|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-06-2008, 04:05 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Hijacking Help
First time posting so be gentle please...
 Any time that I try to update Symantec or AdAware or the like, I get a message saying that the program can not connect for updates. Any time I try to go to a website such as Panda Security or Trend Micro Housecall (or many others) I get a "google" search page with my destination website as the search subject. It looks legit, but when I click on a link it sends you to a completely different place or just says page could not be displayed. I disabled System Restore. I have run scans with Symantec, AdAware, and Windows Defender (all unupdated of course). Removed any trash found there. Tried to install Spybot and others, but failed due to blocked communication to websites like these. Windows firewall is off. I even tried safe mode...denied...I get a blue screen stating it couldn't find or load a video driver. Here is a Hijackthis file (one of very few things I could load directly). Please let me know what to try next. Thank you for your time and efforts in advance. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:36:25 PM, on 10/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Windows Defender\MSASCui.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\UCC\System\UcsNavBar.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\UCC\System\Umhwinmg.exe C:\UCC\System\Umhwinui.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\UCC\Services\Ucsinsvc.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.akinsford.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6045C5E3-3653-4262-9E3E-0DA3A22A2C1D} (Crystal ActiveX Report Viewer Web Report Source 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1121702207263 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1121715727671 O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://myvpn.ford.com/dana-cached/s...erSetupSP1.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS1\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS2\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: UCS Install NT Service - UCS - C:\UCC\Services\Ucsinsvc.exe O23 - Service: UCS Refresh Service - UCS - C:\UCC\Services\UcsrrSvc.exe -- End of file - 5868 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-09-2008, 07:43 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ If you have trouble downloading the files below, download them to a USB drive on another computer, and transfer them to the desktop of the affected computer. ------------------------------------------------------ Please download ComboFix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named to your Desktop. Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: C:\Qoobox\Add-Remove Programs.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log Add-Remove Programs.txt If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
10-10-2008, 08:24 AM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
You guys are the best! It appears that everything is working great now. I can get to sites like TrendMicro now that were getting redirected before, and my antivirus proggram will update once again. GJ. I am posting all the requested files below. I also re-enabled my AV and defender programs. It would seem that someone had loaded something that created a folder and files having to do with FunWebProducts (look for newspaper article about choking incident in the near future). Anyway if this results in the all-clear, I thank you sincerely. Go DAWGS!
---------- ComboFix 08-10-09.06 - Administrator 2008-10-10 9:52:53.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.296 [GMT -4:00] Command switches used :: C:\Documents and Settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\FunWebProducts C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\avatar.dat C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\register.dat C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\zbucks.dat C:\WINDOWS\system32\tdssadw.dll C:\WINDOWS\system32\TDSSerrors.log C:\WINDOWS\system32\tdssinit.dll C:\WINDOWS\system32\TDSSl.dll C:\WINDOWS\system32\TDSSlog.dll C:\WINDOWS\system32\tdssmain.dll C:\WINDOWS\system32\TDSSserf.dll C:\WINDOWS\system32\TDSSserf1.dll C:\WINDOWS\system32\tdssservers.dat . ((((((((((((((((((((((((( Files Created from 2008-09-10 to 2008-10-10 ))))))))))))))))))))))))))))))) . 2008-10-06 16:38 . 2008-10-10 09:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3 2008-10-06 16:12 . 2008-10-06 16:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-06 15:53 . 2008-10-06 15:53 0 --a------ C:\WINDOWS\nsreg.dat 2008-10-06 14:07 . 2008-10-06 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-10-06 13:52 . 2008-10-06 13:59 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-06 11:34 . 2008-10-06 11:34 <DIR> d-------- C:\Program Files\Defraggler 2008-10-06 11:33 . 2008-10-06 11:33 <DIR> d-------- C:\Program Files\CCleaner 2008-10-06 10:20 . 2008-10-06 10:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-06 10:20 . 2008-10-06 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-06 10:13 . 2008-10-06 10:13 0 --a------ C:\WINDOWS\vpc32.INI 2008-10-06 10:12 . 2008-10-06 10:10 123,619 --a------ C:\WINDOWS\system32\SYMEVNT.386 2008-10-06 10:12 . 2008-10-06 10:10 83,672 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-06 10:12 . 2008-10-06 10:10 73,224 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-06 10:11 . 2008-10-06 10:11 <DIR> d-------- C:\Program Files\Symantec_Client_Security . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-06 17:45 --------- d-----w C:\Program Files\Google 2008-10-06 14:40 90,112 ----a-w C:\WINDOWS\DUMP26f0.tmp 2008-10-06 14:12 --------- d-----w C:\Program Files\Symantec 2008-10-06 14:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688] "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\UCC\\SYSTEM\\Umhwinmg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R2 UCS Install NT Service;UCS Install NT Service;C:\UCC\Services\Ucsinsvc.exe [2008-03-26 61440] S2 UCS Refresh Service;UCS Refresh Service;C:\UCC\Services\UcsrrSvc.exe [2005-06-09 77824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder 2008-10-10 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\g87miiq5.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava14.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-10 09:55:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv] "imagepath"="\systemroot\system32\drivers\TDSSserv.sys" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . Completion time: 2008-10-10 9:57:21 ComboFix-quarantined-files.txt 2008-10-10 13:57:17 Pre-Run: 31,938,543,616 bytes free Post-Run: 32,008,257,536 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 135 --- E O F --- 2008-10-09 19:38:16 ------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:59:29 AM, on 10/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\UCC\Services\Ucsinsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.akinsford.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKCU\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6045C5E3-3653-4262-9E3E-0DA3A22A2C1D} (Crystal ActiveX Report Viewer Web Report Source 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1121702207263 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1121715727671 O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://myvpn.ford.com/dana-cached/s...erSetupSP1.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS1\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS2\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: UCS Install NT Service - UCS - C:\UCC\Services\Ucsinsvc.exe O23 - Service: UCS Refresh Service - UCS - C:\UCC\Services\UcsrrSvc.exe -- End of file - 5048 bytes ------------------ Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Reader 7.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A71000000002} AXIS Media Control --> rundll32 "C:\Program Files\Axis Communications\AXIS Media Control\AxisMediaControl.dll",UninstallMe CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" Computer Assisted Instruction --> C:\UCC\Installr\Uninstal.exe WCIINSTL Conexant D850 56K V.9x DFVc Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1\HXFSETUP.EXE -U -Idel200fk.inf Defraggler (remove only) --> "C:\Program Files\Defraggler\uninst.exe" Dell Printer Software Uninstall --> C:\Program Files\Dell\Install\Uninstall.exe Dell ResourceCD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe" HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Internet Explorer 7 (KB947864) --> "C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe" Hotfix for Windows XP (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" Hotfix for Windows XP (KB915865) --> "C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe" Hotfix for Windows XP (KB952287) --> "C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" Intel(R) Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572 Intel(R) PRO Network Adapters and Drivers --> Prounstl.exe J2SE Runtime Environment 5.0 Update 4 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040} J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060} Learning QuickBooks 2006 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{057F76A1-A2D1-4500-A7E8-BC485AA19E16}\Setup.exe" -l0x9 LiveUpdate 1.7 (Symantec Corporation) --> C:\Program Files\\Symantec\LiveUpdate\LSETUP.EXE /U Microsoft .NET Framework 1.1 --> msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 --> MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 Hotfix (KB928366) --> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp" Microsoft Internationalized Domain Names Mitigation APIs --> "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs --> "C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9} Mozilla Firefox (3.0.3) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe PC-Attach --> C:\UCC\Installr\Uninstal.exe PCAINSTL POWER Workstation --> C:\UCC\Installr\Uninstal.exe PWRINSTL Print Manager --> C:\UCC\Installr\Uninstal.exe PRTINSTL QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log Security Update for Windows Internet Explorer 7 (KB938127) --> "C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB942615) --> "C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB944533) --> "C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB950759) --> "C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB953838) --> "C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe" Security Update for Windows Media Player (KB911564) --> "C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe" Security Update for Windows Media Player 6.4 (KB925398) --> "C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe" Security Update for Windows Media Player 9 (KB911565) --> "C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe" Security Update for Windows Media Player 9 (KB917734) --> "C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe" Security Update for Windows Media Player 9 (KB936782) --> "C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe" Security Update for Windows XP (KB883939) --> "C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe" Security Update for Windows XP (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" Security Update for Windows XP (KB893066) --> "C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe" Security Update for Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Security Update for Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Security Update for Windows XP (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe" Security Update for Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Security Update for Windows XP (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe" Security Update for Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Security Update for Windows XP (KB896688) --> "C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe" Security Update for Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Security Update for Windows XP (KB899588) --> "C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe" Security Update for Windows XP (KB899589) --> "C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe" Security Update for Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Security Update for Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Security Update for Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Security Update for Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Security Update for Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Security Update for Windows XP (KB903235) --> "C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe" Security Update for Windows XP (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" Security Update for Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Security Update for Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Security Update for Windows XP (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe" Security Update for Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Security Update for Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Security Update for Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Security Update for Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Security Update for Windows XP (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe" Security Update for Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Security Update for Windows XP (KB912812) --> "C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe" Security Update for Windows XP (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe" Security Update for Windows XP (KB913446) --> "C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe" Security Update for Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Security Update for Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Security Update for Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Security Update for Windows XP (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe" Security Update for Windows XP (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe" Security Update for Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe" Security Update for Windows XP (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe" Security Update for Windows XP (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe" Security Update for Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Security Update for Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Security Update for Windows XP (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe" Security Update for Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Security Update for Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Security Update for Windows XP (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe" Security Update for Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Security Update for Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Security Update for Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Security Update for Windows XP (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe" Security Update for Windows XP (KB921503) --> "C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe" Security Update for Windows XP (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe" Security Update for Windows XP (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe" Security Update for Windows XP (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe" Security Update for Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Security Update for Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Security Update for Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Security Update for Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Security Update for Windows XP (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe" Security Update for Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Security Update for Windows XP (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe" Security Update for Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Security Update for Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Security Update for Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Security Update for Windows XP (KB925454) --> "C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe" Security Update for Windows XP (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe" Security Update for Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Security Update for Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Security Update for Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Security Update for Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Security Update for Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Security Update for Windows XP (KB928090) --> "C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe" Security Update for Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Security Update for Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Security Update for Windows XP (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe" Security Update for Windows XP (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe" Security Update for Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Security Update for Windows XP (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Security Update for Windows XP (KB931768) --> "C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe" Security Update for Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Security Update for Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Security Update for Windows XP (KB933566) --> "C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe" Security Update for Windows XP (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe" Security Update for Windows XP (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe" Security Update for Windows XP (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe" Security Update for Windows XP (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe" Security Update for Windows XP (KB937143) --> "C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe" Security Update for Windows XP (KB937894) --> "C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe" Security Update for Windows XP (KB938127) --> "C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe" Security Update for Windows XP (KB938464) --> "C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Security Update for Windows XP (KB938829) --> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe" Security Update for Windows XP (KB939653) --> "C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe" Security Update for Windows XP (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe" Security Update for Windows XP (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe" Security Update for Windows XP (KB941693) --> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe" Security Update for Windows XP (KB942615) --> "C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe" Security Update for Windows XP (KB943055) --> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe" Security Update for Windows XP (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe" Security Update for Windows XP (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe" Security Update for Windows XP (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe" Security Update for Windows XP (KB945553) --> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe" Security Update for Windows XP (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe" Security Update for Windows XP (KB946648) --> "C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Security Update for Windows XP (KB948590) --> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe" Security Update for Windows XP (KB948881) --> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe" Security Update for Windows XP (KB950749) --> "C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe" Security Update for Windows XP (KB950760) --> "C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Security Update for Windows XP (KB950762) --> "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Security Update for Windows XP (KB950974) --> "C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Security Update for Windows XP (KB951066) --> "C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376-v2) --> "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376) --> "C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe" Security Update for Windows XP (KB951698) --> "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" Security Update for Windows XP (KB951748) --> "C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Security Update for Windows XP (KB952954) --> "C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Security Update for Windows XP (KB953839) --> "C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe" Sentinel System Driver --> C:\WINDOWS\SYSTEM32\RNBOSENT\SETUPX86.EXE /U /q Software Manager --> C:\UCC\Installr\Uninstal.exe SMGINSTL SoundMAX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" Symantec AntiVirus Client --> MsiExec.exe /X{0EFC6259-3AD8-4CD2-BC57-D4937AF5CC0E} UCC Diagnostics --> C:\UCC\Installr\Uninstal.exe DGNINSTL Unit Conversion Tool Evaluation Version 5.1 --> "C:\Program Files\Unit Conversion Tool\unins000.exe" Update for Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Update for Windows XP (KB896727) --> "C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe" Update for Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Update for Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Update for Windows XP (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" Update for Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Update for Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Update for Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Update for Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Update for Windows XP (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe" Update for Windows XP (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe" Update for Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Update for Windows XP (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe" Update for Windows XP (KB932823-v3) --> "C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe" Update for Windows XP (KB933360) --> "C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe" Update for Windows XP (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe" Update for Windows XP (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe" Update for Windows XP (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe" Update for Windows XP (KB942840) --> "C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe" Update for Windows XP (KB946627) --> "C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe" Update for Windows XP (KB951072-v2) --> "C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" Windows Defender --> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401} Windows Defender Signatures --> MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C} Windows Genuine Advantage Notifications (KB905474) --> Windows Installer 3.1 (KB893803) --> "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" Windows Internet Explorer 7 --> "C:\WINDOWS\ie7\spuninst\spuninst.exe" Windows XP Hotfix - KB873333 --> C:\WINDOWS\$NtUninstallKB873333$\spuninst\spuninst.exe Windows XP Hotfix - KB873339 --> C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe Windows XP Hotfix - KB885250 --> C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe Windows XP Hotfix - KB885835 --> C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe Windows XP Hotfix - KB885836 --> C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe Windows XP Hotfix - KB886185 --> C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe Windows XP Hotfix - KB887472 --> C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe Windows XP Hotfix - KB887742 --> C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe Windows XP Hotfix - KB888113 --> C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe Windows XP Hotfix - KB888302 --> C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe Windows XP Hotfix - KB890175 --> C:\WINDOWS\$NtUninstallKB890175$\spuninst\spuninst.exe Windows XP Hotfix - KB890859 --> "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe" Windows XP Hotfix - KB891781 --> C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe Windows XP Hotfix - KB893086 --> "C:\WINDOWS\$NtUninstallKB893086$\spuninst\spuninst.exe" ------------- |
|
|
|
|
10-10-2008, 11:48 AM
|
#4 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Hello, carguy209. Go DAWGS!
