|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-05-2008, 09:46 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Invisible popups, unknown programs running
While playing an online full-screen game, with no other active programs running, internet explorer invisibly opens and forces whatever else I was doing to minimize. On checking task manager, iexplorer.exe and another program titled "8Ok4qQGr.exe" are running. I searched the latter of the two and it's in the System32 folder. Malwarebytes' Anti-Malware has removed it several times, claiming it as a trojan, but it reappears in hours. Please assist, thank you.
Logfile of random's system information tool 1.04 (written by random/random) Run by Ryan at 2008-11-05 21:36:59 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 92 GB (60%) free of 153 GB Total RAM: 2047 MB (77% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:37:02 PM, on 11/5/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\nvraidservice.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Documents and Settings\Ryan\Desktop\gmer.exe C:\WINDOWS\system32\8Ok4qQGr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Ryan\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Ryan.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126875435921 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 5695 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\At1.job C:\WINDOWS\tasks\At10.job C:\WINDOWS\tasks\At11.job C:\WINDOWS\tasks\At12.job C:\WINDOWS\tasks\At121.job C:\WINDOWS\tasks\At122.job C:\WINDOWS\tasks\At123.job C:\WINDOWS\tasks\At124.job C:\WINDOWS\tasks\At125.job C:\WINDOWS\tasks\At126.job C:\WINDOWS\tasks\At127.job C:\WINDOWS\tasks\At128.job C:\WINDOWS\tasks\At129.job C:\WINDOWS\tasks\At13.job C:\WINDOWS\tasks\At130.job C:\WINDOWS\tasks\At131.job C:\WINDOWS\tasks\At132.job C:\WINDOWS\tasks\At133.job C:\WINDOWS\tasks\At134.job C:\WINDOWS\tasks\At135.job C:\WINDOWS\tasks\At136.job C:\WINDOWS\tasks\At137.job C:\WINDOWS\tasks\At138.job C:\WINDOWS\tasks\At139.job C:\WINDOWS\tasks\At14.job C:\WINDOWS\tasks\At140.job C:\WINDOWS\tasks\At141.job C:\WINDOWS\tasks\At142.job C:\WINDOWS\tasks\At143.job C:\WINDOWS\tasks\At144.job C:\WINDOWS\tasks\At15.job C:\WINDOWS\tasks\At16.job C:\WINDOWS\tasks\At17.job C:\WINDOWS\tasks\At18.job C:\WINDOWS\tasks\At19.job C:\WINDOWS\tasks\At2.job C:\WINDOWS\tasks\At20.job C:\WINDOWS\tasks\At21.job C:\WINDOWS\tasks\At22.job C:\WINDOWS\tasks\At23.job C:\WINDOWS\tasks\At24.job C:\WINDOWS\tasks\At3.job C:\WINDOWS\tasks\At4.job C:\WINDOWS\tasks\At5.job C:\WINDOWS\tasks\At6.job C:\WINDOWS\tasks\At7.job C:\WINDOWS\tasks\At8.job C:\WINDOWS\tasks\At9.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll [2008-06-30 349552] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2008-10-22 116088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-05 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-05 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-05 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll [2008-06-30 349552] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NVRaidService"=C:\WINDOWS\system32\nvraidservice.exe [2005-05-26 112640] "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-10-17 51048] "osCheck"=C:\Program Files\Norton 360\osCheck.exe [2008-02-26 988512] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-11-06 8523776] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-11-06 81920] "NVMixerTray"=C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072] "MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-13 169984] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-05 136600] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [] "Aim6"= [] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk] C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE [2004-06-04 212992] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [2008-05-02 805392] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ryan^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] C:\PROGRA~1\MICROS~2\OFFICE11\ONENOTEM.EXE [2004-06-16 59080] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Apple Mobile Device"=2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn] c:\program files\common files\logitech\bluetooth\LBTWlgn.dll [2008-05-02 72208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\InterVideo\DVD6\WinDVD.exe"="C:\Program Files\InterVideo\DVD6\WinDVD.exe:*:Enabled:WinDVD" "\\ares\local_srvr_d\Pegasus Archive\Old or Shitty Games\Quake III Arena\quake3.exe"="\\ares\local_srvr_d\Pegasus Archive\Old or Shitty Games\Quake III Arena\quake3.exe:*:Enabled:quake3.exe" "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger" "C:\World of Warcraft\WoW-1.7.1.4695-to-1.8.0-enUS-downloader.exe"="C:\World of Warcraft\WoW-1.7.1.4695-to-1.8.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Documents and Settings\Ryan\Desktop\CaptureTheFlag-downloader.exe"="C:\Documents and Settings\Ryan\Desktop\CaptureTheFlag-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Documents and Settings\Ryan\My Documents\WOWEx_Blizcon-downloader.exe"="C:\Documents and Settings\Ryan\My Documents\WOWEx_Blizcon-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\BitTorrent\btdownloadgui.exe"="C:\Program Files\BitTorrent\btdownloadgui.exe:*:Enabled:btdownloadgui" "C:\World of Warcraft\WoW-1.8.3.4807-to-1.8.4.4878-enUS-downloader.exe"="C:\World of Warcraft\WoW-1.8.3.4807-to-1.8.4.4878-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox" "C:\World of Warcraft\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe"="C:\World of Warcraft\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\World of Warcraft\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"="C:\World of Warcraft\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Documents and Settings\Ryan\Desktop\WOWEx_Blizcon-downloader.exe"="C:\Documents and Settings\Ryan\Desktop\WOWEx_Blizcon-downloader.exe:*:Enabled:Blizzard Downloader" "C:\World of Warcraft\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"="C:\World of Warcraft\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoW-1.10.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.10.