|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-29-2008, 09:24 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
problem with trojan-keylogger.win32.fung
I keep getting the following pop up every 15 minutes or so.
Windows Security Alert To help protect tour computer, Windows Freewall has blocked activity of harmful software Do you want to block suspocious software? Name: Trojan-Keylogger.WIN32.FUNG Risk Level: High Description: Fung is a Spyware program that records keystrokes and takes screen shots of the computer i have a picture of this problem ( i already attached with this topic ) Logfile of random's system information tool 1.04 (written by random/random) Run by ir8clan at 2008-12-29 22:35:43 Microsoft Windows XP Professional Service Pack 2 System drive C: has 77 GB (84%) free of 92 GB Total RAM: 959 MB (41% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:35:51, on 12/29/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\ir8clan\Desktop\RSIT.exe C:\Program Files\trend micro\ir8clan.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [asus32] "C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe" O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 10341 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\SpywareStop Scheduled Scan.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}] IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2008-02-18 99760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B9F5787-88A5-4945-90E7-C4B18563BC5E}] CKeyScramblerBHO Object - C:\Program Files\KeyScrambler\KeyScramblerIE.dll [2008-12-28 812520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-12-15 308856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-01 455960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-09-04 2055960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - MSN Toolbar - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll [2008-06-03 86032] {A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-09-04 2055960] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-05-04 16206848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-04-24 1448960] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-02-01 8523776] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-02-01 81920] "Flashget"=C:\Program Files\FlashGet\FlashGet.exe /min [] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "Super Screen Capture"=C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe [2006-06-02 3126784] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-29 1234712] "avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-12-15 185896] "SpyHunter Security Suite"=C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [2008-09-10 864256] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2008-10-22 399504] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360] "Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704] "IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2008-01-23 2577840] "DW6"=C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe [2008-06-10 785520] "Uniblue RegistryBooster 2"=C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S [] "asus32"=C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe [2008-12-28 98304] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe C:\Documents and Settings\ir8clan\Start Menu\Programs\Startup LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="avgrsstx.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "DisableTaskMgr"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoWindowsUpdate"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe" "C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget" "C:\WINDOWS\system32\drivers\svchost.exe"="C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e052900-276a-11dd-84b8-0040452c13e8}] shell\AutoRun\command - E:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85bd0d0-60db-11dd-84ef-0013d380508d}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe shell\Open(&0)\command - Recycled\ctfmon.exe ======File associations====== .txt - open - Notepad.exe %1 ======List of files/folders created in the last 1 months====== 2008-12-29 22:27:41 ----D---- C:\Program Files\trend micro 2008-12-29 22:27:40 ----D---- C:\rsit 2008-12-29 21:45:08 ----A---- C:\WINDOWS\gmer.ini 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer.exe 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer.dll 2008-12-28 21:42:54 ----D---- C:\Program Files\Enigma Software Group 2008-12-28 21:21:25 ----D---- C:\Program Files\CCleaner 2008-12-28 19:45:34 ----D---- C:\Program Files\KeyScrambler 2008-12-28 19:05:45 ----A---- C:\IPAddr.txt 2008-12-28 19:05:16 ----A---- C:\phyaddr.txt 2008-12-28 18:54:53 ----A---- C:\ipconfig.txt 2008-12-28 17:44:21 ----D---- C:\Documents and Settings\ir8clan\Application Data\Google 2008-12-28 09:13:50 ----D---- C:\Program Files\ImTOO 2008-12-27 10:19:00 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-12-15 17:17:04 ----D---- C:\Program Files\Common Files\xing shared 2008-12-15 03:15:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-12-15 03:15:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-12-15 03:14:37 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-12-15 03:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-12-15 03:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-12-15 03:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$ 2008-12-15 02:17:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-12-15 01:59:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Malwarebytes 2008-12-15 01:59:09 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-12-15 00:19:53 ----D---- C:\Program Files\Avira 2008-12-15 00:11:10 ----D---- C:\WINDOWS\system32\appmgmt 2008-12-13 21:55:16 ----D---- C:\Documents and Settings\ir8clan\Application Data\skypePM 2008-12-13 21:49:51 ----D---- C:\Documents and Settings\All Users\Application Data\Skype ======List of files/folders modified in the last 1 months====== 2008-12-29 22:27:41 ----RD---- C:\Program Files 2008-12-29 22:20:50 ----D---- C:\WINDOWS\Temp 2008-12-29 22:11:52 ----D---- C:\Program Files\Mozilla Firefox 2008-12-29 22:03:21 ----D---- C:\WINDOWS\Prefetch 2008-12-29 21:45:08 ----D---- C:\WINDOWS 2008-12-29 21:45:05 ----D---- C:\WINDOWS\system32\drivers 2008-12-29 16:41:40 ----D---- C:\Documents and Settings\ir8clan\Application Data\LimeWire 2008-12-29 16:39:47 ----D---- C:\Documents and Settings\ir8clan\Application Data\DMCache 2008-12-29 16:37:27 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-29 16:37:12 ----D---- C:\Program Files\Bkav2006 2008-12-29 16:37:04 ----D---- C:\WINDOWS\system32 2008-12-29 12:21:28 ----HD---- C:\$AVG8.VAULT$ 2008-12-28 23:25:10 ----SD---- C:\WINDOWS\Tasks 2008-12-28 23:12:49 ----D---- C:\Downloads 2008-12-28 22:51:10 ----D---- C:\Documents and Settings\ir8clan\Application Data\Yahoo! 