Quote:
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report new HijackThis log report on system behavior Last edited by chemist; 10-10-2008 at 08:33 PM. |
||
|
|
|
|
10-16-2008, 10:49 AM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
Ok, I was delayed in my follow up to your last instructions, then I discovered that someone had opened an email attachment on this computer, further soiling the system. What an idiot!! Anyway I ran Combo fix again like I did the first time, then again with the script you gave. Both logs will be attached. Then the Java updates, ATF session, and finally the Kaspersky scan which found 39 objects..YIKES! I ran another Hijack this and here are all the results:
ComboFix 08-10-09.06 - Administrator 2008-10-16 9:27:38.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.216 [GMT -4:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Cookies\mixobo.bin C:\Documents and Settings\Administrator\Cookies\ucuxyn._dl C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\asezan.pif C:\Documents and Settings\Administrator\Start Menu\Programs\XP_AntiSpyware C:\Documents and Settings\Administrator\Start Menu\Programs\XP_AntiSpyware\Uninstall.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\XP_AntiSpyware\XP_AntiSpyware.lnk C:\Program Files\Microsoft Common C:\Program Files\Microsoft Common\wuauclt.exe C:\Program Files\XP_AntiSpyware C:\Program Files\XP_AntiSpyware\AVEngn.dll C:\Program Files\XP_AntiSpyware\data\daily.cvd C:\Program Files\XP_AntiSpyware\htmlayout.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcm80.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcp80.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcr80.dll C:\Program Files\XP_AntiSpyware\pthreadVC2.dll C:\Program Files\XP_AntiSpyware\Uninstall.exe C:\Program Files\XP_AntiSpyware\wscui.cpl C:\Program Files\XP_AntiSpyware\XP_Antispyware.cfg C:\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe C:\WINDOWS\system32\brastk.exe C:\WINDOWS\system32\DelSelf.bat . ((((((((((((((((((((((((( Files Created from 2008-09-16 to 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-16 05:31 . 2008-10-14 23:14 211,984 --a------ C:\WINDOWS\system32\_scui.cpl 2008-10-16 05:31 . 2008-10-16 05:31 19,776 --a------ C:\WINDOWS\eweqeju.sys 2008-10-16 05:31 . 2008-10-16 05:31 19,268 --a------ C:\Program Files\Common Files\ifuzeh.reg 2008-10-16 05:31 . 2008-10-16 05:31 18,832 --a------ C:\WINDOWS\kevyruv.reg 2008-10-16 05:31 . 2008-10-16 05:31 18,439 --a------ C:\WINDOWS\system32\dijoritizi.inf 2008-10-16 05:31 . 2008-10-16 05:31 17,973 --a------ C:\Documents and Settings\All Users\Application Data\wadufadig.com 2008-10-16 05:31 . 2008-10-16 05:31 16,444 --a------ C:\WINDOWS\gohyzexezu.lib 2008-10-16 05:31 . 2008-10-16 05:31 16,198 --a------ C:\Program Files\Common Files\vefeqifef.exe 2008-10-16 05:31 . 2008-10-16 05:31 15,449 --a------ C:\Documents and Settings\Administrator\Application Data\edewyva.dll 2008-10-16 05:31 . 2008-10-16 05:31 13,842 --a------ C:\WINDOWS\uqihunud.reg 2008-10-16 05:31 . 2008-10-16 05:31 13,112 --a------ C:\WINDOWS\system32\ikewus.dl 2008-10-16 05:31 . 2008-10-16 05:31 12,194 --a------ C:\Documents and Settings\All Users\Application Data\ifadu.exe 2008-10-16 05:31 . 2008-10-16 05:31 10,454 --a------ C:\WINDOWS\uwudara.ban 2008-10-16 05:31 . 2008-10-16 05:31 10,127 --a------ C:\Documents and Settings\All Users\Application Data\agocyc.bin 2008-10-16 05:27 . 2008-10-16 05:27 71,710 --a------ C:\WINDOWS\system32\wini10602.exe 2008-10-15 03:02 . 2008-10-15 03:05 1,393 --a------ C:\WINDOWS\imsins.BAK 2008-10-06 16:38 . 2008-10-10 09:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3 2008-10-06 16:12 . 2008-10-06 16:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-06 15:53 . 2008-10-06 15:53 0 --a------ C:\WINDOWS\nsreg.dat 2008-10-06 14:07 . 2008-10-06 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-10-06 13:52 . 2008-10-06 13:59 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-06 11:34 . 2008-10-06 11:34 <DIR> d-------- C:\Program Files\Defraggler 2008-10-06 11:33 . 2008-10-06 11:33 <DIR> d-------- C:\Program Files\CCleaner 2008-10-06 10:20 . 2008-10-06 10:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-06 10:20 . 2008-10-06 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-06 10:13 . 2008-10-06 10:13 0 --a------ C:\WINDOWS\vpc32.INI 2008-10-06 10:12 . 2008-10-06 10:10 123,619 --a------ C:\WINDOWS\system32\SYMEVNT.386 2008-10-06 10:12 . 2008-10-06 10:10 83,672 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-06 10:12 . 2008-10-06 10:10 73,224 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-06 10:11 . 2008-10-06 10:11 <DIR> d-------- C:\Program Files\Symantec_Client_Security . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 09:31 18,033 ----a-w C:\Program Files\Common Files\cylewelocy.db 2008-10-16 09:31 11,153 ----a-w C:\Program Files\Common Files\efekokis._sy 2008-10-06 17:45 --------- d-----w C:\Program Files\Google 2008-10-06 14:40 90,112 ----a-w C:\WINDOWS\DUMP26f0.tmp 2008-10-06 14:12 --------- d-----w C:\Program Files\Symantec 2008-10-06 14:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 10:00 2,180,352 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:22 2,057,728 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll . ((((((((((((((((((((((((((((( snapshot@2008-10-10_ 9.56.57.43 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-26 09:08:35 124,928 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\advpack.dll + 2008-08-26 09:08:36 347,136 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\dxtmsft.dll + 2008-08-26 09:08:36 214,528 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\dxtrans.dll + 2008-08-26 09:08:36 132,608 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\extmgr.dll + 2008-08-26 09:08:36 63,488 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\icardie.dll + 2008-08-25 08:43:21 70,656 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ie4uinit.exe + 2008-08-26 09:08:36 153,088 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieakeng.dll + 2008-08-26 09:08:36 230,400 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieaksie.dll + 2008-08-23 05:54:50 161,792 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieakui.dll + 2007-07-01 03:31:33 2,455,488 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieapfltr.dat + 2008-08-26 09:08:36 380,928 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieapfltr.dll + 2008-08-26 09:08:37 388,608 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iedkcs32.dll + 2008-10-03 17:26:50 6,068,224 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieframe.dll + 2008-08-26 09:08:39 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iernonce.dll + 2008-08-26 09:08:39 267,776 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iertutil.dll + 2008-08-25 08:43:21 13,824 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\ieudinit.exe + 2008-08-23 05:56:16 635,848 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe + 2008-08-26 09:08:40 27,648 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\jsproxy.dll + 2008-08-26 09:08:40 459,264 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\msfeeds.dll + 2008-08-26 09:08:40 52,224 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\msfeedsbs.dll + 2008-08-26 09:08:43 