:\Program Files\Yahoo! 2008-09-23 18:40 --------- d-----w C:\Program Files\HP 2008-09-23 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-20 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2008-09-17 20:42 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-09-12 21:07 --------- d-----w C:\Program Files\CONEXANT 2008-09-12 20:00 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-12 19:55 --------- d-----w C:\Program Files\Belkin 2008-09-02 19:41 10,112 ----a-w C:\Documents and Settings\Dave\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-17 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-14 579072] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 C:\WINDOWS\LOGI_MWX.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-14 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G Notebook Card Client Utility.lnk - C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [2008-09-12 1556480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-09-29 16:11 1279216 C:\Program Files\CCleaner\CCleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] --a--c--- 2004-10-13 18:34 229438 C:\Program Files\HPQ\Default Settings\Cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-09-17 17:19 290816 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2004-06-04 13:38 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2007-01-23 23:33 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a--c--- 2005-06-22 20:30 26112 C:\Program Files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R3 Belkin701F;Belkin Wireless G Notebook Card Service v7;C:\WINDOWS\system32\DRIVERS\BLKWGNv7.sys [2006-10-19 303616] R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 13532] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-13 20:35:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-13 20:39:29 ComboFix-quarantined-files.txt 2008-10-13 19:39:23 ComboFix2.txt 2008-10-13 19:17:21 ComboFix3.txt 2008-10-08 19:37:04 Pre-Run: 27,427,921,920 bytes free Post-Run: 27,416,907,776 bytes free 122 --- E O F --- 2008-09-17 22:09:30 Tuesday, October 14, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, October 13, 2008 21:18:51 Records in database: 1309394 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer C:\ D:\ Scan statistics Files scanned 79412 Threat name 2 Infected objects 14 Suspicious objects 0 Duration of the scan 02:07:20 File name Threat name Threats count C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.g 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\dba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\gba1402.exe.vir Infected: not-a-virus:Porn-Dialer.Win32.GBDialer.d 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:35:36, on 14/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\Logi_MwX.Exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Dave\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatch...s&qkw=%s&tbid= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/?tbid= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.inbox.com/search/ie.aspx?tb_id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.inbox.com/support/sa_customize.aspx?TbId= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.v21.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: &Inbox.com Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Belkin Wireless G Notebook Card Client Utility.lnk = C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Inbox Search - tbr:iemenu O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Inbox\Toolbar\ctbr.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6256 bytes ComboFix 08-10-08.01 - Dave 2008-10-13 20:33:14.3 - NTFSx86 Running from: C:\Documents and Settings\Dave\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dave\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe c:\windows\downloaded program files\dba1402.exe c:\windows\downloaded program files\gba1402.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-09-13 to 2008-10-13 ))))))))))))))))))))))))))))))) . 2008-10-07 21:44 . 2008-10-07 21:45 <DIR> d-------- C:\rsit 2008-10-02 22:21 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-10-02 22:17 . 2008-10-02 22:17 <DIR> d-------- C:\Program Files\Panda Security 2008-10-02 21:34 . 2008-10-02 21:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-02 21:14 . 2008-10-02 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-09-29 22:03 . 2008-09-29 23:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-29 21:19 . 2008-09-29 21:19 <DIR> d-------- C:\Program Files\CCleaner 2008-09-22 21:09 . 2008-09-22 21:09 <DIR> d-------- C:\Program Files\LG Electronics 2008-09-22 21:09 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys 2008-09-22 21:09 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys 2008-09-22 20:51 . 2008-09-22 20:51 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LGSync 2008-09-22 20:46 . 2008-09-22 21:42 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LG Electronics 2008-09-22 20:45 . 2005-09-26 22:55 419,240 --a------ C:\WINDOWS\system32\Vsflex7L.ocx 2008-09-22 20:45 . 2000-05-22 00:00 244,416 --a------ C:\WINDOWS\system32\Msflxgrd.ocx 2008-09-21 12:07 . 2008-09-21 12:07 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-21 12:05 . 2008-09-21 12:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-09-14 21:19 . 2008-09-17 23:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 20:13 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-29 20:19 --------- d-----w C:\Program Files\Yahoo! 2008-09-23 18:40 --------- d-----w C:\Program Files\HP 2008-09-23 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-20 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2008-09-17 20:42 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-09-12 21:07 --------- d-----w C:\Program Files\CONEXANT 2008-09-12 20:00 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-12 19:55 --------- d-----w C:\Program Files\Belkin 2008-09-02 19:41 10,112 ----a-w C:\Documents and Settings\Dave\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-17 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-14 579072] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 C:\WINDOWS\LOGI_MWX.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-14 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G Notebook Card Client Utility.lnk - C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [2008-09-12 1556480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-09-29 16:11 1279216 C:\Program Files\CCleaner\CCleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] --a--c--- 2004-10-13 18:34 229438 C:\Program Files\HPQ\Default Settings\Cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-09-17 17:19 290816 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2004-06-04 13:38 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2007-01-23 23:33 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a--c--- 2005-06-22 20:30 26112 C:\Program Files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R3 Belkin701F;Belkin Wireless G Notebook Card Service v7;C:\WINDOWS\system32\DRIVERS\BLKWGNv7.sys [2006-10-19 303616] R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 13532] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-13 20:35:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-13 20:39:29 ComboFix-quarantined-files.txt 2008-10-13 19:39:23 ComboFix2.txt 2008-10-13 19:17:21 ComboFix3.txt 2008-10-08 19:37:04 Pre-Run: 27,427,921,920 bytes free Post-Run: 27,416,907,776 bytes free 122 --- E O F --- 2008-09-17 22:09:30 |
|
|
|
|
10-13-2008, 06:48 PM
|
#8 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,604
OS: XP SP3
|
Re: diallers found on laptop
Hello dave.