2008-12-28 22:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\SpywareStop 2008-12-28 22:14:07 ----A---- C:\WINDOWS\NeroDigital.ini 2008-12-28 21:41:32 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-12-28 21:32:29 ----D---- C:\WINDOWS\Debug 2008-12-28 18:37:48 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\AVGTOOLBAR 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Ahead 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\AdobeUM 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adobe 2008-12-28 17:45:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adblock Pro 2008-12-28 09:16:25 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-27 10:19:16 ----HD---- C:\WINDOWS\inf 2008-12-27 10:19:04 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-27 10:17:08 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-15 17:17:04 ----D---- C:\Program Files\Common Files 2008-12-15 17:16:53 ----D---- C:\Program Files\Common Files\Real 2008-12-15 17:16:45 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2008-12-15 17:16:30 ----A---- C:\WINDOWS\system32\pndx5032.dll 2008-12-15 17:16:30 ----A---- C:\WINDOWS\system32\pndx5016.dll 2008-12-15 17:16:20 ----A---- C:\WINDOWS\system32\msvcr71.dll 2008-12-15 17:16:20 ----A---- C:\WINDOWS\system32\msvcp71.dll 2008-12-15 17:16:19 ----A---- C:\WINDOWS\system32\pncrt.dll 2008-12-15 03:05:11 ----D---- C:\Program Files\Internet Explorer 2008-12-15 02:01:50 ----A---- C:\YServer.txt 2008-12-15 00:19:53 ----D---- C:\Documents and Settings\All Users\Application Data\Avira 2008-12-15 00:11:09 ----SHD---- C:\WINDOWS\Installer 2008-12-15 00:00:52 ----D---- C:\Documents and Settings\ir8clan\Application Data\IDM ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [] R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-01 97928] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-09-04 26824] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-06-27 75072] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352] R1 SysLib;SysLib; C:\WINDOWS\system32\drivers\SysLib.sys [2008-12-29 15979350] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-12 20747] R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-04 4271616] R3 KeyScrambler;KeyScrambler; C:\WINDOWS\System32\drivers\keyscrambler.sys [2008-06-24 113896] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-02-01 7434720] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136] R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera; C:\WINDOWS\System32\Drivers\ubVeo532.sys [2002-07-01 95232] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-12-29 85969] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 NtApm;NT Apm/Legacy Interface Driver; C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 9344] S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 ACPI;ACPI; C:\WINDOWS\system32\drivers\ACPI.sys [] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-12-26 68865] R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-12-26 151297] R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-01 231704] R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-20 168432] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-02-01 155716] R2 O2Flash;O2Micro Flash Memory; C:\WINDOWS\system32\o2flash.exe [2006-08-15 36864] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-03 14336] -----------------EOF----------------- |
|
     |
| Sponsored Links |
|
10-30-2008, 10:35 AM
|
#2 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Hello -
I don't think you read the pre-posting instructions which koala linked you to completely. http://www.techsupportforum.com/secu...oval-help.html Quote:
Once you've done so, run RSIT once again, using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "C:\Documents and Settings\ir8clan\Desktop\RSIT.exe" /infoClick on Continue. Post the two logs produced.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. |
|
|
|
|
|
10-30-2008, 11:45 AM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
this is the fixed information
please help me with this problem Logfile of random's system information tool 1.04 (written by random/random) Run by ir8clan at 2008-12-30 12:56:44 Microsoft Windows XP Professional Service Pack 2 System drive C: has 79 GB (85%) free of 92 GB Total RAM: 959 MB (43% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:56:51, on 12/30/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\ir8clan\Desktop\RSIT.exe C:\Program Files\trend micro\ir8clan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [asus32] "C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 10416 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\SpywareStop Scheduled Scan.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}] IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2008-02-18 99760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B9F5787-88A5-4945-90E7-C4B18563BC5E}] CKeyScramblerBHO Object - C:\Program Files\KeyScrambler\KeyScramblerIE.dll [2008-12-28 812520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-12-15 308856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-01 455960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-09-04 2055960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - MSN Toolbar - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll [2008-06-03 86032] {A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-09-04 2055960] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-05-04 16206848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-04-24 1448960] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-02-01 8523776] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-02-01 81920] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "Super Screen Capture"=C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe [2006-06-02 3126784] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-29 1234712] "avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-12-15 185896] "SpyHunter Security Suite"=C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [2008-09-10 864256] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360] "Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704] "IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2008-01-23 2577840] "DW6"=C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe [2008-06-10 785520] "asus32"=C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe [2008-12-28 98304] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe C:\Documents and Settings\ir8clan\Start Menu\Programs\Startup LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="avgrsstx.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e052900-276a-11dd-84b8-0040452c13e8}] shell\AutoRun\command - E:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85bd0d0-60db-11dd-84ef-0013d380508d}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe shell\Open(&0)\command - Recycled\ctfmon.exe ======File associations====== .txt - open - Notepad.exe %1 ======List of files/folders created in the last 1 months====== 2008-12-30 12:56:44 ----D---- C:\rsit 2008-12-30 12:39:35 ----D---- C:\WINDOWS\temp 2008-12-30 12:39:34 ----A---- C:\ComboFix.txt 2008-12-30 12:35:44 ----A---- C:\Boot.bak 2008-12-30 12:35:34 ----RASHD---- C:\cmdcons 2008-12-30 12:34:27 ----A---- C:\WINDOWS\zip.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\VFIND.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\SWSC.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\SWREG.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\sed.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\NIRCMD.