3,594,752 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll + 2008-08-26 09:08:43 477,696 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\mshtmled.dll + 2008-08-26 09:08:44 193,024 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\msrating.dll + 2008-08-26 09:08:44 671,232 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\mstime.dll + 2008-08-26 09:08:44 102,912 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\occache.dll + 2008-08-26 09:08:44 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\pngfilt.dll + 2008-08-26 09:08:44 105,984 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\url.dll + 2008-08-26 09:08:45 1,162,752 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\urlmon.dll + 2008-08-26 09:08:45 233,472 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\webcheck.dll + 2008-08-26 09:08:45 827,904 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll + 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\spmsg.dll + 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\spuninst.exe + 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\update\spcustom.dll + 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\update\update.exe + 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB956390-IE7\update\updspapi.dll - 2007-02-28 09:08:48 2,136,064 -c----w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe + 2008-08-14 09:58:27 2,136,064 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe - 2007-02-28 08:38:55 2,057,600 -c----w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe + 2008-08-14 09:22:13 2,057,728 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe - 2007-02-28 08:38:57 2,015,744 -c----w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe + 2008-08-14 09:22:14 2,015,744 ------w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe - 2007-02-28 09:10:57 2,180,352 -c----w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe + 2008-08-14 10:00:45 2,180,352 ------w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe + 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\advpack.dll + 2008-06-23 16:57:27 347,136 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtmsft.dll + 2008-06-23 16:57:27 214,528 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtrans.dll + 2008-06-23 16:57:27 133,120 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\extmgr.dll + 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\icardie.dll + 2008-06-23 09:20:25 70,656 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ie4uinit.exe + 2008-06-23 16:57:29 153,088 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakeng.dll + 2008-06-23 16:57:29 230,400 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieaksie.dll + 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakui.dll + 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieapfltr.dll + 2008-06-23 16:57:29 384,512 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iedkcs32.dll + 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieframe.dll + 2008-06-23 16:57:33 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iernonce.dll + 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iertutil.dll + 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieudinit.exe + 2008-06-23 09:20:52 625,664 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe + 2008-06-23 16:57:35 27,648 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\jsproxy.dll + 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeeds.dll + 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeedsbs.dll + 2008-06-24 14:57:40 3,592,192 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll + 2008-06-23 16:57:39 477,696 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll + 2008-06-23 16:57:39 193,024 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll + 2008-06-23 16:57:40 671,232 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mstime.dll + 2008-06-23 16:57:40 102,912 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll + 2008-06-23 16:57:40 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll + 2007-03-06 01:22:41 213,216 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\updspapi.dll + 2008-06-23 16:57:40 105,984 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\url.dll + 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\urlmon.dll + 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll + 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\wininet.dll - 2008-09-11 07:04:40 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2008-10-15 07:04:21 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2008-09-11 07:04:40 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2008-10-15 07:04:21 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2008-09-11 07:04:40 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2008-10-15 07:04:21 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2008-09-11 07:04:40 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe + 2008-10-15 07:04:21 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe - 2008-09-11 07:04:40 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2008-10-15 07:04:21 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2008-09-11 07:04:40 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2008-10-15 07:04:21 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2008-09-11 07:04:40 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2008-10-15 07:04:21 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2008-09-11 07:04:40 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2008-10-15 07:04:22 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2008-09-11 07:04:40 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2008-10-15 07:04:21 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2008-09-11 07:04:40 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2008-10-15 07:04:21 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2008-09-11 07:04:40 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2008-10-15 07:04:22 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2008-09-11 07:04:39 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2008-10-15 07:04:20 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2008-09-11 07:04:39 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2008-10-15 07:04:20 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe - 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-08-26 07:24:28 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2008-10-10 13:45:45 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-16 09:27:20 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-10 13:45:45 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-16 09:27:20 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-16 09:27:20 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-08-26 07:24:28 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll - 2008-06-20 10:44:38 138,368 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys + 2008-08-14 09:51:43 138,368 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys - 2008-06-23 16:57:27 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-08-26 07:24:28 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-06-23 16:57:27 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-08-26 07:24:28 