|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-07-2008, 07:54 AM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Infected with Bagel Virus, Trojan Downloader, etc
All antivirus and malware removal tools are disabled on my computer, they wont execute. I cannot startup in safemode at all. My computer seems to be running very hot as if something is running in the background, and issues occur like losing my computers sound, random shutdowns, disabled messenger, etc.
Panda Online Scan found several issues such as Bagle Win32 Worm, Trojan Downloader, Trojan Sniper, etc. No removals or scans work and Im out of options. Ive followed all of the advise, I think, and here are my logs: Logfile of random's system information tool 1.04 (written by random/random) Run by billy crystal at 2007-03-11 01:56:20 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 17 GB (25%) free of 66 GB Total RAM: 959 MB (35% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:56:29 AM, on 3/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Allume\StuffIt\MXTask.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\PROGRA~1\Allume\StuffIt\mxtask.exe C:\WINDOWS\hostsvc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\System32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\billy crystal\Desktop\RSIT.exe C:\Program Files\trend micro\billy crystal.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Cier] %WINDIR%\system32\Cier.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: &Lookup in Bookshelf - res://C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\bsdef.dll/#1001 O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O8 - Extra context menu item: Download linked FLV with GetFLV - C:\Program Files\GetFLV\iemenu\DownloadLinkFLV.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - C:\PROGRA~1\Allume\StuffIt\MXTask.exe -- End of file - 8548 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2007-07-29 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22 321120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2007-07-29 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2007-07-29 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22 321120] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "hpWirelessAssistant"=C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2005-01-23 692224] "High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-04-18 61952] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2005-01-23 692224] "Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2006-01-26 40960] "RecGuard"=C:\Windows\SMINST\RecGuard.exe [2005-10-11 1187840] "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952] "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392] "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168] "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-21 7561216] ""= [] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-10-25 282624] "QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-03-23 131072] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] "HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152] "Cier"=C:\WINDOWS\system32\Cier.exe [2007-05-09 57344] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2007-07-29 136600] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-03-03 185872] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "ccleaner"=C:\Program Files\CCleaner\ccleaner.exe [2007-07-26 1209584] "SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [] "Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] C:\PROGRA~1\HEWLET~1\HPPAVI~1\tsnp2std.exe [2006-03-30 98304] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] C:\PROGRA~1\MICROS~4\MICROS~1.0\qshelf.exe [2000-12-20 36911] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 "usnsvc"=3 "LiveUpdate"=3 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableLUA"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\Program Files\eMule\eMule.exe"="C:\Program Files\eMule\eMule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db044ef3-c515-11dc-8ecf-e420063e8ed2}] shell\AutoRun\command - G:\nideiect.com shell\explore\command - G:\nideiect.com shell\open\command - G:\nideiect.