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\grep.exe 2008-12-30 12:34:27 ----A---- C:\WINDOWS\fdsv.exe 2008-12-30 12:34:05 ----D---- C:\WINDOWS\ERDNT 2008-12-30 12:34:05 ----D---- C:\Qoobox 2008-12-30 12:29:27 ----D---- C:\Program Files\Spybot - Search & Destroy 2008-12-30 12:29:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-29 22:27:41 ----D---- C:\Program Files\trend micro 2008-12-29 21:45:08 ----A---- C:\WINDOWS\gmer.ini 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer.exe 2008-12-29 21:45:04 ----A---- C:\WINDOWS\gmer.dll 2008-12-28 21:42:54 ----D---- C:\Program Files\Enigma Software Group 2008-12-28 21:21:25 ----D---- C:\Program Files\CCleaner 2008-12-28 19:45:34 ----D---- C:\Program Files\KeyScrambler 2008-12-28 19:05:45 ----A---- C:\IPAddr.txt 2008-12-28 19:05:16 ----A---- C:\phyaddr.txt 2008-12-28 18:54:53 ----A---- C:\ipconfig.txt 2008-12-28 17:44:21 ----D---- C:\Documents and Settings\ir8clan\Application Data\Google 2008-12-28 09:13:50 ----D---- C:\Program Files\ImTOO 2008-12-27 10:19:00 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-12-15 17:17:04 ----D---- C:\Program Files\Common Files\xing shared 2008-12-15 03:15:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-12-15 03:15:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-12-15 03:14:37 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-12-15 03:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-12-15 03:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-12-15 03:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$ 2008-12-15 02:17:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-12-15 01:59:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Malwarebytes 2008-12-15 01:59:09 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-12-15 00:19:53 ----D---- C:\Program Files\Avira 2008-12-15 00:11:10 ----D---- C:\WINDOWS\system32\appmgmt 2008-12-13 21:55:16 ----D---- C:\Documents and Settings\ir8clan\Application Data\skypePM 2008-12-13 21:49:51 ----D---- C:\Documents and Settings\All Users\Application Data\Skype ======List of files/folders modified in the last 1 months====== 2008-12-30 12:39:54 ----D---- C:\Program Files\Mozilla Firefox 2008-12-30 12:39:38 ----D---- C:\WINDOWS\system32\drivers 2008-12-30 12:39:38 ----D---- C:\WINDOWS\system32 2008-12-30 12:39:35 ----D---- C:\WINDOWS 2008-12-30 12:39:34 ----D---- C:\WINDOWS\Prefetch 2008-12-30 12:38:05 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-30 12:37:14 ----D---- C:\Documents and Settings\ir8clan\Application Data\DMCache 2008-12-30 12:37:14 ----A---- C:\WINDOWS\system.ini 2008-12-30 12:35:44 ----RASH---- C:\boot.ini 2008-12-30 12:34:46 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-30 12:29:27 ----RD---- C:\Program Files 2008-12-30 08:48:21 ----D---- C:\Documents and Settings\ir8clan\Application Data\LimeWire 2008-12-29 22:41:39 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-12-29 16:37:12 ----D---- C:\Program Files\Bkav2006 2008-12-29 12:21:28 ----HD---- C:\$AVG8.VAULT$ 2008-12-28 23:25:10 ----SD---- C:\WINDOWS\Tasks 2008-12-28 23:12:49 ----D---- C:\Downloads 2008-12-28 22:51:10 ----D---- C:\Documents and Settings\ir8clan\Application Data\Yahoo! 2008-12-28 22:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\SpywareStop 2008-12-28 22:14:07 ----A---- C:\WINDOWS\NeroDigital.ini 2008-12-28 21:32:29 ----D---- C:\WINDOWS\Debug 2008-12-28 18:37:48 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\AVGTOOLBAR 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Ahead 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\AdobeUM 2008-12-28 17:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adobe 2008-12-28 17:45:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adblock Pro 2008-12-27 10:19:16 ----HD---- C:\WINDOWS\inf 2008-12-27 10:19:04 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-27 10:17:08 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-15 17:17:04 ----D---- C:\Program Files\Common Files 2008-12-15 17:16:53 ----D---- C:\Program Files\Common Files\Real 2008-12-15 17:16:45 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2008-12-15 17:16:30 ----A---- C:\WINDOWS\system32\pndx5032.dll 2008-12-15 17:16:30 ----A---- C:\WINDOWS\system32\pndx5016.dll 2008-12-15 17:16:20 ----A---- C:\WINDOWS\system32\msvcr71.dll 2008-12-15 17:16:20 ----A---- C:\WINDOWS\system32\msvcp71.dll 2008-12-15 17:16:19 ----A---- C:\WINDOWS\system32\pncrt.dll 2008-12-15 03:05:11 ----D---- C:\Program Files\Internet Explorer 2008-12-15 02:01:50 ----A---- C:\YServer.txt 2008-12-15 00:19:53 ----D---- C:\Documents and Settings\All Users\Application Data\Avira 2008-12-15 00:11:09 ----SHD---- C:\WINDOWS\Installer 2008-12-15 00:00:52 ----D---- C:\Documents and Settings\ir8clan\Application Data\IDM ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [] R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-01 97928] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-09-04 26824] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-06-27 75072] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352] R1 SysLib;SysLib; C:\WINDOWS\system32\drivers\SysLib.sys [2008-12-29 15979350] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-12 20747] R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [] R3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-12-29 85969] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-04 4271616] R3 KeyScrambler;KeyScrambler; C:\WINDOWS\System32\drivers\keyscrambler.sys [2008-06-24 113896] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-02-01 7434720] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136] R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera; C:\WINDOWS\System32\Drivers\ubVeo532.sys [2002-07-01 95232] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 NtApm;NT Apm/Legacy Interface Driver; C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 9344] S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 ACPI;ACPI; C:\WINDOWS\system32\drivers\ACPI.sys [] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-12-26 68865] R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-12-26 151297] R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-01 231704] R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-20 168432] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-02-01 155716] R2 O2Flash;O2Micro Flash Memory; C:\WINDOWS\system32\o2flash.exe [2006-08-15 36864] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-03 14336] -----------------EOF----------------- |
|
|
|
|
10-30-2008, 12:02 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Hello -
Those logs don't look any different. I still see Avira and AVG, and I still see Limewire installed. Did you perform those uninstalls? Something else I noticed...the machine's date seems to be off by two months. 2008-12-30 In my time zone, today is October 30 Please reset your clock, perform the uninstalls, and post these logs. Run HijackThis C:\Program Files\trend micro\HijackThis.exe click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. Create an uninstall list: With HiJackThis still open
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
10-31-2008, 11:33 AM
|
#5 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
sorry, this is the fixed information