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2008-06-23 16:57:27 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-08-26 07:24:28 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll - 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll + 2008-08-26 07:24:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2008-06-23 09:20:25 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2008-08-25 08:37:59 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2008-06-23 16:57:29 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-08-26 07:24:28 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2008-06-23 16:57:29 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-08-26 07:24:28 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll + 2008-08-23 05:54:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll - 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2008-08-26 07:24:28 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2008-06-23 16:57:29 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-08-26 07:24:29 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2008-10-03 17:41:15 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2008-06-23 16:57:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-08-26 07:24:29 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll - 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2008-08-26 07:24:29 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2008-08-25 08:38:00 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2008-06-23 09:20:52 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2008-08-23 05:56:15 635,848 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe - 2008-06-23 16:57:35 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-08-26 07:24:30 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2008-08-26 07:24:30 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2008-08-26 07:24:30 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2008-06-24 14:57:40 3,592,192 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-08-27 08:24:32 3,593,216 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2008-06-23 16:57:39 477,696 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-08-26 07:24:30 477,696 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2008-06-23 16:57:39 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-08-26 07:24:30 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll - 2008-06-23 16:57:40 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-08-26 07:24:30 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-02-28 09:08:48 2,136,064 -c----w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe + 2008-08-14 09:58:27 2,136,064 -c----w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe - 2007-02-28 08:38:55 2,057,600 -c----w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe + 2008-08-14 09:22:13 2,057,728 -c----w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe - 2007-02-28 08:38:57 2,015,744 -c----w C:\WINDOWS\system32\dllcache\ntkrpamp.exe + 2008-08-14 09:22:14 2,015,744 -c----w C:\WINDOWS\system32\dllcache\ntkrpamp.exe - 2007-02-28 09:10:57 2,180,352 -c----w C:\WINDOWS\system32\dllcache\ntoskrnl.exe + 2008-08-14 10:00:45 2,180,352 -c----w C:\WINDOWS\system32\dllcache\ntoskrnl.exe - 2008-06-23 16:57:40 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll + 2008-08-26 07:24:30 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll - 2008-06-23 16:57:40 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-08-26 07:24:30 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2006-08-14 10:34:41 332,928 -c--a-w C:\WINDOWS\system32\dllcache\srv.sys + 2008-08-28 10:04:17 333,056 -c--a-w C:\WINDOWS\system32\dllcache\srv.sys - 2008-06-23 16:57:40 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll + 2008-08-26 07:24:30 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll - 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-08-26 07:24:31 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-08-26 07:24:31 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll - 2008-03-19 09:47:00 1,845,248 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys + 2008-09-15 11:57:41 1,846,016 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys - 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-08-26 07:24:31 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll - 2008-06-20 10:44:38 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys + 2008-08-14 09:51:43 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys - 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-08-26 07:24:28 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-08-26 07:24:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2008-06-23 16:57:27 133,120 ------w C:\WINDOWS\system32\extmgr.dll + 2008-08-26 07:24:28 133,120 ------w C:\WINDOWS\system32\extmgr.dll - 2008-07-02 11:11:22 238,352 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-10-15 07:11:29 238,352 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2008-08-26 07:24:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2008-06-23 09:20:25 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe + 2008-08-25 08:37:59 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe - 2008-06-23 16:57:29 153,088 ------w C:\WINDOWS\system32\ieakeng.dll + 2008-08-26 07:24:28 153,088 ------w C:\WINDOWS\system32\ieakeng.dll - 2008-06-23 16:57:29 230,400 ------w C:\WINDOWS\system32\ieaksie.dll + 2008-08-26 07:24:28 230,400 ------w C:\WINDOWS\system32\ieaksie.dll - 2008-06-21 05:23:54 161,792 ------w C:\WINDOWS\system32\ieakui.dll + 2008-08-23 05:54:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll - 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2008-08-26 07:24:28 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2008-06-23 16:57:29 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll + 2008-08-26 07:24:29 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll - 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll + 2008-10-03 17:41:15 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2008-06-23 16:57:33 44,544 ------w C:\WINDOWS\system32\iernonce.dll + 2008-08-26 07:24:29 44,544 ------w C:\WINDOWS\system32\iernonce.dll - 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2008-08-26 07:24:29 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-08-25 08:38:00 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2008-06-23 16:57:35 27,648 ------w C:\WINDOWS\system32\jsproxy.dll + 2008-08-26 07:24:30 27,648 ------w C:\WINDOWS\system32\jsproxy.dll - 2008-08-26 17:28:14 16,208,504 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-10-07 19:19:40 16,721,856 ----a-w C:\WINDOWS\system32\MRT.exe - 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2008-08-26 07:24:30 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2008-08-26 07:24:30 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2008-06-24 14:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-08-27 08:24:32 3,593,216 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-08-26 07:24:30 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2008-06-23 16:57:39 193,024 ------w C:\WINDOWS\system32\msrating.dll + 2008-08-26 07:24:30 193,024 ------w C:\WINDOWS\system32\msrating.dll - 2008-06-23 16:57:40 671,232 ------w C:\WINDOWS\system32\mstime.dll + 2008-08-26 07:24:30 