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\BackgroundDownloader.exe"="C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader" "C:\Documents and Settings\Ryan\Desktop\Naxxramas_English-downloader.exe"="C:\Documents and Settings\Ryan\Desktop\Naxxramas_English-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC" "C:\Program Files\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoWTest\WoW-0.12.0.5537-to-0.12.0.5561-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoWTest\WoW-0.12.0.5537-to-0.12.0.5561-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\StubInstaller.exe"="C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoW-2.0.3-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\World of Warcraft\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader" "C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM" "C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Civilization4.exe"="C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 Gold" "C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Warlords\Civ4Warlords.exe"="C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4: Warlords" "C:\Program Files\RealVNC\VNC4\winvnc4.exe"="C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:VNC Server Free Edition for Win32" "C:\Program Files\World of Warcraft\WoW-2.3.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.3.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare" "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\WINDOWS\system32\a.exe"="C:\WINDOWS\system32\a.exe:*:Disabled:a" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2008-11-05 21:36:59 ----D---- C:\rsit 2008-11-05 21:15:08 ----A---- C:\WINDOWS\system32\8Ok4qQGr.exe.a_a 2008-11-05 21:15:08 ----A---- C:\WINDOWS\system32\8Ok4qQGr.exe 2008-11-05 20:43:57 ----A---- C:\WINDOWS\system32\javaws.exe 2008-11-05 20:43:57 ----A---- C:\WINDOWS\system32\javaw.exe 2008-11-05 20:43:57 ----A---- C:\WINDOWS\system32\java.exe 2008-11-05 20:33:10 ----A---- C:\WINDOWS\system32\deploytk.dll 2008-11-05 19:40:58 ----A---- C:\WINDOWS\gmer.ini 2008-11-05 19:40:57 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2008-11-05 19:40:57 ----A---- C:\WINDOWS\gmer.exe 2008-11-05 19:40:57 ----A---- C:\WINDOWS\gmer.dll 2008-11-05 19:24:16 ----D---- C:\Program Files\Trend Micro 2008-10-29 16:19:14 ----A---- C:\WINDOWS\system32\CapabilityTable.exe 2008-10-29 16:18:25 ----A---- C:\WINDOWS\system32\nvunrm.exe 2008-10-29 16:13:57 ----A---- C:\WINDOWS\system32\nvumpu.exe 2008-10-29 16:13:54 ----A---- C:\WINDOWS\system32\nvuaudio.exe 2008-10-29 16:12:08 ----D---- C:\Program Files\Common Files\NVIDIA Shared 2008-10-29 16:12:07 ----D---- C:\Program Files\NVIDIA Corporation 2008-10-29 15:55:55 ----N---- C:\WINDOWS\system32\nvuide.exe 2008-10-29 15:49:18 ----A---- C:\WINDOWS\system32\nvusmb.exe 2008-10-29 15:27:18 ----D---- C:\WINDOWS\NV20762080.TMP 2008-10-28 15:21:55 ----A---- C:\WINDOWS\system32\nvudisp.exe 2008-10-28 15:21:21 ----A---- C:\WINDOWS\system32\NVUNINST.EXE 2008-10-27 16:34:11 ----D---- C:\WINDOWS\NV932736.TMP 2008-10-27 16:25:35 ----D---- C:\WINDOWS\nview 2008-10-27 15:41:10 ----D---- C:\WINDOWS\system32\AGEIA 2008-10-27 15:41:09 ----D---- C:\Program Files\AGEIA Technologies 2008-10-27 15:40:50 ----D---- C:\WINDOWS\NV7082828.TMP 2008-10-27 15:12:07 ----D---- C:\WINDOWS\NV7641132.TMP 2008-10-23 23:59:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-10-22 17:21:49 ----D---- C:\WINDOWS\system32\N360_BACKUP 2008-10-22 17:03:54 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-22 16:46:12 ----D---- C:\Program Files\Windows Sidebar 2008-10-22 16:45:33 ----D---- C:\Program Files\Norton 360 2008-10-22 16:44:41 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-21 21:32:26 ----D---- C:\WINDOWS\ie7updates 2008-10-21 21:31:58 ----D---- C:\WINDOWS\WBEM 2008-10-21 21:31:40 ----HDC---- C:\WINDOWS\ie7 2008-10-21 21:31:26 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$ 2008-10-21 21:30:47 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$ 2008-10-21 10:28:38 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-20 16:02:02 ----D---- C:\Documents and Settings\Ryan\Application Data\Malwarebytes 2008-10-20 16:01:57 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-20 14:53:10 ----D---- C:\Documents and Settings\Ryan\Application Data\Symantec 2008-10-19 23:46:06 ----A---- C:\WINDOWS\system32\Ti56qn3F.exe 2008-10-14 10:50:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-10-14 10:50:37 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-10-14 10:50:32 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-10-14 10:50:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-10-14 10:50:21 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-10-14 10:49:02 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$ ======List of files/folders modified in the last 1 months====== 2008-11-05 21:28:25 ----D---- C:\WINDOWS\Prefetch 2008-11-05 21:19:59 ----D---- C:\WINDOWS\Temp 2008-11-05 21:17:44 ----D---- C:\Program Files\Mozilla Firefox 2008-11-05 21:15:08 ----D---- C:\WINDOWS\system32 2008-11-05 20:51:10 ----RD---- C:\Program Files 2008-11-05 20:49:36 ----D---- C:\Program Files\Common Files 2008-11-05 20:46:42 ----SHD---- C:\WINDOWS\Installer 2008-11-05 20:46:42 ----SHD---- C:\Config.Msi 2008-11-05 20:43:42 ----D---- C:\Program Files\Java 2008-11-05 20:42:51 ----RASH---- C:\boot.ini 2008-11-05 20:42:51 ----A---- C:\WINDOWS\win.ini 2008-11-05 20:42:51 ----A---- C:\WINDOWS\system.ini 2008-11-05 20:38:13 ----D---- C:\Program Files\Common Files\Symantec Shared 2008-11-05 20:33:14 ----D---- C:\WINDOWS 2008-11-05 20:20:49 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-11-05 19:40:57 ----D---- C:\WINDOWS\system32\drivers 2008-11-05 17:00:00 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-11-05 16:43:42 ----D---- C:\WINDOWS\system32\CatRoot2 2008-11-05 11:24:01 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-11-05 11:23:50 ----D---- C:\Documents and Settings\Ryan\Application Data\Viewpoint 2008-11-04 16:33:23 ----D---- C:\Program Files\Microsoft ActiveSync 2008-11-04 16:33:22 ----D---- C:\WINDOWS\Help 2008-11-04 16:12:59 ----SD---- C:\WINDOWS\Tasks 2008-11-03 06:22:25 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-11-01 00:44:13 ----SD---- C:\Documents and Settings\Ryan\Application Data\Microsoft 2008-10-29 21:51:17 ----D---- C:\WINDOWS\pss 2008-10-29 20:30:01 ----D---- C:\WINDOWS\Minidump 2008-10-29 16:20:20 ----D---- C:\WINDOWS\system32\CatRoot 2008-10-29 16:18:53 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-10-29 16:18:49 ----HD---- C:\WINDOWS\inf 2008-10-29 16:18:40 ----D---- C:\WINDOWS\system32\ReinstallBackups 2008-10-29 16:16:17 ----D---- C:\WINDOWS\Downloaded Installations 2008-10-29 16:12:07 ----HD---- C:\Program Files\InstallShield Installation Information 2008-10-28 22:34:17 ----D---- C:\WINDOWS\network