Logfile of random's system information tool 1.04 (written by random/random) Run by ir8clan at 2008-10-31 13:41:49 Microsoft Windows XP Professional Service Pack 2 System drive C: has 79 GB (86%) free of 92 GB Total RAM: 959 MB (44% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:41:49, on 10/31/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Documents and Settings\ir8clan\Desktop\RSIT.exe C:\Program Files\trend micro\ir8clan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [asus32] "C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 9496 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\SpywareStop Scheduled Scan.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}] IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2008-02-18 99760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B9F5787-88A5-4945-90E7-C4B18563BC5E}] CKeyScramblerBHO Object - C:\Program Files\KeyScrambler\KeyScramblerIE.dll [2008-12-28 812520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-12-15 308856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - MSN Toolbar - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll [2008-06-03 86032] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-05-04 16206848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-04-24 1448960] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-02-01 8523776] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-02-01 81920] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "Super Screen Capture"=C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe [2006-06-02 3126784] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-12-15 185896] "SpyHunter Security Suite"=C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [] "KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k [] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360] "Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704] "IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2008-01-23 2577840] "DW6"=C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe [2008-06-10 785520] "asus32"=C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe [2008-12-28 98304] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e052900-276a-11dd-84b8-0040452c13e8}] shell\AutoRun\command - E:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85bd0d0-60db-11dd-84ef-0013d380508d}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe shell\Open(&0)\command - Recycled\ctfmon.exe ======File associations====== .txt - open - Notepad.exe %1 ======List of files/folders created in the last 1 months====== 2008-12-30 15:18:53 ----D---- C:\WINDOWS\Minidump 2008-12-30 13:57:57 ----SHD---- C:\RECYCLER 2008-12-30 13:39:35 ----D---- C:\WINDOWS\temp 2008-12-30 13:39:34 ----A---- C:\ComboFix.txt 2008-12-30 13:35:44 ----A---- C:\Boot.bak 2008-12-30 13:35:34 ----RASHD---- C:\cmdcons 2008-12-30 13:34:27 ----A---- C:\WINDOWS\zip.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\VFIND.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\SWSC.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\SWREG.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\sed.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\NIRCMD.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\grep.exe 2008-12-30 13:34:27 ----A---- C:\WINDOWS\fdsv.exe 2008-12-30 13:34:05 ----D---- C:\WINDOWS\ERDNT 2008-12-30 13:34:05 ----D---- C:\Qoobox 2008-12-30 13:29:27 ----D---- C:\Program Files\Spybot - Search & Destroy 2008-12-30 13:29:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-29 23:27:41 ----D---- C:\Program Files\trend micro 2008-12-29 22:45:08 ----A---- C:\WINDOWS\gmer.ini 2008-12-29 22:45:04 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2008-12-29 22:45:04 ----A---- C:\WINDOWS\gmer.exe 2008-12-29 22:45:04 ----A---- C:\WINDOWS\gmer.dll 2008-12-28 22:42:54 ----D---- C:\Program Files\Enigma Software Group 2008-12-28 22:21:25 ----D---- C:\Program Files\CCleaner 2008-12-28 20:45:34 ----D---- C:\Program Files\KeyScrambler 2008-12-28 20:05:45 ----A---- C:\IPAddr.txt 2008-12-28 20:05:16 ----A---- C:\phyaddr.txt 2008-12-28 19:54:53 ----A---- C:\ipconfig.txt 2008-12-28 18:44:21 ----D---- C:\Documents and Settings\ir8clan\Application Data\Google 2008-12-28 10:13:50 ----D---- C:\Program Files\ImTOO 2008-12-27 11:19:00 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-12-15 18:17:04 ----D---- C:\Program Files\Common Files\xing shared 2008-12-15 04:15:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-12-15 04:15:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-12-15 04:14:37 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-12-15 04:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-12-15 04:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-12-15 04:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$ 2008-12-15 03:17:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-12-15 02:59:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Malwarebytes 2008-12-15 02:59:09 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-12-15 01:11:10 ----D---- C:\WINDOWS\system32\appmgmt 2008-12-13 22:55:16 ----D---- C:\Documents and Settings\ir8clan\Application Data\skypePM 2008-12-13 22:49:51 ----D---- C:\Documents and Settings\All Users\Application Data\Skype 2008-11-23 23:38:23 ----D---- C:\Program Files\Samsung 2008-11-11 09:37:31 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-11-11 09:35:50 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$ 2008-11-03 12:18:16 ----N---- C:\WINDOWS\Setup1.exe 2008-11-03 12:18:15 ----A---- C:\WINDOWS\ST6UNST.EXE 2008-11-03 12:15:00 ----A---- C:\WINDOWS\IsUninst.exe 2008-10-31 13:41:49 ----D---- C:\rsit 2008-10-28 16:57:08 ----D---- C:\WINDOWS\system32\CatRoot_bak 2008-10-15 19  15 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$2008-10-15 19:05:58 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2008-10-15 19:05:43 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$ 2008-10-15 19:05:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2008-10-15 19:05:10 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$ 2008-10-15 19:04:51 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2008-10-15 19:04:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2008-10-15 19:03:52 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$ 2008-10-05 18 09 ----D---- C:\Mp3 Output2008-10-05 18 04 ----D---- C:\Program Files\Smallvideosoft2008-10-05 18 04 ----A---- C:\WINDOWS\system32\xvidcore.dll2008-10-05 18 04 ----A---- C:\WINDOWS\system32\NCMedia.dll2008-10-05 18 04 ----A---- C:\WINDOWS\system32\libmp3lame-0.dll2008-10-05 02:05:39 ----D---- C:\Documents and Settings\ir8clan\Application Data\AVS4YOU 2008-10-05 02:05:13 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU 2008-10-05 02:02:17 ----D---- C:\Program Files\Common Files\AVSMedia 2008-10-05 02:02:11 ----A---- C:\WINDOWS\system32\msvcp70.dll 2008-10-05 02:02:11 ----A---- C:\WINDOWS\system32\mfc70.dll 2008-10-05 02:02:10 ----D---- C:\Program Files\AVS4YOU 2008-10-05 02:02:10 ----A---- C:\WINDOWS\system32\msxml3a.dll 2008-10-05 02:02:10 ----A---- C:\WINDOWS\system32\msvcr70.dll 2008-10-05 02:02:10 ----A---- C:\WINDOWS\system32\GdiPlus.dll ======List of files/folders modified in the last 1 months====== 2008-12-31 13:31:49 ----D---- C:\Program Files\Mozilla Firefox 2008-12-31 13:29:49 ----D---- C:\Documents and Settings\ir8clan\Application Data\DMCache 2008-12-31 13:29:04 ----D---- C:\WINDOWS\system32 2008-12-31 13:28:29 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-31 13:28:14 ----D---- C:\WINDOWS\system32\drivers 2008-12-31 13:28:14 ----D---- C:\WINDOWS 2008-12-31 13:28:13 ----D---- C:\Documents and Settings\All Users\Application Data\avg8 2008-12-31 13:27:16 ----SD---- C:\Documents and Settings\ir8clan\Application Data\Microsoft 2008-12-31 13:23:45 ----RD---- C:\Program Files 2008-12-31 12:24:01 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-12-31 12:19:55 ----D---- C:\Documents and Settings\ir8clan\Application Data\LimeWire 2008-12-30 13:39:34 ----D---- C:\WINDOWS\Prefetch 2008-12-30 13:38:05 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-30 13:37:14 ----A---- C:\WINDOWS\system.ini 2008-12-30 13:35:44 ----RASH---- C:\boot.ini 2008-12-29 17:37:12 ----D---- C:\Program Files\Bkav2006 2008-12-29 00:25:10 ----SD---- C:\WINDOWS\Tasks 2008-12-29 00:12:49 ----D---- C:\Downloads 2008-12-28 23:51:10 ----D---- C:\Documents and Settings\ir8clan\Application Data\Yahoo! 