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e564bc56-5682-11dc-8ebf-9800260cc1dd}] shell\AutoRun\command - F:\nideiect.com shell\explore\command - F:\nideiect.com shell\open\command - F:\nideiect.com ======File associations====== .js - edit - .js - open - "H:\Adobe Creative Suite 3 Web Premium Crack\MAGNiTUDE\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1" .reg - edit - .reg - open - C:\I386\REGEDIT.EXE %1 ======List of files/folders created in the last 1 months====== 2007-11-02 11:29:31 ----A---- C:\WINDOWS\system32\zlib.dll 2007-11-02 11:29:17 ----HD---- C:\WINDOWS\Modules 2007-11-01 21:25:42 ----D---- C:\Documents and Settings\All Users\Application Data\ALM 2007-11-01 21:11:27 ----A---- C:\WINDOWS\system32\NPSWF32_FlashUtil.exe 2007-11-01 21:11:27 ----A---- C:\WINDOWS\system32\NPSWF32.dll 2007-11-01 21:01:43 ----D---- C:\Program Files\Bonjour 2007-11-01 20:54:42 ----D---- C:\Program Files\Common Files\Macrovision Shared 2007-11-01 01:13:13 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet 2007-10-02 16:51:26 ----D---- C:\Documents and Settings\billy crystal\Application Data\DivX 2007-09-30 03:19:49 ----A---- C:\WINDOWS\system32\pxafs.dll 2007-09-30 03:19:10 ----D---- C:\Program Files\DivX 2007-09-21 13:55:22 ----A---- C:\WINDOWS\Neuro.ini 2007-09-21 13:55:19 ----D---- C:\Program Files\Common Files\Asymetrix 2007-09-21 13:55:01 ----A---- C:\WINDOWS\uninst.exe 2007-09-17 10:23:00 ----A---- C:\WINDOWS\system32\divx_xx0c.dll 2007-09-17 10:23:00 ----A---- C:\WINDOWS\system32\divx_xx07.dll 2007-09-17 10:22:58 ----A---- C:\WINDOWS\system32\divx_xx11.dll 2007-09-17 10:22:58 ----A---- C:\WINDOWS\system32\DivX.dll 2007-09-11 15:14:30 ----A---- C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-08-20 16:26:52 ----A---- C:\WINDOWS\system32\dtu100.dll.manifest 2007-08-20 16:26:52 ----A---- C:\WINDOWS\system32\dtu100.dll 2007-08-20 16:26:52 ----A---- C:\WINDOWS\system32\dpl100.dll.manifest 2007-08-20 16:26:52 ----A---- C:\WINDOWS\system32\dpl100.dll 2007-08-15 14:33:18 ----A---- C:\WINDOWS\system32\DivXsm.exe 2007-08-15 14:33:14 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2007-08-15 14:33:06 ----A---- C:\WINDOWS\system32\ssldivx.dll 2007-08-15 14:33:06 ----A---- C:\WINDOWS\system32\libdivx.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpv11.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpus11.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpuGUI11.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpuGUI10.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpu11.dll 2007-08-15 14:31:00 ----A---- C:\WINDOWS\system32\dpu10.dll 2007-08-15 14:30:26 ----A---- C:\WINDOWS\system32\DivXWMPExtType.dll 2007-07-30 23:12:37 ----A---- C:\fuckinB.EXE 2007-07-29 01:37:56 ----A---- C:\WINDOWS\system32\locate.com 2007-07-29 01:36:15 ----D---- C:\MGtools 2007-07-29 01:34:44 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-07-29 01:26:16 ----A---- C:\WINDOWS\system32\javaws.exe 2007-07-29 01:26:16 ----A---- C:\WINDOWS\system32\javaw.exe 2007-07-29 01:26:16 ----A---- C:\WINDOWS\system32\java.exe 2007-07-29 01:26:16 ----A---- C:\WINDOWS\system32\deploytk.dll 2007-07-29 01:20:04 ----A---- C:\MGtools.exe 2007-07-28 04:27:57 ----D---- C:\Program Files\Bazooka Scanner 2007-07-28 04:22:32 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2007-07-27 00:01:04 ----D---- C:\Documents and Settings\billy crystal\Application Data\Malwarebytes 2007-07-27 00:00:59 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2007-07-27 00:00:59 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2007-07-27 00:00:40 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-07-27 00:00:22 ----D---- C:\Program Files\SUPERAntiSpyware 2007-07-27 00:00:22 ----D---- C:\Documents and Settings\billy crystal\Application Data\SUPERAntiSpyware.com 2007-07-26 23:59:27 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-26 09:31:49 ----D---- C:\Documents and Settings\billy crystal\Application Data\Uniblue 2007-07-26 09:31:13 ----D---- C:\Program Files\Uniblue 2007-07-26 09:19:23 ----D---- C:\Program Files\Spybot - Search & Destroy 2007-07-26 09:19:09 ----D---- C:\Program Files\AVG 2007-07-26 09:19:08 ----D---- C:\Documents and Settings\All Users\Application Data\avg8 2007-07-25 00:49:36 ----D---- C:\Documents