Quote:
Quote:
It appears that you ran ComboFix twice that last round. Please do the following: Go to Start > Run and copy/paste the following into the Run box and click OK: C:\Qoobox\ComboFix2.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ |
||
|
|
|
|
10-14-2008, 12:43 PM
|
#9 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 6
OS: xp
|
Re: diallers found on laptop
Hi, as requested here is gthe second of the combo logs. the system seems to working OK. It is a little slow to boot and shut down though. Hope this is enough.
ComboFix 08-10-08.01 - Dave 2008-10-13 20:12:06.2 - NTFSx86 Running from: C:\Documents and Settings\Dave\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dave\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe c:\windows\downloaded program files\dba1402.exe c:\windows\downloaded program files\gba1402.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\NoAdware5.0 C:\Program Files\NoAdware5.0\nutils.dll C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.10\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.11\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.12\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.2\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.3\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.4\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.5\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.6\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.7\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.8\dba1402.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.9\dba1402.exe c:\windows\downloaded program files\dba1402.exe c:\windows\downloaded program files\gba1402.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-09-13 to 2008-10-13 ))))))))))))))))))))))))))))))) . 2008-10-07 21:44 . 2008-10-07 21:45 <DIR> d-------- C:\rsit 2008-10-02 22:21 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-10-02 22:17 . 2008-10-02 22:17 <DIR> d-------- C:\Program Files\Panda Security 2008-10-02 21:34 . 2008-10-02 21:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-02 21:14 . 2008-10-02 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-09-29 22:03 . 2008-09-29 23:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-29 21:19 . 2008-09-29 21:19 <DIR> d-------- C:\Program Files\CCleaner 2008-09-22 21:09 . 2008-09-22 21:09 <DIR> d-------- C:\Program Files\LG Electronics 2008-09-22 21:09 . 2007-07-11 10:45 21,632 --a------ C:\WINDOWS\system32\drivers\lgusbmodem.sys 2008-09-22 21:09 . 2007-07-11 10:40 12,416 --a------ C:\WINDOWS\system32\drivers\lgusbbus.sys 2008-09-22 20:51 . 2008-09-22 20:51 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LGSync 2008-09-22 20:46 . 2008-09-22 21:42 <DIR> d-------- C:\Documents and Settings\Dave\Application Data\LG Electronics 2008-09-22 20:45 . 2005-09-26 22:55 419,240 --a------ C:\WINDOWS\system32\Vsflex7L.ocx 2008-09-22 20:45 . 2000-05-22 00:00 244,416 --a------ C:\WINDOWS\system32\Msflxgrd.ocx 2008-09-21 12:07 . 2008-09-21 12:07 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-21 12:05 . 2008-09-21 12:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-09-14 21:19 . 2008-09-17 23:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 20:13 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-29 20:19 --------- d-----w C:\Program Files\Yahoo! 2008-09-23 18:40 --------- d-----w C:\Program Files\HP 2008-09-23 18:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-20 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2008-09-17 20:42 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-09-12 21:07 --------- d-----w C:\Program Files\CONEXANT 2008-09-12 20:00 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-12 19:55 --------- d-----w C:\Program Files\Belkin 2008-09-02 19:41 10,112 ----a-w C:\Documents and Settings\Dave\Application Data\wklnhst.dat 2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-18 21:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-17 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-09-14 579072] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 C:\WINDOWS\LOGI_MWX.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-09-14 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G Notebook Card Client Utility.lnk - C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [2008-09-12 1556480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-09-29 16:11 1279216 C:\Program Files\CCleaner\CCleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] --a--c--- 2004-10-13 18:34 229438 C:\Program Files\HPQ\Default Settings\Cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl] --a------ 2004-09-17 17:19 290816 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2004-06-04 13:38 286720 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2007-01-23 23:33 155648 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a--c--- 2005-06-22 20:30 26112 C:\Program Files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] S3 Belkin701F;Belkin Wireless G Notebook Card Service v7;C:\WINDOWS\system32\DRIVERS\BLKWGNv7.sys [2006-10-19 303616] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-13 20:14:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-13 20:17:20 ComboFix-quarantined-files.txt 2008-10-13 19:17:18 ComboFix2.txt 2008-10-08 19:37:04 Pre-Run: 27,446,349,824 bytes free Post-Run: 27,435,905,024 bytes free 155 --- E O F --- 2008-09-17 22:09:30 |
|
|
|
|
10-14-2008, 01:20 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,604
OS: XP SP3
|
Re: diallers found on laptop
Hello again, davec67.
Please read the following article: http://www.techsupportforum.com/secu...ning-slow.html ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now. Delete RSIT.exe from your desktop. Delete the following Folder if it still exists: C:\rsit Empty your Recycle Bin if it is not emptied automatically. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. It would be a good idea to update to AVG8. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. FIREWALL Using a third-party Firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one Firewall program as they will conflict with each other.SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