2008-12-28 23:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\SpywareStop 2008-12-28 23:14:07 ----A---- C:\WINDOWS\NeroDigital.ini 2008-12-28 22:32:29 ----D---- C:\WINDOWS\Debug 2008-12-28 19:37:48 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-12-28 18:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Ahead 2008-12-28 18:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\AdobeUM 2008-12-28 18:45:23 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adobe 2008-12-28 18:45:22 ----D---- C:\Documents and Settings\ir8clan\Application Data\Adblock Pro 2008-12-27 11:19:16 ----HD---- C:\WINDOWS\inf 2008-12-27 11:19:04 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-27 11:17:08 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-15 18:17:04 ----D---- C:\Program Files\Common Files 2008-12-15 18:16:53 ----D---- C:\Program Files\Common Files\Real 2008-12-15 18:16:45 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2008-12-15 18:16:30 ----A---- C:\WINDOWS\system32\pndx5032.dll 2008-12-15 18:16:30 ----A---- C:\WINDOWS\system32\pndx5016.dll 2008-12-15 18:16:20 ----A---- C:\WINDOWS\system32\msvcr71.dll 2008-12-15 18:16:20 ----A---- C:\WINDOWS\system32\msvcp71.dll 2008-12-15 18:16:19 ----A---- C:\WINDOWS\system32\pncrt.dll 2008-12-15 04:05:11 ----D---- C:\Program Files\Internet Explorer 2008-12-15 03:01:50 ----A---- C:\YServer.txt 2008-12-15 01:11:09 ----SHD---- C:\WINDOWS\Installer 2008-12-15 01:00:52 ----D---- C:\Documents and Settings\ir8clan\Application Data\IDM 2008-11-28 19:08:06 ----HD---- C:\Program Files\InstallShield Installation Information 2008-11-11 09:37:32 ----D---- C:\WINDOWS\WinSxS 2008-11-02 17:30:03 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-10-28 17:35:53 ----D---- C:\WINDOWS\system32\CatRoot 2008-10-28 16:52:03 ----D---- C:\WINDOWS\Help 2008-10-18 02:19:00 ----D---- C:\Documents and Settings\All Users\Application Data\Google 2008-10-15 22:22:35 ----A---- C:\WINDOWS\PhotoSnapViewer.INI 2008-10-15 19 00 ----D---- C:\Program Files\Messenger2008-10-15 09:57:55 ----A---- C:\WINDOWS\system32\netapi32.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 SysLib;SysLib; C:\WINDOWS\system32\drivers\SysLib.sys [2008-12-29 15979350] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-12 20747] R3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-12-29 85969] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-04 4271616] R3 KeyScrambler;KeyScrambler; C:\WINDOWS\System32\drivers\keyscrambler.sys [2008-06-24 113896] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-02-01 7434720] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136] R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera; C:\WINDOWS\System32\Drivers\ubVeo532.sys [2002-07-01 95232] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 NtApm;NT Apm/Legacy Interface Driver; C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 9344] S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 ACPI;ACPI; C:\WINDOWS\system32\drivers\ACPI.sys [] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-20 168432] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-02-01 155716] R2 O2Flash;O2Micro Flash Memory; C:\WINDOWS\system32\o2flash.exe [2006-08-15 36864] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-03 14336] -----------------EOF----------------- |
|
|
|
|
10-31-2008, 11:48 AM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Hello -
We seem to be having troubles with communication and understanding. You've not provided the logs I've asked for in my last post, and now you have NO antivirus installed?? Both Avira and AVG have been uninstalled? Only one was to be uninstalled. Please reinstall one or the other, but not both. Of the two, I would use Avira. You must follow my directions exactly if we're to successfully work together in this medium. If you have questions, Ask first. It also appears as though you've run ComboFix without my asking you to. Please delete ComboFix.exe if you still have it. Post C:\ComboFix.txt Also post a new HijackThis log, (NOT a log from RSIT, as I mentioned in my last post) Run HijackThis C:\Program Files\trend micro\HijackThis.exe click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
10-31-2008, 12:13 PM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
i am so sorry, cause English is my second language. i am so sorry about that. this is the hijack that you asked.
and i already installed Avira. i also attached the other two files in case you want to see and about the combofix. i can not find it in my computer Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:16:41, on 10/31/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Documents and Settings\ir8clan\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [asus32] "C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 10147 bytes |
|
|
|
|
10-31-2008, 12:29 PM
|
#8 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
and this is the uninstalled list
Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Reader 8.1.2 Avira AntiVir Personal - Free Antivirus AX SUMMER 08 Screen Saver Bach Khoa Antivirus 2006 CCleaner (remove only) DivX Web Player FlashGet 1.81 FLV Player 2.0, build 24 Freez FLV to MP3 Converter Google Photos Screensaver Google Updater High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB935448) Hotfix for Windows XP (KB952287) Internet Download Manager Java(TM) 6 Update 4 Java(TM) 6 Update 5 Java(TM) 6 Update 7 KeyScrambler Malwarebytes' Anti-Malware Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.0.3) MSN Toolbar MSXML 4.0 SP2 (KB936181) Nero 7 Lite v7.5.1.1 Nero 7 Ultra Edition neroxml NVIDIA Drivers O2Micro Flash Memory Card Windows Driver V2.05 OpenOffice.org Installer 1.0 PhotoFiltre Ralink Wireless LAN Card Ralink Wireless LAN Card RealPlayer Realtek High Definition Audio Driver Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB958644) Spybot - Search & Destroy SpyHunter SpywareStop Super Screen Capture 2.5 System Requirements Lab TBS WMP Plug-in The Weather Channel Desktop 6 UniKey 4.0 NT Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB951072-v2) VideoLAN VLC media player 0.8.6e Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver Yahoo! ¤u¨ã¦C Yahoo! Browser Services Yahoo! Install Manager Yahoo! Internet Mail Yahoo! Messenger YP-MT6 |
|
|
|
|
10-31-2008, 01:04 PM
|
#9 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Good, now we're making progress. Let's see about removing the malware now.
It's very important that you do exactly as I ask, and only provide the information I request. If you have questions, please ask them before acting. I'll be glad to clarify if it's needed. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- ComboFix is updated frequently. This latest version will address the infection you have. If ComboFix.exe is present still, delete your existing version. Next....