and Settings\billy crystal\Application Data\Netscape 2007-07-11 02:01:24 ----D---- C:\Program Files\NJStar Japanese WP 2007-07-08 02:01:03 ----D---- C:\Program Files\NJStar Chinese WP 2007-07-05 15:44:52 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2007-07-05 15:44:49 ----D---- C:\Program Files\DVD Shrink 2007-07-05 14:40:54 ----D---- C:\Program Files\DVD Decrypter 2007-05-09 01:50:07 ----A---- C:\WINDOWS\system32\Cier.exe 2007-05-04 01:15:01 ----A---- C:\WINDOWS\GetFLV.ini 2007-04-26 10:57:26 ----D---- C:\Documents and Settings\billy crystal\Application Data\RealWorld 2007-04-26 10:57:02 ----D---- C:\Program Files\RealWorld Icon Editor 2007-04-21 13:55:32 ----A---- C:\WINDOWS\system32\ltmm15.dll 2007-04-21 13:55:31 ----A---- C:\WINDOWS\system32\DSKernel2.dll 2007-04-21 05:08:17 ----A---- C:\WINDOWS\AviSplitter.INI 2007-04-11 01:43:31 ----A---- C:\Documents and Settings\billy crystal\Application Data\inst.exe 2007-04-11 01:43:30 ----D---- C:\Documents and Settings\billy crystal\Application Data\Vso 2007-04-11 01:43:22 ----D---- C:\Program Files\VSO 2007-03-26 17:39:14 ----A---- C:\WINDOWS\system32\ac3config.exe 2007-03-21 20:54:16 ----A---- C:\WINDOWS\system32\TWUNK_32.EXE 2007-03-21 20:54:16 ----A---- C:\WINDOWS\system32\TWUNK_16.EXE 2007-03-21 20:54:16 ----A---- C:\WINDOWS\system32\TWAIN_32.DLL 2007-03-16 01:32:13 ----A---- C:\WINDOWS\DUMP97db.tmp 2007-03-15 03:49:58 ----A---- C:\WINDOWS\system32\E_DCINST.DLL 2007-03-15 03:49:54 ----A---- C:\WINDOWS\system32\EBPMON24.DLL 2007-03-15 03:49:54 ----A---- C:\WINDOWS\system32\E_SAGSET.DLL 2007-03-15 03:46:40 ----D---- C:\Program Files\CCleaner 2007-03-12 14:02:26 ----A---- C:\WINDOWS\system32\msjava.dll 2007-03-11 01:56:21 ----D---- C:\Program Files\trend micro 2007-03-11 01:56:20 ----D---- C:\rsit 2007-03-11 01:34:41 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2007-03-11 01:34:38 ----A---- C:\WINDOWS\gmer.exe 2007-03-10 23:40:06 ----D---- C:\Program Files\Exterminate It! 2007-03-10 23:18:06 ----D---- C:\Documents and Settings\billy crystal\Application Data\skypePM 2007-03-10 17:45:30 ----D---- C:\Program Files\Panda Security 2007-03-10 17:39:07 ----D---- C:\Program Files\BullGuard Ltd 2007-03-10 05:27:12 ----A---- C:\ComboFix.txt 2007-03-10 05:14:19 ----D---- C:\Program Files\Microsoft Reference 2007-03-08 23:12:32 ----A---- C:\WINDOWS\system32\AVSredirect.dll 2007-03-08 16:52:22 ----D---- C:\Documents and Settings\billy crystal\Application Data\Skype 2007-03-08 16:51:45 ----D---- C:\Program Files\Skype 2007-03-08 16:51:43 ----D---- C:\Program Files\Common Files\Skype 2007-03-08 16:51:17 ----D---- C:\Documents and Settings\All Users\Application Data\Skype 2007-03-06 01:14:48 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-03-06 01:14:48 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2007-03-04 08:51:12 ----D---- C:\Documents and Settings\billy crystal\Application Data\Help 2007-03-04 03:55:40 ----A---- C:\WINDOWS\system32\devil.dll 2007-03-04 03:55:31 ----A---- C:\WINDOWS\system32\avisynth.dll 2007-03-03 05:02:10 ----D---- C:\Program Files\Common Files\xing shared 2007-02-25 11:27:23 ----D---- C:\Program Files\XP Codec Pack 2007-02-15 17:03:14 ----A---- C:\WINDOWS\PROTOCOL.INI 2007-02-15 17:03:08 ----D---- C:\Program Files\GetFLV 2007-02-15 03:10:49 ----D---- C:\WINDOWS\nview 2007-02-15 03:10:49 ----A---- C:\WINDOWS\system32\nvudisp.exe 2007-02-14 03:53:13 ----A---- C:\WINDOWS\system32\nvunrm.exe 2007-02-14 00:36:03 ----D---- C:\Documents and Settings\All Users\Application Data\Ahead ======List of files/folders modified in the last 1 months====== 2008-08-26 13:28:14 ----A---- C:\WINDOWS\system32\MRT.exe 2007-11-20 12:14:59 ----D---- C:\Program Files\Adobe 2007-11-08 02:22:35 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe 2007-11-02 12:52:29 ----D---- C:\Program Files\Common Files\Adobe 2007-11-01 21:12:42 ----RSD---- C:\WINDOWS\Fonts 2007-11-01 21:08:14 ----D---- C:\WINDOWS\WinSxS 2007-11-01 19:29:40 ----D---- C:\Program Files\Macromedia 2007-11-01 19:27:48 ----D---- C:\Documents and Settings\All Users\Application Data\Macromedia 2007-11-01 19:25:39 ----D---- C:\WINDOWS\Downloaded Installations 2007-09-30 03:09:51 ----D---- C:\Program Files\Common Files\Microsoft