diagnostic 2008-10-28 20:17:55 ----D---- C:\WINDOWS\Registration 2008-10-27 20:08:27 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-10-27 20:08:23 ----D---- C:\WINDOWS\security 2008-10-27 17:37:46 ----A---- C:\WINDOWS\imsins.BAK 2008-10-27 16:20:52 ----DC---- C:\WINDOWS\system32\DRVSTORE 2008-10-27 15:40:57 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-23 23:58:08 ----HD---- C:\WINDOWS\$hf_mig$ 2008-10-22 17:11:01 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec 2008-10-22 17  01 ----D---- C:\Program Files\Symantec2008-10-22 16:41:11 ----D---- C:\WINDOWS\SxsCaPendDel 2008-10-22 16:40:12 ----D---- C:\WINDOWS\WinSxS 2008-10-22 16:40:01 ----D---- C:\Program Files\Common Files\Microsoft Shared 2008-10-21 21:34:02 ----D---- C:\Program Files\Internet Explorer 2008-10-21 21:32:32 ----D---- C:\WINDOWS\system32\en-us 2008-10-21 21:32:05 ----D---- C:\WINDOWS\system32\config 2008-10-21 21:31:55 ----D---- C:\WINDOWS\Media 2008-10-21 21:12:42 ----D---- C:\WINDOWS\Cursors 2008-10-21 21:12:38 ----D---- C:\Program Files\Windows NT 2008-10-21 17:46:25 ----A---- C:\WINDOWS\ntbtlog.txt 2008-10-20 17:58:03 ----D---- C:\Program Files\Google 2008-10-20 14:41:51 ----D---- C:\Program Files\Symantec AntiVirus 2008-10-20 14:37:39 ----D---- C:\Documents and Settings\Ryan\Application Data\Amazon 2008-10-15 08:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll 2008-10-07 11:19:40 ----A---- C:\WINDOWS\system32\MRT.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352] R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592] R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [] R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2008-01-31 43696] R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2008-06-13 184240] R2 CO_Mon;CO_Mon; \??\C:\WINDOWS\system32\drivers\CO_Mon.sys [] R2 irda;IrDA Protocol; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192] R2 LBeepKE;LBeepKE; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2006-06-29 3712] R3 COH_Mon;COH_Mon; \??\C:\WINDOWS\system32\Drivers\COH_Mon.sys [] R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688] R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2008-02-29 35344] R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2008-02-29 36880] R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081105.039\NAVENG.SYS [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081105.039\NAVEX15.SYS [] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-11-06 7429088] R3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2005-04-13 53376] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928] R3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2005-04-13 414464] R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2008-01-31 279088] R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2008-06-13 13616] R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [] R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2008-06-13 96432] R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2008-06-13 38576] R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\ipsdefs\20081104.002\SymIDSCo.sys [] R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280] R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2008-06-13 37424] R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2008-06-13 22320] R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000] S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800] S3 av0s3npo;av0s3npo; C:\WINDOWS\system32\drivers\av0s3npo.sys [] S3 CDDRV;CDDRV; C:\WINDOWS\System32\Drivers\CDDRV.sys [2003-08-29 4608] S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys [] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-11-05 85969] S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [] S3 HwIOctl;HwIOctl; \??\C:\Program Files\Setup Files\MS-7160 v3.20\HwIOctl.sys [] S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\System32\Drivers\L8042Kbd.sys [2006-05-10 13568] S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\System32\Drivers\L8042mou.sys [2006-05-10 56064] S3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidKE.Sys [2006-05-10 27264] S3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\System32\Drivers\LMouKE.sys [2006-05-10 71680] S3 Memctl;Memctl; \??\C:\Program Files\Setup Files\MS-7160 v3.20\Memctl.sys [] S3 msloop;Microsoft Loopback Adapter Driver; C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 4992] S3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824] S3 RushTopDevice;RushTopDevice; \??\C:\Program Files\MSI\Core Center\RushTop.sys [] S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2008-01-31 317616] S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280] S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000] S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 atapi;atapi; C:\WINDOWS\system32\drivers\atapi.sys [2008-04-13 96512] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2003-03-31 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-21 238968] R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] R2 Irmon;Infrared Monitor; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-05 152984] R2 LiveUpdate Notice;LiveUpdate Notice; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-11-06 155716] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-10-02 66872] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-14 32768] S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264] S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [2008-05-02 121360] S3 LiveUpdate;LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2008-09-05 3220856] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SandraDataSrv;Sandra Data Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe [2005-10-09 170536] S3 SandraTheSrv;Sandra Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe [2005-10-09 1079832] S3 Symantec Core LC;Symantec Core LC; C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe [2008-10-22 1245064] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040] S4 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2005-03-11 455632] -----------------EOF----------------- |
|
     |
| Sponsored Links |
|
11-08-2008, 07:32 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
11-08-2008, 11:21 PM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Re: Invisible popups, unknown programs running
Thank you for taking the time to assist me, I greatly appreciate it. Here are the logs of the two actions you had me run.