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-01-2008, 09:15 AM
|
#10 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
this is the log of combofix and hijack
ComboFix 08-10-31.02 - ir8clan 2008-11-01 11:14:40.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.513 [GMT -7:00] Running from: C:\Documents and Settings\ir8clan\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\ir8clan\Application Data\Google\fwldpl.dll C:\Documents and Settings\ir8clan\Application Data\Google\mupd1_2_1165664.exe C:\Documents and Settings\ir8clan\Start Menu\Programs\Bach Khoa Antivirus C:\Documents and Settings\ir8clan\Start Menu\Programs\Bach Khoa Antivirus\Bkav2006.lnk C:\Documents and Settings\ir8clan\Start Menu\Programs\Bach Khoa Antivirus\UnInstall Bkav2006.lnk C:\Program Files\Bkav2006 C:\Program Files\Bkav2006\Backup\BootC.dat C:\Program Files\Bkav2006\BKAV.LOG C:\Program Files\Bkav2006\Bkav2006.exe C:\Program Files\Bkav2006\Bkav2006.lnk C:\Program Files\Bkav2006\BKAVE.LOG C:\Program Files\Bkav2006\ContextMenu.dll C:\Program Files\Bkav2006\Help\bkav.css C:\Program Files\Bkav2006\Help\chitiet.htm C:\Program Files\Bkav2006\Help\chitiete.htm C:\Program Files\Bkav2006\Help\HelpBanquyen.htm C:\Program Files\Bkav2006\Help\Helpbtg.htm C:\Program Files\Bkav2006\Help\Helpdiet.htm C:\Program Files\Bkav2006\Help\HelpGth.htm C:\Program Files\Bkav2006\Help\HelpLiqu.htm C:\Program Files\Bkav2006\Help\HelpLiveUpdate.htm C:\Program Files\Bkav2006\Help\Helpnhki.htm C:\Program Files\Bkav2006\Help\Helpnhl.htm C:\Program Files\Bkav2006\Help\HelpOpt.htm C:\Program Files\Bkav2006\Help\HelpVrls.htm C:\Program Files\Bkav2006\Help\images\arrow.gif C:\Program Files\Bkav2006\Help\images\DangKy.gif C:\Program Files\Bkav2006\UnInstall Bkav2006.lnk C:\WINDOWS\Fonts\Vn.Fon C:\WINDOWS\system32\BkavAuto.vxd C:\WINDOWS\system32\drivers\BkavAuto.sys C:\WINDOWS\system32\drivers\SysLib.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BKAVAUTO -------\Legacy_SYSLIB -------\Service_BkavAuto -------\Service_SysLib ((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 ))))))))))))))))))))))))))))))) . 2008-12-30 13:29 . 2008-12-30 13:29 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-12-30 13:29 . 2008-12-30 13:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-29 23:27 . 2008-10-31 13:41 <DIR> d-------- C:\Program Files\trend micro 2008-12-29 22:45 . 2008-10-31 14:17 250 --a------ C:\WINDOWS\gmer.ini 2008-12-28 22:42 . 2008-12-28 23:28 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-12-28 22:21 . 2008-12-28 22:21 <DIR> d-------- C:\Program Files\CCleaner 2008-12-28 20:45 . 2008-12-28 20:45 <DIR> d-------- C:\Program Files\KeyScrambler 2008-12-28 20:45 . 2008-06-24 10:45 113,896 --a------ C:\WINDOWS\system32\drivers\keyscrambler.sys 2008-12-28 10:13 . 2008-12-28 10:13 <DIR> d-------- C:\Program Files\ImTOO 2008-12-15 18:17 . 2008-12-15 18:17 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-12-15 03:17 . 2008-12-29 18:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-12-15 03:17 . 2008-10-22 17:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-12-15 03:17 . 2008-10-22 17:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-12-15 02:59 . 2008-12-15 02:59 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\Malwarebytes 2008-12-15 02:59 . 2008-12-15 02:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-12-13 22:55 . 2008-12-15 01:08 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\skypePM 2008-12-13 22:55 . 2008-12-13 22:55 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-12-13 22:49 . 2008-12-15 01:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype 2008-11-23 23:38 . 2008-11-23 23:38 <DIR> d-------- C:\Program Files\Samsung 2008-11-23 23:38 . 2004-11-02 18:01 68,222 --------- C:\WINDOWS\system32\drivers\StMp3Rec.sys 2008-11-03 12:18 . 2008-11-03 12:18 249,856 --------- C:\WINDOWS\Setup1.exe 2008-11-03 12:18 . 2008-11-03 12:18 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-11-03 12:15 . 1997-12-17 19:33 304,128 --a------ C:\WINDOWS\IsUninst.exe 2008-11-03 12:14 . 2008-11-03 12:14 <DIR> d-------- C:\Documents and Settings\ir8clan\WINDOWS 2008-10-31 14:24 . 2008-10-31 14:24 <DIR> d-------- C:\rsit 2008-10-31 14:10 . 2008-10-31 14:10 <DIR> d-------- C:\Program Files\Avira 2008-10-31 14:10 . 2008-10-31 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-10-28 16:57 . 2008-10-28 17:34 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-05 18:06 . 2008-10-05 18:06 <DIR> d-------- C:\Program Files\Smallvideosoft 2008-10-05 18:06 . 2008-10-05 18:06 <DIR> d-------- C:\Mp3 Output 2008-10-05 18:06 . 2007-03-01 04:18 4,762,112 --a------ C:\WINDOWS\system32\NCMedia.dll 2008-10-05 18:06 . 2006-11-01 14:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-10-05 18:06 . 2007-02-25 15:36 383,238 --a------ C:\WINDOWS\system32\libmp3lame-0.dll 2008-10-05 02:05 . 2008-10-05 02:05 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\AVS4YOU 2008-10-05 02:05 . 2008-10-05 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU 2008-10-05 02:02 . 2008-10-05 18:05 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2008-10-05 02:02 . 2008-10-05 18:05 <DIR> d-------- C:\Program Files\AVS4YOU 2008-10-05 02:02 . 2007-02-27 19:36 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2008-10-05 02:02 . 2007-02-27 19:36 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2008-10-05 02:02 . 2007-02-27 19:36 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2008-10-05 02:02 . 2007-02-27 19:36 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-10-05 02:02 . 2007-02-27 19:36 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-31 20:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-12-31 19:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-12-31 19:19 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\LimeWire 2008-12-29 06:51 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Yahoo! 2008-12-29 06:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\SpywareStop 2008-12-29 02:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Ahead 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\AdobeUM 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Adblock Pro 2008-12-16 01:16 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-12-16 01:16 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-12-16 01:16 --------- d-----w C:\Program Files\Common Files\Real 2008-12-15 08:00 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\IDM 2008-11-29 02:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-11-01 18:20 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\DMCache 2008-09-26 03:56 --------- d-----w C:\Program Files\Sun 2008-09-26 03:56 --------- d-----w C:\Program Files\Java 2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-06 17:54 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Uniblue 2008-09-01 00:55 --------- d-----w C:\Program Files\AVG 2008-08-20 05:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 10:00 2,180,352 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:22 2,057,728 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( snapshot@2008-12-30_12.38.24.54 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-21 04:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE - 2000-08-31 16:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe + 2000-08-31 15:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe - 2000-08-31 16:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe + 2000-08-31 15:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe - 2008-05-09 21:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys + 2008-05-09 20:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys - 2008-01-22 02:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2008-01-22 01:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys - 2008-06-27 23:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2008-06-27 22:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys - 2007-03-01 18:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys + 2007-03-01 17:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys - 2008-11-03 00:30:03 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-11-01 17:57:23 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-11-03 00:30:03 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-11-01 17:57:23 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704] "IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-01-23 2577840] "DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-02-01 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-02-01 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Super Screen Capture"="C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe" [2006-06-02 3126784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-12-15 185896] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RTHDCPL"="RTHDCPL.EXE" [2006-05-04 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-04-24 C:\WINDOWS\SkyTel.exe] "nwiz"="nwiz.exe" [2008-02-01 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "KeyScrambler"="C:\Program