Shared 2007-09-21 14:10:33 ----D---- C:\Program Files\Common Files\Symantec Shared 2007-09-21 14  30 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec2007-08-29 18:19:46 ----D---- C:\Program Files\Replay Converter 2007-08-15 14:33:12 ----A---- C:\WINDOWS\system32\PxWave.dll 2007-08-15 14:33:12 ----A---- C:\WINDOWS\system32\PxMas.dll 2007-08-15 14:33:12 ----A---- C:\WINDOWS\system32\pxhpinst.exe 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\VXBLOCK.dll 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\PxSFS.DLL 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\pxinsi64.exe 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\pxinsa64.exe 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\pxdrv.dll 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\pxcpyi64.exe 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\pxcpya64.exe 2007-08-15 14:33:10 ----A---- C:\WINDOWS\system32\Px.dll 2007-07-29 01:24:55 ----D---- C:\Program Files\Java 2007-07-29 00:48:42 ----A---- C:\WINDOWS\win.ini 2007-07-29 00:48:42 ----A---- C:\WINDOWS\system.ini 2007-07-29 00:48:42 ----A---- C:\boot.ini 2007-07-26 21:03:03 ----D---- C:\WINDOWS\system32\config 2007-07-26 20:54:34 ----SD---- C:\Documents and Settings\billy crystal\Application Data\Microsoft 2007-07-22 05:30:29 ----AC---- C:\WINDOWS\SoftWriting.ini 2007-07-21 21:40:45 ----RD---- C:\Program Files\NewSoft 2007-07-11 02:01:35 ----D---- C:\Documents and Settings\billy crystal\Application Data\NJStar 2007-07-09 05:56:04 ----DC---- C:\WINDOWS\system32\DRVSTORE 2007-07-09 05:56:03 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2007-04-30 13:55:27 ----D---- C:\WINDOWS\pss 2007-04-21 13:55:02 ----AC---- C:\WINDOWS\iun6002.exe 2007-03-21 14:36:45 ----AC---- C:\WINDOWS\viewer.ini 2007-03-11 01:56:25 ----D---- C:\WINDOWS\Prefetch 2007-03-11 01:56:21 ----D---- C:\Program Files 2007-03-11 01:38:04 ----D---- C:\WINDOWS\Temp 2007-03-11 01:34:42 ----HD---- C:\WINDOWS\system32\drivers 2007-03-11 01:34:41 ----D---- C:\WINDOWS 2007-03-11 01:18:03 ----D---- C:\WINDOWS\system32 2007-03-11 01:17:58 ----HD---- C:\WINDOWS\inf 2007-03-11 01:04:14 ----A---- C:\WINDOWS\cdplayer.ini 2007-03-10 22:38:54 ----A---- C:\WINDOWS\NeroDigital.ini 2007-03-10 17:45:46 ----D---- C:\WINDOWS\LastGood 2007-03-10 05:10:53 ----D---- C:\Program Files\Mozilla Firefox 2007-03-09 04:45:58 ----D---- C:\Documents and Settings\billy crystal\Application Data\Adobe 2007-03-08 16:52:12 ----SHD---- C:\WINDOWS\Installer 2007-03-08 16:51:43 ----D---- C:\Program Files\Common Files 2007-03-07 22:23:43 ----AC---- C:\WINDOWS\pccrcmd.ini 2007-03-05 18:34:55 ----D---- C:\Program Files\eMule 2007-03-03 05 47 ----D---- C:\WINDOWS\system32\CatRoot22007-03-03 05:01:31 ----D---- C:\Program Files\Common Files\Real 2007-03-03 05:01:14 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2007-03-03 05:00:06 ----A---- C:\WINDOWS\system32\pndx5032.dll 2007-03-03 05:00:06 ----A---- C:\WINDOWS\system32\pndx5016.dll 2007-03-03 04:59:54 ----A---- C:\WINDOWS\system32\msvcr71.dll 2007-03-03 04:59:53 ----A---- C:\WINDOWS\system32\msvcp71.dll 2007-03-03 04:59:52 ----A---- C:\WINDOWS\system32\pncrt.dll 2007-03-03 04:26:25 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2007-03-03 04:20:40 ----A---- C:\WINDOWS\SchedLgU.Txt 2007-02-15 03:13:22 ----D---- C:\WINDOWS\Help 2007-02-14 02:32:39 ----HD---- C:\Program Files\InstallShield Installation Information ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 36864] R1 eabfiltr;eabfiltr; C:\WINDOWS\system32\DRIVERS\eabfiltr.sys [2005-09-19 7808] R1 GEARAspiWDM;GearAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848] R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [] R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-02-15 12672] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-01-19 424320] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2005-09-19 9344] R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2006-04-18 569856] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2006-03-09 995712] R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2006-03-09 206976] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-21 3659872] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-03 