ComboFix 08-11-07.01 - Ryan 2008-11-08 23:13:26.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1573 [GMT -8:00] Running from: c:\documents and settings\Ryan\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\8Ok4qQGr.exe.a_a . ((((((((((((((((((((((((( Files Created from 2008-10-09 to 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-08 14:15 . 2008-11-08 14:14 41,986 --a------ c:\windows\system32\8Ok4qQGr.exe 2008-11-05 21:36 . 2008-11-05 21:37 <DIR> d-------- C:\rsit 2008-11-05 20:43 . 2008-11-05 20:43 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-05 20:33 . 2008-11-05 20:43 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-05 20:08 . 2008-11-05 20:09 80,806,558 --a------ C:\registrybackup.reg 2008-11-05 19:40 . 2008-11-05 21:28 250 --a------ c:\windows\gmer.ini 2008-11-05 19:24 . 2008-11-05 19:24 <DIR> d-------- c:\program files\Trend Micro 2008-10-29 16:19 . 2005-06-03 14:09 454,656 --a------ c:\windows\system32\CapabilityTable.exe 2008-10-29 16:18 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvunrm.exe 2008-10-29 16:18 . 2005-02-11 00:14 4,624 --a------ c:\windows\system32\nvaudio.nvu 2008-10-29 16:18 . 2005-02-08 10:26 3,596 --a------ c:\windows\system32\nvnrm.nvu 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvumpu.exe 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvuaudio.exe 2008-10-29 16:12 . 2008-10-29 21:01 <DIR> d-------- c:\program files\NVIDIA Corporation 2008-10-29 16:12 . 2008-10-29 16:12 <DIR> d-------- c:\program files\Common Files\NVIDIA Shared 2008-10-29 15:55 . 2005-09-09 12:51 176,128 --------- c:\windows\system32\nvuide.exe 2008-10-29 15:49 . 2005-05-13 06:52 176,128 --a------ c:\windows\system32\nvusmb.exe 2008-10-29 15:49 . 2005-02-08 10:26 1,231 --a------ c:\windows\system32\nvsmb.nvu 2008-10-29 15:28 . 2007-11-06 17:30 158,263 --a------ c:\windows\system32\nvapps.nvb 2008-10-29 15:27 . 2008-10-29 15:30 <DIR> d-------- c:\windows\NV20762080.TMP 2008-10-28 22:31 . 2003-08-29 00:13 4,608 --a------ c:\windows\system32\drivers\CDDRV.sys 2008-10-28 15:22 . 2008-10-29 17:02 164,163 --a------ c:\windows\system32\nvapps.xml 2008-10-28 15:21 . 2007-11-06 17:59 356,352 --a------ c:\windows\system32\NVUNINST.EXE 2008-10-28 15:21 . 2007-11-06 17:30 356,352 --a------ c:\windows\system32\nvudisp.exe 2008-10-28 15:21 . 2007-11-06 17:30 17,737 --a------ c:\windows\system32\nvdisp.nvu 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a------ c:\windows\system32\drivers\loop.sys 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a--c--- c:\windows\system32\dllcache\loop.sys 2008-10-27 16:34 . 2008-10-27 16:36 <DIR> d-------- c:\windows\NV932736.TMP 2008-10-27 16:32 . 2008-10-27 16:32 664 --a------ c:\windows\system32\d3d9caps.dat 2008-10-27 16:25 . 2008-10-29 15:30 <DIR> d-------- c:\windows\nview 2008-10-27 15:41 . 2008-10-27 15:41 <DIR> d-------- c:\windows\system32\AGEIA 2008-10-27 15:41 . 2008-10-27 16:20 <DIR> d-------- c:\program files\AGEIA Technologies 2008-10-27 15:40 . 2008-10-27 15:42 <DIR> d-------- c:\windows\NV7082828.TMP 2008-10-27 15:12 . 2008-10-27 15:36 <DIR> d-------- c:\windows\NV7641132.TMP 2008-10-24 17:26 . 2008-10-24 17:26 <DIR> d-------- c:\documents and settings\Guest\Application Data\Symantec 2008-10-23 17:45 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-22 17:21 . 2008-10-22 17:21 <DIR> d-------- c:\windows\system32\N360_BACKUP 2008-10-22 17:03 . 2008-10-22 17:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-22 16:46 . 2008-10-22 16:46 <DIR> d-------- c:\program files\Windows Sidebar 2008-10-22 16:45 . 2008-11-03 15:13 <DIR> d-------- c:\program files\Norton 360 2008-10-22 16:44 . 2008-10-22 17:06 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS 2008-10-22 16:44 . 2008-10-22 17:06 60,800 --a------ c:\windows\system32\S32EVNT1.DLL 2008-10-22 16:44 . 2008-10-22 17:06 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT 2008-10-22 16:44 . 2008-10-22 17:06 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF 2008-10-21 21:27 . 2008-10-03 09:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-10-21 21:27 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-10-21 21:27 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-10-21 21:27 . 2008-08-25 23:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-10-21 21:27 . 2008-08-25 23:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-10-21 21:27 . 2008-08-25 23:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-10-21 21:27 . 2008-08-25 23:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-10-21 21:27 . 2008-08-25 23:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-10-21 21:27 . 2008-08-25 00:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-10-21 10:28 . 2008-11-06 20:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-10-21 10:28 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-21 10:28 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-10-20 16:02 . 2008-10-20 16:02 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Malwarebytes 2008-10-20 16:01 . 2008-10-20 16:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-10-20 14:53 . 2008-10-22 17:20 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Symantec 2008-10-19 23:46 . 2008-10-19 23:45 30,272 --a------ c:\windows\system32\Ti56qn3F.exe 2008-10-14 10:02 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-10-14 10:02 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-10-14 10:01 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-14 10:01 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 06:20 --------- d-----w c:\documents and settings\Ryan\Application Data\dvdcss 2008-11-09 05:15 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-06 04:43 --------- d-----w c:\program files\Java 2008-11-05 19:24 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-11-05 00:33 --------- d-----w c:\program files\Microsoft ActiveSync 2008-10-30 00:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-27 23:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-10-23 01:11 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2008-10-23 01:06 --------- d-----w c:\program files\Symantec 2008-10-21 01:58 --------- d-----w c:\program files\Google 2008-10-20 22:41 --------- d-----w c:\program files\Symantec AntiVirus 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-02 16:20 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-02 16:20 107,832 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-02 16:11 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-10-01 23:47 --------- d-----w c:\documents and settings\Guest\Application Data\Amazon 2008-09-30 21:54 --------- d-----w c:\program files\Electronic Arts 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe 2008-08-29 15:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe 2005-11-30 00:54 5,862,994 ----a-w c:\program files\ts2_client_rc2_2032.exe 2007-10-15 02:47 10,022 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-11-07_17.41.48.65 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-09 04:11:43 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4d4.dat + 2008-11-08 23:48:05 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_570.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2005-05-26 112640] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-06 81920] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-05 136600] "nwiz"="nwiz.exe" [2007-11-06 c:\windows\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ryan^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] path=c:\documents and settings\Ryan\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-10 08:47 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 16:12 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 09:47 289064 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 02:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"= "\\\\ares\\local_srvr_d\\Pegasus Archive\\Old or Shitty Games\\Quake III Arena\\quake3.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Civilization4.