671,232 ------w C:\WINDOWS\system32\mstime.dll - 2008-06-23 16:57:40 102,912 ------w C:\WINDOWS\system32\occache.dll + 2008-08-26 07:24:30 102,912 ------w C:\WINDOWS\system32\occache.dll - 2008-08-14 11:59:57 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-15 11:58:09 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-08-14 11:59:57 383,254 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-15 11:58:09 383,254 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-08-26 07:24:30 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll - 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-08-26 07:24:30 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-08-26 07:24:31 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-08-26 07:24:31 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688] "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\UCC\\SYSTEM\\Umhwinmg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R2 UCS Install NT Service;UCS Install NT Service;C:\UCC\Services\Ucsinsvc.exe [2008-03-26 61440] S2 UCS Refresh Service;UCS Refresh Service;C:\UCC\Services\UcsrrSvc.exe [2005-06-09 77824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - AEC *Newly Created Service* - ASYNCMAC . Contents of the 'Scheduled Tasks' folder 2008-10-16 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20] . - - - - ORPHANS REMOVED - - - - HKCU-Run-brastk - C:\WINDOWS\system32\brastk.exe HKLM-Run-XP Antispyware 2009 - C:\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\g87miiq5.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava14.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 09:28:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . Completion time: 2008-10-16 9:30:51 ComboFix-quarantined-files.txt 2008-10-16 13:30:46 ComboFix2.txt 2008-10-10 13:57:22 Pre-Run: 31,309,885,440 bytes free Post-Run: 31,321,407,488 bytes free 419 --- E O F --- 2008-10-15 07:05:35 #2 ComboFix 08-10-09.06 - Administrator 2008-10-16 9:33:09.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.223 [GMT -4:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-09-16 to 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-16 05:31 . 2008-10-14 23:14 211,984 --a------ C:\WINDOWS\system32\_scui.cpl 2008-10-16 05:31 . 2008-10-16 05:31 19,776 --a------ C:\WINDOWS\eweqeju.sys 2008-10-16 05:31 . 2008-10-16 05:31 19,268 --a------ C:\Program Files\Common Files\ifuzeh.reg 2008-10-16 05:31 . 2008-10-16 05:31 18,832 --a------ C:\WINDOWS\kevyruv.reg 2008-10-16 05:31 . 2008-10-16 05:31 18,439 --a------ C:\WINDOWS\system32\dijoritizi.inf 2008-10-16 05:31 . 2008-10-16 05:31 17,973 --a------ C:\Documents and Settings\All Users\Application Data\wadufadig.com 2008-10-16 05:31 . 2008-10-16 05:31 16,444 --a------ C:\WINDOWS\gohyzexezu.lib 2008-10-16 05:31 . 2008-10-16 05:31 16,198 --a------ C:\Program Files\Common Files\vefeqifef.exe 2008-10-16 05:31 . 2008-10-16 05:31 15,449 --a------ C:\Documents and Settings\Administrator\Application Data\edewyva.dll 2008-10-16 05:31 . 2008-10-16 05:31 13,842 --a------ C:\WINDOWS\uqihunud.reg 2008-10-16 05:31 . 2008-10-16 05:31 13,112 --a------ C:\WINDOWS\system32\ikewus.dl 2008-10-16 05:31 . 2008-10-16 05:31 12,194 --a------ C:\Documents and Settings\All Users\Application Data\ifadu.exe 2008-10-16 05:31 . 2008-10-16 05:31 10,454 --a------ C:\WINDOWS\uwudara.ban 2008-10-16 05:31 . 2008-10-16 05:31 10,127 --a------ C:\Documents and Settings\All Users\Application Data\agocyc.bin 2008-10-16 05:27 . 2008-10-16 05:27 71,710 --a------ C:\WINDOWS\system32\wini10602.exe 2008-10-15 03:02 . 2008-10-15 03:05 1,393 --a------ C:\WINDOWS\imsins.BAK 2008-10-06 16:38 . 2008-10-10 09:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3 2008-10-06 16:12 . 2008-10-06 16:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-06 15:53 . 2008-10-06 15:53 0 --a------ C:\WINDOWS\nsreg.dat 2008-10-06 14:07 . 2008-10-06 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-10-06 13:52 . 2008-10-06 13:59 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-06 11:34 . 2008-10-06 11:34 <DIR> d-------- C:\Program Files\Defraggler 2008-10-06 11:33 . 2008-10-06 11:33 <DIR> d-------- C:\Program Files\CCleaner 2008-10-06 10:20 . 2008-10-06 10:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-06 10:20 . 2008-10-06 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-06 10:13 . 2008-10-06 10:13 0 --a------ C:\WINDOWS\vpc32.INI 2008-10-06 10:12 . 2008-10-06 10:10 123,619 --a------ C:\WINDOWS\system32\SYMEVNT.386 2008-10-06 10:12 . 2008-10-06 10:10 83,672 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-06 10:12 . 2008-10-06 10:10 73,224 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-06 10:11 . 2008-10-06 10:11 <DIR> d-------- C:\Program Files\Symantec_Client_Security . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 09:31 18,033 ----a-w C:\Program Files\Common Files\cylewelocy.db 2008-10-16 09:31 11,153 ----a-w C:\Program Files\Common Files\efekokis._sy 2008-10-06 17:45 --------- d-----w C:\Program Files\Google 2008-10-06 14:40 90,112 ----a-w C:\WINDOWS\DUMP26f0.tmp 2008-10-06 14:12 --------- d-----w C:\Program Files\Symantec 2008-10-06 14:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688] "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\UCC\\SYSTEM\\Umhwinmg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R2 UCS Install NT Service;UCS Install NT Service;C:\UCC\Services\Ucsinsvc.exe [2008-03-26 61440] S2 UCS Refresh Service;UCS Refresh Service;C:\UCC\Services\UcsrrSvc.exe [2005-06-09 77824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-10-16 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 09:34:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\UCC\SYSTEM\Umhwinmg.exe C:\UCC\SYSTEM\UmhWinUi.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Completion time: 2008-10-16 9:38:35 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-16 13:38:31 ComboFix2.txt 2008-10-16 13:30:53 ComboFix3.txt 2008-10-10 13:57:22 Pre-Run: 31,312,875,520 bytes free Post-Run: 31,302,696,960 bytes free 127 --- E O F --- 2008-10-15 07:05:35 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, October 16, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, October 16, 2008 08:52:28 Records in database: 1315286 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Files scanned: 33350 Threat name: 15 Infected objects: 39 Suspicious objects: 0 Duration of the scan: 01:15:13 File name / Threat name / Threats count C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Infected: Trojan-Spy.Win32.KeySpy.x 1 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OLK42\Statement_JAN-OCT.zip Infected: Worm.Win32.AutoRun.qsf 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0AF40000.VBN Infected: Trojan-Mailfinder.Win32.Agent.sc 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0AF40001.VBN Infected: Backdoor.Win32.UltimateDefender.