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-03 13056] R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136] R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928] R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840] R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-11-01 308992] R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584] R3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-04 11136] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-03 192736] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-03 78464] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2006-03-09 726400] S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [] S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [] S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128] S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 eabusb;eabusb; C:\WINDOWS\system32\DRIVERS\eabusb.sys [2005-09-19 5760] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [] S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-03 51328] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-04-11 47360] S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [] S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-04 10240] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20061025.029\symidsco.sys [] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [] S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368] S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928] S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752] S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008] S4 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [] S4 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [] S4 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [] S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952] S4 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\DRIVERS\iaStor.sys [2005-10-13 874240] S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088] S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-03-15 135168] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2007-07-29 147456] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-02-17 73728] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-21 143427] R2 StuffIt Task Manager;StuffIt Task Manager; C:\PROGRA~1\Allume\StuffIt\MXTask.exe [2005-06-13 155648] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] S2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [] S2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe /service [] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2007-11-01 654848] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-06-08 208896] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-04-16 91184] S4 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [] S4 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [] S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service [] S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service [] S4 bdss;BitDefender Scan Server; C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe /service [] S4 VSSERV;BitDefender Virus Shield; C:\Program Files\Softwin\BitDefender10\vsserv.exe /service [] S4 XCOMM;BitDefender Communicator; C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe /service [] -----------------EOF----------------- |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-10-2008, 05:02 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= P2P P2P - I see you have P2P software eMule installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========= Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. Link 1 Link 2 Link 3   [*]Double click on combofix.exe & follow the prompts. [*]As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes, to continue scanning for malware. [*]Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. [*] When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. ======== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ======== Logs Required C:\Combofix.txt Hijackthis Log If there is no response to this post within 72hrs, this thread will be closed. |
|
|
|
|
11-10-2008, 10:15 AM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Thank you so very much!