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Warlords\\Civ4Warlords.exe"= "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R2 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2008-11-05 152984] R2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2006-06-29 3712] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] S3 CDDRV;CDDRV;c:\windows\system32\Drivers\CDDRV.sys [2003-08-29 4608] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 HwIOctl;HwIOctl;c:\program files\Setup Files\MS-7160 v3.20\HwIOctl.sys [ ] S3 Memctl;Memctl;c:\program files\Setup Files\MS-7160 v3.20\Memctl.sys [ ] S3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2001-08-17 4992] S3 RushTopDevice;RushTopDevice;c:\program files\MSI\Core Center\RushTop.sys [2005-05-02 37792] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder 2008-11-08 c:\windows\Tasks\At1.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-10-20 c:\windows\Tasks\At10.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-01 c:\windows\Tasks\At11.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-07 c:\windows\Tasks\At12.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-01 c:\windows\Tasks\At13.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-02 c:\windows\Tasks\At14.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At15.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At16.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At169.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At17.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At170.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At171.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At172.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At173.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At174.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At175.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At176.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At177.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At178.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At179.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At18.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At180.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At181.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At182.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At183.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At184.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At185.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At186.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At187.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At188.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At189.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At19.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-09 c:\windows\Tasks\At190.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At191.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-09 c:\windows\Tasks\At192.job - c:\windows\system32\8Ok4qQGr.exe [2008-11-08 14:14] 2008-11-08 c:\windows\Tasks\At2.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At20.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At21.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-09 c:\windows\Tasks\At22.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-09 c:\windows\Tasks\At23.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-09 c:\windows\Tasks\At24.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At3.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-08 c:\windows\Tasks\At4.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-10-25 c:\windows\Tasks\At5.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-10-25 c:\windows\Tasks\At6.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-10-20 c:\windows\Tasks\At7.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-11-07 c:\windows\Tasks\At8.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] 2008-10-20 c:\windows\Tasks\At9.job - c:\windows\system32\Ti56qn3F.exe [2008-10-19 23:45] . . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Ryan\Application Data\Mozilla\Firefox\Profiles\qs592mav.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.com FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-08 23:15:30 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-08 23:16:45 ComboFix-quarantined-files.txt 2008-11-09 07:16:37 ComboFix2.txt 2008-11-08 21:00:12 ComboFix3.txt 2008-11-08 01:43:12 Pre-Run: 104,159,846,400 bytes free Post-Run: 104,214,052,864 bytes free 338 --- E O F --- 2008-10-24 07:59:17 -------------------------------------------------------------------- -------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:17:23 PM, on 11/8/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126875435921 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 5467 bytes |
|
|
|
|
11-09-2008, 04:18 AM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Hello, Ishtar84. It appears that you ran ComboFix 5 times. Did you have trouble? Please let us know.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: C:\Qoobox\ComboFix-quarantined-files.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
del /a/f/q "C:\WINDOWS\Tasks\At*.job" It should look like this:  Double-click on delete.bat and allow it to run. Please delete the file afterwards. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. Please let your helper know you successfully submitted the file. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix-quarantined-files.txt ComboFix.txt new HijackThis log |
|
|
|
|
|
11-09-2008, 01:49 PM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Re: Invisible popups, unknown programs running
Thanks for the speedy response. A few things to mention before you look at the logs below. When I ran the .bat file, I saw the cmd screen pop up and flicker briefly, that's all it did. Also in regard to your question about the multiple times I ran Combofix, I just had some issues with power failure where I live, situation is fine now. Here are the logs:
2008-11-07 17:37:37 A------- 174 C:\Qoobox\Quarantine\catchme.log 2008-11-08 14:15:02 A------- 0 C:\Qoobox\Quarantine\C\WINDOWS\system32\8Ok4qQGr.exe.a_a.vir 2008-11-08 23:15:07 A------- 7,592 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2008-11-08 23:16:08 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat 2008-11-08 23:16:08 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat 2008-11-08 23:16:08 A------- 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat -------------------------------------------------------------------- -------------------------------------------------------------------- ComboFix 08-11-09.01 - Ryan 2008-11-09 13:38:21.6 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1586 [GMT -8:00] Running from: c:\documents and settings\Ryan\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Ryan\Desktop\CFScript.txt * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\8Ok4qQGr.exe . ((((((((((((((((((((((((( Files Created from 2008-10-09 to 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 13:24 . 2008-11-09 13:24 0 --a------ c:\windows\system32\8Ok4qQGr.exe.a_a 2008-11-05 21:36 . 2008-11-05 21:37 <DIR> d-------- C:\rsit 2008-11-05 20:43 . 2008-11-05 20:43 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-05 20:33 . 2008-11-05 20:43 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-05 20:08 . 2008-11-05 20:09 80,806,558 --a------ C:\registrybackup.reg 2008-11-05 19:40 . 2008-11-05 21:28 250 --a------ c:\windows\gmer.ini 2008-11-05 19:24 . 2008-11-05 19:24 <DIR> d-------- c:\program files\Trend Micro 2008-10-29 16:19 . 2005-06-03 14:09 454,656 --a------ c:\windows\system32\CapabilityTable.exe 2008-10-29 16:18 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvunrm.exe 2008-10-29 16:18 . 2005-02-11 00:14 4,624 --a------ c:\windows\system32\nvaudio.nvu 2008-10-29 16:18 . 2005-02-08 10:26 3,596 --a------ c:\windows\system32\nvnrm.nvu 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvumpu.exe 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvuaudio.exe 2008-10-29 16:12 . 2008-10-29 21:01 <DIR> d-------- c:\program files\NVIDIA Corporation 2008-10-29 16:12 . 2008-10-29 16:12 <DIR> d-------- c:\program files\Common Files\NVIDIA Shared 2008-10-29 15:55 . 2005-09-09 12:51 176,128 --------- c:\windows\system32\nvuide.exe 2008-10-29 15:49 . 2005-05-13 06:52 176,128 --a------ c:\windows\system32\nvusmb.exe 2008-10-29 15:49 . 2005-02-08 10:26 1,231 --a------ c:\windows\system32\nvsmb.nvu 2008-10-29 15:28 . 