Files\KeyScrambler\getting_started.html" [X] "RealUpgradeHelper"="C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-12-15 136768] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2008-03-12 589824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-08-15 34880] R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2006-08-15 29056] R3 KeyScrambler;KeyScrambler;C:\WINDOWS\system32\drivers\keyscrambler.sys [2008-06-24 113896] S0 spywarestop;spywarestop;C:\WINDOWS\system32\DRIVERS\spywarestop.sys [ ] S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera;C:\WINDOWS\system32\Drivers\ubVeo532.sys [2002-07-01 95232] S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 9344] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e052900-276a-11dd-84b8-0040452c13e8}] \Shell\AutoRun\command - E:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85bd0d0-60db-11dd-84ef-0013d380508d}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . Contents of the 'Scheduled Tasks' folder 2008-12-29 C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job - C:\Program Files\SpywareStop\SpywareStop.exe [] 2008-12-29 C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job - C:\Program Files\SpywareStop [] . - - - - ORPHANS REMOVED - - - - HKLM-Run-SpyHunter Security Suite - C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\ir8clan\Application Data\Mozilla\Firefox\Profiles\duxj8j4y.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/ FF -: plugin - C:\Program Files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 11:18:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Zeallsoft\Super Screen Capture\zHook.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-11-01 11:23:37 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-01 18:23:19 ComboFix2.txt 2008-12-30 20:39:34 Pre-Run: 82,910,134,272 bytes free Post-Run: 82,831,622,144 bytes free 241 --- E O F --- 2008-12-27 18:19:17 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:27:28, on 11/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\ir8clan\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 9454 bytes |
|
|
|
|
11-01-2008, 09:41 AM
|
#11 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Good job. Things are looking better.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: Java(TM) 6 Update 4 Java(TM) 6 Update 5 These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall previous version when you update, nor tell you that you should. Leave Java(TM) 6 Update 7 alone, as it has the most recent security updates. Also Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add or Remove Programs) if they exist: SpywareStop This program is rogueware. Rogue or Suspect means that these products are of unknown, questionable, or dubious value as anti-spyware protection. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
|
11-01-2008, 10:23 AM
|
#12 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
i tried to uninstall spyware stop on control panel but it did not allow me to do that. it said that it dose not have enough files to run the uninstall
the following is the log that you asked ComboFix 08-10-31.02 - ir8clan 2008-11-01 12:03:48.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.492 [GMT -7:00] Running from: C:\Documents and Settings\ir8clan\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\ir8clan\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\DRIVERS\spywarestop.sys C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\avg8 C:\Documents and Settings\All Users\Application Data\avg8\dumps\avgtray.exe_128652002771787200.dmp C:\Documents and Settings\ir8clan\Application Data\LimeWire C:\Documents and Settings\ir8clan\Application Data\LimeWire\active.mojito C:\Documents and Settings\ir8clan\Application Data\LimeWire\createtimes.cache C:\Documents and Settings\ir8clan\Application Data\LimeWire\fileurns.bak C:\Documents and Settings\ir8clan\Application Data\LimeWire\fileurns.cache C:\Documents and Settings\ir8clan\Application Data\LimeWire\filters.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\gnutella.net C:\Documents and Settings\ir8clan\Application Data\LimeWire\installation.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\library.dat C:\Documents and Settings\ir8clan\Application Data\LimeWire\limewire.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\mojito.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\passive.mojito C:\Documents and Settings\ir8clan\Application Data\LimeWire\questions.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\responses.cache C:\Documents and Settings\ir8clan\Application Data\LimeWire\simpp.xml C:\Documents and Settings\ir8clan\Application Data\LimeWire\spam.dat C:\Documents and Settings\ir8clan\Application Data\LimeWire\tables.props C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme.lwtp C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\01_star.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\02_star.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\03_star.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\04_star.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\05_star.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\chat.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\forward_dn.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\forward_up.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\kill.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\kill_on.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\logo.png C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\notsearching.png C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\pause_dn.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\pause_up.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\play_dn.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\play_up.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\question.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\rewind_up.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\searching.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\stop_dn.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\stop_up.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\theme.txt C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\version.txt C:\Documents and Settings\ir8clan\Application Data\LimeWire\themes\windows_theme\warning.gif C:\Documents and Settings\ir8clan\Application Data\LimeWire\ttrees.cache C:\Documents and Settings\ir8clan\Application Data\LimeWire\ttroot.cache C:\Documents and Settings\ir8clan\Application Data\LimeWire\version.xml C:\Documents and Settings\ir8clan\Application Data\LimeWire\xml\data\audio.sxml C:\Documents and Settings\ir8clan\Application Data\SpywareStop C:\Documents and Settings\ir8clan\Application Data\SpywareStop\fp.dat C:\Documents and Settings\ir8clan\Application Data\SpywareStop\Log\2008 Dec 28 - 06_32_53 PM_001.log C:\Documents and Settings\ir8clan\Application Data\SpywareStop\Log\2008 Dec 28 - 07_48_32 PM_067.log C:\Documents and Settings\ir8clan\Application Data\SpywareStop\Log\2008 Dec 28 - 09_48_12 PM_814.log C:\Documents and Settings\ir8clan\Application Data\SpywareStop\Log\2008 Dec 28 - 10_44_23 PM_741.log C:\Documents and Settings\ir8clan\Application Data\SpywareStop\rs.dat C:\Program Files\AVG C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SPYWARESTOP -------\Service_spywarestop ((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 ))))))))))))))))))))))))))))))) . 2008-12-30 13:29 . 2008-12-30 13:29 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-12-30 13:29 . 2008-12-30 13:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-29 23:27 . 2008-10-31 13:41 <DIR> d-------- C:\Program Files\trend micro 2008-12-29 22:45 . 2008-10-31 14:17 250 --a------ C:\WINDOWS\gmer.ini 2008-12-28 22:42 . 2008-12-28 23:28 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-12-28 22:21 . 2008-12-28 22:21 <DIR> d-------- C:\Program Files\CCleaner 2008-12-28 20:45 . 2008-12-28 20:45 <DIR> d-------- C:\Program Files\KeyScrambler 2008-12-28 20:45 . 2008-06-24 10:45 113,896 --a------ C:\WINDOWS\system32\drivers\keyscrambler.sys 2008-12-28 10:13 . 2008-12-28 10:13 <DIR> d-------- C:\Program Files\ImTOO 2008-12-15 18:17 . 2008-12-15 18:17 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-12-15 03:17 . 2008-12-29 18:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-12-15 03:17 . 2008-10-22 17:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-12-15 03:17 . 2008-10-22 17:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-12-15 02:59 . 2008-12-15 02:59 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\Malwarebytes 2008-12-15 02:59 . 2008-12-15 02:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-12-13 22:55 . 2008-12-15 01:08 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\skypePM 2008-12-13 22:55 . 2008-12-13 22:55 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-12-13 22:49 . 2008-12-15 01:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype 2008-11-23 23:38 . 