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0000.VBN Infected: Rootkit.Win32.Agent.eeq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0001.VBN Infected: Rootkit.Win32.Agent.eeq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0002.VBN Infected: Rootkit.Win32.Clbd.kr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0003.VBN Infected: Rootkit.Win32.Clbd.kr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0004.VBN Infected: Rootkit.Win32.Agent.ehv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0005.VBN Infected: Rootkit.Win32.Agent.ehv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0006.VBN Infected: Backdoor.Win32.Agent.rfv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0007.VBN Infected: Backdoor.Win32.Agent.rfv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0008.VBN Infected: Backdoor.Win32.Agent.tcb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0009.VBN Infected: Backdoor.Win32.Agent.tcb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000A.VBN Infected: Trojan-Downloader.Win32.FraudLoad.vbxt 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000B.VBN Infected: Trojan-Downloader.Win32.FraudLoad.vbxt 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000C.VBN Infected: Backdoor.Win32.TDSS.zj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000D.VBN Infected: Backdoor.Win32.TDSS.zj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000E.VBN Infected: Rootkit.Win32.Agent.eeq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C000F.VBN Infected: Rootkit.Win32.Agent.eeq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0010.VBN Infected: Rootkit.Win32.Clbd.kr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0011.VBN Infected: Rootkit.Win32.Clbd.kr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0012.VBN Infected: Rootkit.Win32.Agent.ehv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0013.VBN Infected: Rootkit.Win32.Agent.ehv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0014.VBN Infected: Backdoor.Win32.Agent.rfv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0015.VBN Infected: Backdoor.Win32.Agent.rfv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0016.VBN Infected: Backdoor.Win32.Agent.tcb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0017.VBN Infected: Backdoor.Win32.Agent.tcb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0018.VBN Infected: Trojan-Downloader.Win32.FraudLoad.vbxt 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C0019.VBN Infected: Trojan-Downloader.Win32.FraudLoad.vbxt 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C001A.VBN Infected: Backdoor.Win32.TDSS.zj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E0C001B.VBN Infected: Backdoor.Win32.TDSS.zj 1 C:\Program Files\RealVNC\WinVNC\othread2.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c 1 C:\Qoobox\Quarantine\C\Program Files\Microsoft Common\wuauclt.exe.vir Infected: Worm.Win32.AutoRun.qsf 1 C:\Qoobox\Quarantine\C\Program Files\XP_AntiSpyware\Uninstall.exe.vir Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.az 1 C:\Qoobox\Quarantine\C\Program Files\XP_AntiSpyware\wscui.cpl.vir Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.ba 1 C:\Qoobox\Quarantine\C\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe.vir Infected: Trojan.Win32.FraudPack.gfc 1 C:\WINDOWS\system32\wini10602.exe Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.az 1 C:\WINDOWS\system32\_scui.cpl Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.ba 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:37:58 PM, on 10/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\UCC\Services\Ucsinsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\UCC\SYSTEM\Umhwinmg.exe C:\UCC\SYSTEM\Umhwinui.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6045C5E3-3653-4262-9E3E-0DA3A22A2C1D} (Crystal ActiveX Report Viewer Web Report Source 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1121702207263 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1121715727671 O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://myvpn.ford.com/dana-cached/s...erSetupSP1.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS1\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS2\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: UCS Install NT Service - UCS - C:\UCC\Services\Ucsinsvc.exe O23 - Service: UCS Refresh Service - UCS - C:\UCC\Services\UcsrrSvc.exe -- End of file - 4847 bytes System behavior seems fine now that the pesky Antivirus XP crap is gone. Web browsing is normal as well. Thanks again for all that you are doing. |
|
|
|
|
10-16-2008, 04:20 PM
|
#8 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Hello carguy209.
Quote:
------------------------------------------------------ Open Notepad and copy/paste the entire contents of the quotebox below into Notepad: Quote:
It should look like this:  Double-click on peek.bat and allow it to run. A Notepad file will open. Post the contents of that file in your next reply, and close the file. ------------------------------------------------------ |
||
|
|
|
|
10-17-2008, 10:02 AM
|
#9 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
Forgive my ignorance and ADD tendancies. It won't happen again. Here is the contents of the peek.bat file:
[boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect Thanks again. |
|
|
|
|
10-17-2008, 10:38 AM
|
#10 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Hello carguy209.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Not sure why ComboFix is saying the Recovery Console is not installed, as it appears to be installed by looking at your boot.ini file. ------------------------------------------------------ Quote:
------------------------------------------------------ Empty this entire folder. It's where Symantec keeps it's renamed quarantined files: C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine Don't delete the folder, just empty it. Empty your Recycle Bin if it does not do so automatically. ------------------------------------------------------ Kaspersky has detected an infected email in the following Folder: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Unfortunately, it only tells us where the email is, and not its name. You will have to find the email and delete it. It is likely an email with an attachment. If you are not sure what it is, you will have to delete emails until a scan of that folder comes up clean. You can configure Kaspersky to scan only that folder. Let me know when you find it. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
File:: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OLK42\Statement_JAN-OCT.zip C:\WINDOWS\system32\_scui.cpl C:\WINDOWS\eweqeju.sys C:\Program Files\Common Files\ifuzeh.reg C:\WINDOWS\kevyruv.reg C:\WINDOWS\system32\dijoritizi.inf C:\Documents and Settings\All Users\Application Data\wadufadig.com C:\WINDOWS\gohyzexezu.lib C:\Program Files\Common Files\vefeqifef.exe C:\Documents and Settings\Administrator\Application Data\edewyva.dll C:\WINDOWS\uqihunud.reg C:\WINDOWS\system32\ikewus.dl C:\Documents and Settings\All Users\Application Data\ifadu.exe C:\WINDOWS\uwudara.ban C:\Documents and Settings\All Users\Application Data\agocyc.bin C:\WINDOWS\system32\wini10602.exe C:\WINDOWS\imsins.BAK C:\Program Files\Common Files\cylewelocy.db C:\Program Files\Common Files\efekokis._sy Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log |
|
|
|
|
|
10-17-2008, 03:07 PM
|
#11 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
I screwed up the copy/paste for the CFScript because I copied it of the notepad I made of your instructions and it copied the last line incorrectly. As chastized before, I wasn't going to do a damn thing without your instruction. Here are the two logs requested.