2007-11-06 17:30 158,263 --a------ c:\windows\system32\nvapps.nvb 2008-10-29 15:27 . 2008-10-29 15:30 <DIR> d-------- c:\windows\NV20762080.TMP 2008-10-28 22:31 . 2003-08-29 00:13 4,608 --a------ c:\windows\system32\drivers\CDDRV.sys 2008-10-28 15:22 . 2008-10-29 17:02 164,163 --a------ c:\windows\system32\nvapps.xml 2008-10-28 15:21 . 2007-11-06 17:59 356,352 --a------ c:\windows\system32\NVUNINST.EXE 2008-10-28 15:21 . 2007-11-06 17:30 356,352 --a------ c:\windows\system32\nvudisp.exe 2008-10-28 15:21 . 2007-11-06 17:30 17,737 --a------ c:\windows\system32\nvdisp.nvu 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a------ c:\windows\system32\drivers\loop.sys 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a--c--- c:\windows\system32\dllcache\loop.sys 2008-10-27 16:34 . 2008-10-27 16:36 <DIR> d-------- c:\windows\NV932736.TMP 2008-10-27 16:32 . 2008-10-27 16:32 664 --a------ c:\windows\system32\d3d9caps.dat 2008-10-27 16:25 . 2008-10-29 15:30 <DIR> d-------- c:\windows\nview 2008-10-27 15:41 . 2008-10-27 15:41 <DIR> d-------- c:\windows\system32\AGEIA 2008-10-27 15:41 . 2008-10-27 16:20 <DIR> d-------- c:\program files\AGEIA Technologies 2008-10-27 15:40 . 2008-10-27 15:42 <DIR> d-------- c:\windows\NV7082828.TMP 2008-10-27 15:12 . 2008-10-27 15:36 <DIR> d-------- c:\windows\NV7641132.TMP 2008-10-24 17:26 . 2008-10-24 17:26 <DIR> d-------- c:\documents and settings\Guest\Application Data\Symantec 2008-10-23 17:45 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-22 17:21 . 2008-10-22 17:21 <DIR> d-------- c:\windows\system32\N360_BACKUP 2008-10-22 17:03 . 2008-10-22 17:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-22 16:46 . 2008-10-22 16:46 <DIR> d-------- c:\program files\Windows Sidebar 2008-10-22 16:45 . 2008-11-03 15:13 <DIR> d-------- c:\program files\Norton 360 2008-10-22 16:44 . 2008-10-22 17:06 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS 2008-10-22 16:44 . 2008-10-22 17:06 60,800 --a------ c:\windows\system32\S32EVNT1.DLL 2008-10-22 16:44 . 2008-10-22 17:06 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT 2008-10-22 16:44 . 2008-10-22 17:06 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF 2008-10-21 21:27 . 2008-10-03 09:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-10-21 21:27 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-10-21 21:27 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-10-21 21:27 . 2008-08-25 23:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-10-21 21:27 . 2008-08-25 23:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-10-21 21:27 . 2008-08-25 23:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-10-21 21:27 . 2008-08-25 23:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-10-21 21:27 . 2008-08-25 23:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-10-21 21:27 . 2008-08-25 00:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-10-21 10:28 . 2008-11-06 20:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-10-21 10:28 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-21 10:28 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-10-20 16:02 . 2008-10-20 16:02 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Malwarebytes 2008-10-20 16:01 . 2008-10-20 16:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-10-20 14:53 . 2008-10-22 17:20 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Symantec 2008-10-19 23:46 . 2008-10-19 23:45 30,272 --a------ c:\windows\system32\Ti56qn3F.exe 2008-10-14 10:02 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-10-14 10:02 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-10-14 10:01 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-14 10:01 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 20:47 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-09 06:20 --------- d-----w c:\documents and settings\Ryan\Application Data\dvdcss 2008-11-06 04:43 --------- d-----w c:\program files\Java 2008-11-05 19:24 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-11-05 00:33 --------- d-----w c:\program files\Microsoft ActiveSync 2008-10-30 00:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-27 23:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-10-23 01:11 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2008-10-23 01:06 --------- d-----w c:\program files\Symantec 2008-10-21 01:58 --------- d-----w c:\program files\Google 2008-10-20 22:41 --------- d-----w c:\program files\Symantec AntiVirus 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-02 16:20 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-02 16:20 107,832 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-02 16:11 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-10-01 23:47 --------- d-----w c:\documents and settings\Guest\Application Data\Amazon 2008-09-30 21:54 --------- d-----w c:\program files\Electronic Arts 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe 2008-08-29 15:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe 2005-11-30 00:54 5,862,994 ----a-w c:\program files\ts2_client_rc2_2032.exe 2007-10-15 02:47 10,022 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-11-07_17.41.48.65 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-09 20:47:33 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_1b4.dat + 2008-11-09 20:47:25 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_540.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2005-05-26 112640] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-06 81920] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-05 136600] "nwiz"="nwiz.exe" [2007-11-06 c:\windows\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ryan^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] path=c:\documents and settings\Ryan\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-10 08:47 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 16:12 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 09:47 289064 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 02:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"= "\\\\ares\\local_srvr_d\\Pegasus Archive\\Old or Shitty Games\\Quake III Arena\\quake3.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Civilization4.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Warlords\\Civ4Warlords.exe"= "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2006-06-29 3712] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] S3 CDDRV;CDDRV;c:\windows\system32\Drivers\CDDRV.sys [2003-08-29 4608] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 HwIOctl;HwIOctl;c:\program files\Setup Files\MS-7160 v3.20\HwIOctl.sys [ ] S3 Memctl;Memctl;c:\program files\Setup Files\MS-7160 v3.20\Memctl.sys [ ] S3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2001-08-17 4992] S3 RushTopDevice;RushTopDevice;c:\program files\MSI\Core Center\RushTop.sys [2005-05-02 37792] *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 13:38:46 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-09 13:43:04 ComboFix-quarantined-files.txt 2008-11-09 21:42:44 ComboFix2.txt 2008-11-09 07:16:47 ComboFix3.txt 2008-11-08 21:00:12 ComboFix4.txt 2008-11-08 01:43:12 Pre-Run: 104,164,462,592 bytes free Post-Run: 104,150,380,544 bytes free 230 --- E O F --- 2008-10-24 07:59:17 -------------------------------------------------------------------- -------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:44:43 PM, on 11/9/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126875435921 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 5466 bytes |
|
|
|
|
11-09-2008, 02:06 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Hello again, Ishtar84. Thanks for submitting the file. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: cmd /c del /a/q "c:\windows\system32\8Ok4qQGr.exe.a_a" A DOS window will open and close again, this is normal. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
11-09-2008, 09:27 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Re: Invisible popups, unknown programs running
Thanks for your quick replies. Before I did the scans and actions listed by your most recent response, I was still getting the popups. Since then, nothing, but time will tell I suppose. Here are the logs requested after the actions performed.