2008-11-23 23:38 <DIR> d-------- C:\Program Files\Samsung 2008-11-23 23:38 . 2004-11-02 18:01 68,222 --------- C:\WINDOWS\system32\drivers\StMp3Rec.sys 2008-11-03 12:18 . 2008-11-03 12:18 249,856 --------- C:\WINDOWS\Setup1.exe 2008-11-03 12:18 . 2008-11-03 12:18 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-11-03 12:15 . 1997-12-17 19:33 304,128 --a------ C:\WINDOWS\IsUninst.exe 2008-11-03 12:14 . 2008-11-03 12:14 <DIR> d-------- C:\Documents and Settings\ir8clan\WINDOWS 2008-10-31 14:24 . 2008-10-31 14:24 <DIR> d-------- C:\rsit 2008-10-31 14:10 . 2008-10-31 14:10 <DIR> d-------- C:\Program Files\Avira 2008-10-31 14:10 . 2008-10-31 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-10-28 16:57 . 2008-10-28 17:34 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-05 18:06 . 2008-10-05 18:06 <DIR> d-------- C:\Program Files\Smallvideosoft 2008-10-05 18:06 . 2008-10-05 18:06 <DIR> d-------- C:\Mp3 Output 2008-10-05 18:06 . 2007-03-01 04:18 4,762,112 --a------ C:\WINDOWS\system32\NCMedia.dll 2008-10-05 18:06 . 2006-11-01 14:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-10-05 18:06 . 2007-02-25 15:36 383,238 --a------ C:\WINDOWS\system32\libmp3lame-0.dll 2008-10-05 02:05 . 2008-10-05 02:05 <DIR> d-------- C:\Documents and Settings\ir8clan\Application Data\AVS4YOU 2008-10-05 02:05 . 2008-10-05 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU 2008-10-05 02:02 . 2008-10-05 18:05 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2008-10-05 02:02 . 2008-10-05 18:05 <DIR> d-------- C:\Program Files\AVS4YOU 2008-10-05 02:02 . 2007-02-27 19:36 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2008-10-05 02:02 . 2007-02-27 19:36 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2008-10-05 02:02 . 2007-02-27 19:36 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2008-10-05 02:02 . 2007-02-27 19:36 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-10-05 02:02 . 2007-02-27 19:36 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-31 19:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-12-29 06:51 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Yahoo! 2008-12-29 02:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Ahead 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\AdobeUM 2008-12-29 01:45 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Adblock Pro 2008-12-16 01:16 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-12-16 01:16 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-12-16 01:16 --------- d-----w C:\Program Files\Common Files\Real 2008-12-15 08:00 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\IDM 2008-11-29 02:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-11-01 19:28 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\DMCache 2008-11-01 18:59 --------- d-----w C:\Program Files\Java 2008-09-26 03:56 --------- d-----w C:\Program Files\Sun 2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-06 17:54 --------- d-----w C:\Documents and Settings\ir8clan\Application Data\Uniblue 2008-08-20 05:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 10:00 2,180,352 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:22 2,057,728 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( snapshot@2008-12-30_12.38.24.54 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-21 04:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE - 2000-08-31 16:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe + 2000-08-31 15:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe - 2000-08-31 16:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe + 2000-08-31 15:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe - 2008-05-09 21:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys + 2008-05-09 20:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys - 2008-01-22 02:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2008-01-22 01:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys - 2008-06-27 23:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2008-06-27 22:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys - 2007-03-01 18:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys + 2007-03-01 17:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys - 2008-11-03 00:30:03 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-11-01 17:57:23 60,624 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-11-03 00:30:03 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-11-01 17:57:23 400,464 ----a-w C:\WINDOWS\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704] "IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-01-23 2577840] "DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-02-01 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-02-01 81920] "Super Screen Capture"="C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe" [2006-06-02 3126784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-12-15 185896] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RTHDCPL"="RTHDCPL.EXE" [2006-05-04 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-04-24 C:\WINDOWS\SkyTel.exe] "nwiz"="nwiz.exe" [2008-02-01 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "KeyScrambler"="C:\Program Files\KeyScrambler\getting_started.html" [X] "RealUpgradeHelper"="C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-12-15 136768] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2008-03-12 589824] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-08-15 34880] R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2006-08-15 29056] R3 KeyScrambler;KeyScrambler;C:\WINDOWS\system32\drivers\keyscrambler.sys [2008-06-24 113896] S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera;C:\WINDOWS\system32\Drivers\ubVeo532.sys [2002-07-01 95232] S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 9344] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e052900-276a-11dd-84b8-0040452c13e8}] \Shell\AutoRun\command - E:\wd_windows_tools\setup.exe . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 12:26:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Zeallsoft\Super Screen Capture\zHook.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-11-01 12:31:09 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-01 19:31:04 ComboFix2.txt 2008-11-01 18:23:38 ComboFix3.txt 2008-12-30 20:39:34 Pre-Run: 82,873,405,440 bytes free Post-Run: 82,850,701,312 bytes free 244 --- E O F --- 2008-12-27 18:19:17 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:33:29, on 11/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\o2flash.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SkyTel.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\ir8clan\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: CKeyScramblerBHO Object - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (file missing) O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Super Screen Capture] C:\Program Files\Zeallsoft\Super Screen Capture\SSCapture.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [KeyScrambler] C:\Program Files\KeyScrambler\getting_started.html (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user') O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe -- End of file - 9522 bytes |
|
|
|
|
11-01-2008, 10:31 AM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Thanks for reporting about SpywareStop. I anticipated that, and we used ComboFix to remove it.
Go here to run an online scannner from ESET.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-01-2008, 11:58 AM
|
#14 (permalink) |
|
Registered User
Join Date: Oct 2008
Posts: 11
OS: xp
|
Re: problem with trojan-keylogger.win32.fung
here the information you asked. and i dont see the warning of trojan keylogger.win32.fung anymore
# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3575 (20081031) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=5821d00e562dd64fb057a73ce415bc70 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2008-11-01 08:33:30 # local_time=2008-11-01 01:33:30 (-0800, Pacific Daylight Time) # country="United States" # osver=5.1.2600 NT Service Pack 2 # scanned=167150 # found=0 # scan_time=1682 Last edited by huy3108; 11-01-2008 at 12:01 PM. |
|
|
|
|
11-01-2008, 12:01 PM
|
#15 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Clean Log!
Quote:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
|
11-01-2008, 12:03 PM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Ah, I see the edited line.
If all is well, I'll have final instructions for you.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-01-2008, 01:01 PM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
Your logs appear clean.You should be good to go. We still have a few items to address.
Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
11-02-2008, 05:30 PM
|
#20 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,574
OS: 2000 Pro; XP Pro; XP Home
|
Re: problem with trojan-keylogger.win32.fung
I'm glad to have helped.
 Surf Safely, and Think Prevention! Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
| Thread Tools | |
|
|
)
)