ComboFix 08-10-16.08 - Administrator 2008-10-17 16:50:11.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.340 [GMT -4:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt * Created a new restore point FILE :: C:\Documents and Settings\Administrator\Application Data\edewyva.dll C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OLK42\Statement_JAN-OCT.zip C:\Documents and Settings\All Users\Application Data\agocyc.bin C:\Documents and Settings\All Users\Application Data\ifadu.exe C:\Documents and Settings\All Users\Application Data\wadufadig.com C:\Program Files\Common Files\cylewelocy.db C:\Program Files\Common Files\efekokis._sySave this Notepad file as CFScript.txt to your Desktop and then close the file. C:\Program Files\Common Files\ifuzeh.reg C:\Program Files\Common Files\vefeqifef.exe C:\WINDOWS\eweqeju.sys C:\WINDOWS\gohyzexezu.lib C:\WINDOWS\imsins.BAK C:\WINDOWS\kevyruv.reg C:\WINDOWS\system32\_scui.cpl C:\WINDOWS\system32\dijoritizi.inf C:\WINDOWS\system32\ikewus.dl C:\WINDOWS\system32\wini10602.exe C:\WINDOWS\uqihunud.reg C:\WINDOWS\uwudara.ban . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\edewyva.dll C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OLK42\Statement_JAN-OCT.zip C:\Documents and Settings\All Users\Application Data\agocyc.bin C:\Documents and Settings\All Users\Application Data\ifadu.exe C:\Documents and Settings\All Users\Application Data\wadufadig.com C:\Program Files\Common Files\cylewelocy.db C:\Program Files\Common Files\ifuzeh.reg C:\Program Files\Common Files\vefeqifef.exe C:\WINDOWS\eweqeju.sys C:\WINDOWS\gohyzexezu.lib C:\WINDOWS\imsins.BAK C:\WINDOWS\kevyruv.reg C:\WINDOWS\system32\_scui.cpl C:\WINDOWS\system32\dijoritizi.inf C:\WINDOWS\system32\ikewus.dl C:\WINDOWS\system32\wini10602.exe C:\WINDOWS\uqihunud.reg C:\WINDOWS\uwudara.ban . ((((((((((((((((((((((((( Files Created from 2008-09-17 to 2008-10-17 ))))))))))))))))))))))))))))))) . 2008-10-16 10:05 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-16 10:04 . 2008-10-16 10:05 <DIR> d-------- C:\Program Files\Java 2008-10-16 10:04 . 2008-10-16 10:04 <DIR> d-------- C:\Program Files\Common Files\Java 2008-10-06 16:38 . 2008-10-10 09:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3 2008-10-06 16:12 . 2008-10-06 16:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-06 15:53 . 2008-10-06 15:53 0 --a------ C:\WINDOWS\nsreg.dat 2008-10-06 14:07 . 2008-10-06 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-10-06 13:52 . 2008-10-06 13:59 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-06 11:34 . 2008-10-06 11:34 <DIR> d-------- C:\Program Files\Defraggler 2008-10-06 11:33 . 2008-10-06 11:33 <DIR> d-------- C:\Program Files\CCleaner 2008-10-06 10:20 . 2008-10-06 10:20 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-06 10:20 . 2008-10-06 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-06 10:13 . 2008-10-06 10:13 0 --a------ C:\WINDOWS\vpc32.INI 2008-10-06 10:12 . 2008-10-06 10:10 123,619 --a------ C:\WINDOWS\system32\SYMEVNT.386 2008-10-06 10:12 . 2008-10-06 10:10 83,672 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-06 10:12 . 2008-10-06 10:10 73,224 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-06 10:11 . 2008-10-06 10:11 <DIR> d-------- C:\Program Files\Symantec_Client_Security . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 09:31 11,153 ----a-w C:\Program Files\Common Files\efekokis._sy 2008-10-06 17:45 --------- d-----w C:\Program Files\Google 2008-10-06 14:40 90,112 ----a-w C:\WINDOWS\DUMP26f0.tmp 2008-10-06 14:12 --------- d-----w C:\Program Files\Symantec 2008-10-06 14:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 10:00 2,180,352 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:22 2,057,728 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll . ((((((((((((((((((((((((((((( snapshot_2008-10-16_ 9.30.27.76 ))))))))))))))))))))))))))))))))))))))))) . - 2005-11-10 15:27:06 49,248 -c--a-w C:\WINDOWS\system32\java.exe + 2008-06-10 05:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2005-11-10 15:27:16 49,250 -c--a-w C:\WINDOWS\system32\javaw.exe + 2008-06-10 05:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe - 2005-11-10 17:03:54 127,078 -c--a-w C:\WINDOWS\system32\javaws.exe + 2008-06-10 06:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 98304] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688] "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 77824] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "UCS NavBar"="C:\UCC\System\UcsNavBar.exe" [2007-10-30 319488] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\UCC\\SYSTEM\\Umhwinmg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R2 UCS Install NT Service;UCS Install NT Service;C:\UCC\Services\Ucsinsvc.exe [2008-03-26 61440] S2 UCS Refresh Service;UCS Refresh Service;C:\UCC\Services\UcsrrSvc.exe [2005-06-09 77824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder 2008-10-17 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-17 16:51:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . Completion time: 2008-10-17 16:53:53 ComboFix-quarantined-files.txt 2008-10-17 20:53:42 ComboFix2.txt 2008-10-16 13:38:37 ComboFix3.txt 2008-10-16 13:30:53 ComboFix4.txt 2008-10-10 13:57:22 Pre-Run: 31,099,084,800 bytes free Post-Run: 31,147,823,104 bytes free 164 --- E O F --- 2008-10-15 07:05:35 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:04:25 PM, on 10/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\UCC\Services\Ucsinsvc.exe C:\UCC\SYSTEM\Umhwinmg.exe C:\UCC\SYSTEM\Umhwinui.exe C:\UCC\System\PrtWinMg.exe C:\UCC\SYSTEM\PrtMgrUI.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [UCS NavBar] C:\UCC\System\UcsNavBar.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6045C5E3-3653-4262-9E3E-0DA3A22A2C1D} (Crystal ActiveX Report Viewer Web Report Source 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1121702207263 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1121715727671 O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - https://web.crystalreports.dealercon...iveXViewer.cab O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://myvpn.ford.com/dana-cached/s...erSetupSP1.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS1\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O17 - HKLM\System\CS2\Services\Tcpip\..\{0FF47882-74B8-4310-BA2F-FB8208ED81D7}: NameServer = 205.171.3.65,205.171.2.65 O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: UCS Install NT Service - UCS - C:\UCC\Services\Ucsinsvc.exe O23 - Service: UCS Refresh Service - UCS - C:\UCC\Services\UcsrrSvc.exe -- End of file - 5048 bytes |
|
|
|
|
10-17-2008, 04:00 PM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
No worries.
Delete the following File if it still exists: C:\Program Files\Common Files\efekokis._sy Empty your Recycle Bin if it is not emptied automatically. If any file resists deletion, reboot into Safe Mode and try again. Please let me know if you have trouble. ------------------------------------------------------ Is your system still behaving properly? Let me know and I will give you some final instructions. |
|
|
|
|
10-20-2008, 07:13 AM
|
#13 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
Ok, file succesfully deleted in normal mode. System is acting great so far. I greatly appreciate you sharing your insights to help the rest of us. Awaiting final instructions. BTW, how does one go about learning this craft? How do you read the logs and know what to look for? Thanks again.
|
|
|
|
|
10-20-2008, 11:08 AM
|
#14 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Hello carguy209.
Quote:
------------------------------------------------------ Did you find the infected email and delete it? Did the Kaspersky scan on outlook.pst come out clean? Please let me know. |
|
|
|
|
|
10-20-2008, 12:13 PM
|
#16 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Hijacking Help
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
10-23-2008, 12:42 PM
|
#18 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 17
OS: XP Pro SP2
|
Re: Hijacking Help
Combofix /u - done
AV and Spyware reinstated - done Microsoft updates - current except SP3 (heard it was buggy still) Spyblaster - done IE-Spyad - done MVPS Hosts File - Don't know how it would work with network at job Spybot - I have Defender and Spyblaster in place already. Do I need Spybot still? Do I need Defender running as well? My Symantec moved some files from Qoobox Quarantine to Symantec's Quarantine. I deleted them in Symantec. Anything else? |
|
|
|
| Thread Tools | |
|
|