-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, November 9, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, November 10, 2008 02:23:27 Records in database: 1377590 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 68618 Threat name: 7 Infected objects: 9 Suspicious objects: 0 Duration of the scan: 01:01:19 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00F00000.VBN Infected: Exploit.Java.Gimsh.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06940000.VBN Infected: Exploit.Java.Gimsh.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B3C0000.VBN Infected: Exploit.Java.Gimsh.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E880000.VBN Infected: Backdoor.Win32.UltimateDefender.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F640000.VBN Infected: Backdoor.Win32.UltimateDefender.gen 1 C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 1 C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1 C:\Qoobox\Quarantine\[4]-Submit_2008-11-09@13.38.zip Infected: Trojan-Downloader.Win32.Agent.aogx 1 C:\WINDOWS\system32\Ti56qn3F.exe Infected: Trojan-Downloader.Win32.Firu.bah 1 The selected area was scanned. ------------------------------------------------------------ ------------------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:23:37 PM, on 11/9/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\5Qm1sSIt.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126875435921 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 5575 bytes |
|
|
|
|
11-10-2008, 04:41 AM
|
#8 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Hello again, Ishtar84.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Empty this entire folder. It's where Symantec keeps it's renamed quarantined files: C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine Don't delete the folder, just empty it. Empty your Recycle Bin if it does not do so automatically. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\5Qm1sSIt.dll (file missing) Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. Please let your helper know you successfully submitted the file. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log |
|
|
|
|
|
11-10-2008, 12:59 PM
|
#9 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Re: Invisible popups, unknown programs running
We're practically pen-pals now, too bad it's under circumstances of mal-ware. Thanks for the quick assist, here are the logs requested.
ComboFix 08-11-09.04 - Ryan 2008-11-10 12:48:51.7 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1649 [GMT -8:00] Running from: c:\documents and settings\Ryan\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Ryan\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\Ti56qn3F.exe . ((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 ))))))))))))))))))))))))))))))) . 2008-11-09 19:58 . 2008-11-09 19:58 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-05 21:36 . 2008-11-05 21:37 <DIR> d-------- C:\rsit 2008-11-05 20:33 . 2008-11-09 19:58 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-05 20:08 . 2008-11-05 20:09 80,806,558 --a------ C:\registrybackup.reg 2008-11-05 19:40 . 2008-11-05 21:28 250 --a------ c:\windows\gmer.ini 2008-11-05 19:24 . 2008-11-05 19:24 <DIR> d-------- c:\program files\Trend Micro 2008-10-29 16:19 . 2005-06-03 14:09 454,656 --a------ c:\windows\system32\CapabilityTable.exe 2008-10-29 16:18 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvunrm.exe 2008-10-29 16:18 . 2005-02-11 00:14 4,624 --a------ c:\windows\system32\nvaudio.nvu 2008-10-29 16:18 . 2005-02-08 10:26 3,596 --a------ c:\windows\system32\nvnrm.nvu 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvumpu.exe 2008-10-29 16:13 . 2005-06-03 14:07 176,128 --a------ c:\windows\system32\nvuaudio.exe 2008-10-29 16:12 . 2008-10-29 21:01 <DIR> d-------- c:\program files\NVIDIA Corporation 2008-10-29 16:12 . 2008-10-29 16:12 <DIR> d-------- c:\program files\Common Files\NVIDIA Shared 2008-10-29 15:55 . 2005-09-09 12:51 176,128 --------- c:\windows\system32\nvuide.exe 2008-10-29 15:49 . 2005-05-13 06:52 176,128 --a------ c:\windows\system32\nvusmb.exe 2008-10-29 15:49 . 2005-02-08 10:26 1,231 --a------ c:\windows\system32\nvsmb.nvu 2008-10-29 15:28 . 2007-11-06 17:30 158,263 --a------ c:\windows\system32\nvapps.nvb 2008-10-29 15:27 . 2008-10-29 15:30 <DIR> d-------- c:\windows\NV20762080.TMP 2008-10-28 22:31 . 2003-08-29 00:13 4,608 --a------ c:\windows\system32\drivers\CDDRV.sys 2008-10-28 15:22 . 2008-10-29 17:02 164,163 --a------ c:\windows\system32\nvapps.xml 2008-10-28 15:21 . 2007-11-06 17:59 356,352 --a------ c:\windows\system32\NVUNINST.EXE 2008-10-28 15:21 . 2007-11-06 17:30 356,352 --a------ c:\windows\system32\nvudisp.exe 2008-10-28 15:21 . 2007-11-06 17:30 17,737 --a------ c:\windows\system32\nvdisp.nvu 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a------ c:\windows\system32\drivers\loop.sys 2008-10-27 23:34 . 2001-08-17 12:53 4,992 --a--c--- c:\windows\system32\dllcache\loop.sys 2008-10-27 16:34 . 2008-10-27 16:36 <DIR> d-------- c:\windows\NV932736.TMP 2008-10-27 16:32 . 2008-10-27 16:32 664 --a------ c:\windows\system32\d3d9caps.dat 2008-10-27 16:25 . 2008-10-29 15:30 <DIR> d-------- c:\windows\nview 2008-10-27 15:41 . 2008-10-27 15:41 <DIR> d-------- c:\windows\system32\AGEIA 2008-10-27 15:41 . 2008-10-27 16:20 <DIR> d-------- c:\program files\AGEIA Technologies 2008-10-27 15:40 . 2008-10-27 15:42 <DIR> d-------- c:\windows\NV7082828.TMP 2008-10-27 15:12 . 2008-10-27 15:36 <DIR> d-------- c:\windows\NV7641132.TMP 2008-10-24 17:26 . 2008-10-24 17:26 <DIR> d-------- c:\documents and settings\Guest\Application Data\Symantec 2008-10-23 17:45 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-22 17:21 . 2008-10-22 17:21 <DIR> d-------- c:\windows\system32\N360_BACKUP 2008-10-22 17:03 . 2008-10-22 17:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-22 16:46 . 2008-10-22 16:46 <DIR> d-------- c:\program files\Windows Sidebar 2008-10-22 16:45 . 2008-11-03 15:13 <DIR> d-------- c:\program files\Norton 360 2008-10-22 16:44 . 2008-10-22 17:06 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS 2008-10-22 16:44 . 2008-10-22 17:06 60,800 --a------ c:\windows\system32\S32EVNT1.DLL 2008-10-22 16:44 . 2008-10-22 17:06 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT 2008-10-22 16:44 . 2008-10-22 17:06 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF 2008-10-21 21:27 . 2008-10-03 09:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-10-21 21:27 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-10-21 21:27 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-10-21 21:27 . 2008-08-25 23:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-10-21 21:27 . 2008-08-25 23:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-10-21 21:27 . 2008-08-25 23:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-10-21 21:27 . 2008-08-25 23:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-10-21 21:27 . 2008-08-25 23:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-10-21 21:27 . 2008-08-25 00:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-10-21 10:28 . 2008-11-06 20:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-10-21 10:28 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-21 10:28 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-10-20 16:02 . 2008-10-20 16:02 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Malwarebytes 2008-10-20 16:01 . 2008-10-20 16:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-10-20 14:53 . 2008-10-22 17:20 <DIR> d-------- c:\documents and settings\Ryan\Application Data\Symantec 2008-10-14 10:02 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-10-14 10:02 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-10-14 10:01 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-14 10:01 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-14 10:01 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-10 20:42 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-10 03:58 --------- d-----w c:\program files\Java 2008-11-09 06:20 --------- d-----w c:\documents and settings\Ryan\Application Data\dvdcss 2008-11-05 19:24 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-11-05 00:33 --------- d-----w c:\program files\Microsoft ActiveSync 2008-10-30 00:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-27 23:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-10-23 01:11 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2008-10-23 01:06 --------- d-----w c:\program files\Symantec 2008-10-21 01:58 --------- d-----w c:\program files\Google 2008-10-20 22:41 --------- d-----w c:\program files\Symantec AntiVirus 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-02 16:20 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-02 16:20 107,832 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-02 16:11 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-10-01 23:47 --------- d-----w c:\documents and settings\Guest\Application Data\Amazon 2008-09-30 21:54 --------- d-----w c:\program files\Electronic Arts 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe 2008-08-29 15:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe 2005-11-30 00:54 5,862,994 ----a-w c:\program files\ts2_client_rc2_2032.exe 2007-10-15 02:47 10,022 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-11-07_17.41.48.65 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-06 04:43:45 144,792 ----a-w c:\windows\system32\java.exe + 2008-11-10 03:58:10 144,792 ----a-w c:\windows\system32\java.exe - 2008-11-06 04:43:45 144,792 ----a-w c:\windows\system32\javaw.exe + 2008-11-10 03:58:10 144,792 ----a-w c:\windows\system32\javaw.exe - 2008-11-06 04:43:45 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-11-10 03:58:10 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-11-10 20:42:03 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_59c.dat + 2008-11-10 20:42:15 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_88c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2005-05-26 112640] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-06 8523776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-06 81920] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-09 136600] "nwiz"="nwiz.exe" [2007-11-06 c:\windows\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ryan^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] path=c:\documents and settings\Ryan\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-10 08:47 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 16:12 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 09:47 289064 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 02:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"= "\\\\ares\\local_srvr_d\\Pegasus Archive\\Old or Shitty Games\\Quake III Arena\\quake3.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Civilization4.exe"= "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Gold\\Warlords\\Civ4Warlords.exe"= "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2006-06-29 3712] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352] S3 CDDRV;CDDRV;c:\windows\system32\Drivers\CDDRV.sys [2003-08-29 4608] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 HwIOctl;HwIOctl;c:\program files\Setup Files\MS-7160 v3.20\HwIOctl.sys [ ] S3 Memctl;Memctl;c:\program files\Setup Files\MS-7160 v3.20\Memctl.sys [ ] S3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2001-08-17 4992] S3 RushTopDevice;RushTopDevice;c:\program files\MSI\Core Center\RushTop.sys [2005-05-02 37792] *Newly Created Service* - COMHOST . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-10 12:50:59 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-11-10 12:53:47 ComboFix-quarantined-files.txt 2008-11-10 20:52:43 ComboFix2.txt 2008-11-09 21:43:05 ComboFix3.txt 2008-11-09 07:16:47 ComboFix4.txt 2008-11-08 21:00:12 ComboFix5.txt 2008-11-10 20:48:18 Pre-Run: 103,966,474,240 bytes free Post-Run: 104,000,364,544 bytes free 230 --- E O F --- 2008-10-24 07:59:17 ----------------------------------------------------------------- ----------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:55:41 PM, on 11/10/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126875435921 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 5449 bytes |
|
|
|
|
11-10-2008, 01:57 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Did you submit the file successfully? Your logs look good. Let me know how your system is behaving and I will give you some final instructions.
|
|
|
|
|
11-10-2008, 03:43 PM
|
#11 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 7
OS: Windows XP
|
Re: Invisible popups, unknown programs running
Yes, the file submitted just fine. I seem to be doing alright system wise, it seems a little slower sometimes, but might be due to some extraneous system processes.
|
|
|
|
|
11-10-2008, 04:51 PM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 8,678
OS: XP SP3
|
Re: Invisible popups, unknown programs running
Congratulations. Well done! Your logs appear clean. You should be good to go.
Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: C:\WINDOWS\gmer_uninstall.cmd Press any key to continue once you see that message. ------------------------------------------------------ As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