Did it all. I couldnt attach the hijackthis log so Im pasting it here, sorry if thats wrong. ComboFix 08-11-09.04 - billy crystal 2008-11-10 8:48:10.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.691 [GMT -8:00] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\billy crystal\Application Data\inst.exe c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe c:\program files\Synaptics\SynTP\SynTPEnh.exe c:\windows\system32\drivers\down c:\windows\system32\drivers\downld c:\windows\system32\drivers\hldrrr.exe c:\windows\system32\drivers\mdelk.exe c:\windows\system32\drivers\srosa.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SROSA -------\Legacy_SROSA ((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-07-27 05:45 47,360 ----a-w c:\documents and settings\billy crystal\Application Data\pcouffin.sys 2006-08-15 17:33 202 ----a-w c:\program files\Shortcut to CD Drive.lnk 2005-01-23 11:04 692,224 ----a-w c:\documents and settings\billy crystal\CHDAudPropShortcut.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2007-07-26 1209584] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-01-02 0] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960] "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-21 7561216] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "Cier"="c:\windows\system32\Cier.exe" [2007-05-09 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2007-07-29 136600] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 c:\windows\system32\CHDAudPropShortcut.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax "vidc.iv50"= c:\progra~1\REPLAY~1\ir50_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] backup=c:\windows\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] backup=c:\windows\pss\MiniEYE-MiniREAD Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] backup=c:\windows\pss\QuickShelf.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) "usnsvc"=3 (0x3) "LiveUpdate"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db044ef3-c515-11dc-8ecf-e420063e8ed2}] \Shell\AutoRun\command - G:\nideiect.com \Shell\explore\Command - G:\nideiect.com \Shell\open\Command - G:\nideiect.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e564bc56-5682-11dc-8ebf-9800260cc1dd}] \Shell\AutoRun\command - F:\nideiect.com \Shell\explore\Command - F:\nideiect.com \Shell\open\Command - F:\nideiect.com *Newly Created Service* - PAVBOOT *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B33E3606-F7C0-F005-E205-FC012005E904}] c:\windows\hostsvc.exe . - - - - ORPHANS REMOVED - - - - HKCU-Run-MsgCenterExe - c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe HKLM-Run-hpWirelessAssistant - c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe HKLM-Run-SynTPEnh - c:\program files\Synaptics\SynTP\SynTPEnh.exe SafeBoot-BgMainSvc . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\billy crystal\Application Data\Mozilla\Firefox\Profiles\kivr3hs9.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ FF -: plugin - c:\program files\Adobe\Acrobat 8.0\Acrobat\browser\nppdf32.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-10 08:53:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???`S????????@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\srosa] . Completion time: 2008-11-10 9:00:13 ComboFix-quarantined-files.txt 2008-11-10 16:59:29 ComboFix2.txt 2007-03-10 13:28:25 Pre-Run: 17,337,614,336 bytes free Post-Run: 17,329,995,776 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer 129 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:09:23 AM, on 11/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Allume\StuffIt\MXTask.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\PROGRA~1\Allume\StuffIt\mxtask.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\hostsvc.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\System32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Cier] %WINDIR%\system32\Cier.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: &Lookup in Bookshelf - res://C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\bsdef.dll/#1001 O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O8 - Extra context menu item: Download linked FLV with GetFLV - C:\Program Files\GetFLV\iemenu\DownloadLinkFLV.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - C:\PROGRA~1\Allume\StuffIt\MXTask.exe -- End of file - 7876 bytes Last edited by TheBruce1; 11-10-2008 at 10:38 AM. |
|
|
|
|
11-10-2008, 11:19 AM
|
#4 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello again
Do NOT attach logs to you`re post, just copy/paste them into you`re replies. ======== Quote:
Cracked (Illegal) Software & Keygens This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk. Even a single click on the site can drop multiple forms of very serious malware, many of which disable your on-board protection, and System Restore. If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer. Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications. Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine In accordance with the rules I have every right to stop help from this point, but I do believe that education about the effects that P2P/cracks/keygens have in supporting the role of malware, these outlets are the main cause of malware that we see everyday in logs. Any other illegal software that you have, even though they do not appear as trojans themselves, will come from sites that support and promote malware which unknowingly to you, can provide backdoors to your machine and install other malicious items. Please remove Adobe Creative Suite 3 Web Premium Crack and any other crack programme you have installed. ======== Can you tell me which antivirus software you have currently installed, i see entries for, Avast, AVG and Bitdefender in you`re logs. ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s). ======== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
This animation will guide you through the process:  To optimize scanning time and produce a more sensible report for review:
========== Please run RSIT again and post the log.txt in your reply. ========== Logs Required C:\Combofix.txt Kaspersky Scan Report log.txt How is your system running now. |
||
|
|
|
|
11-11-2008, 08:05 AM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Thank you for your help, and advise. Ill follow what you say!
My computer is running better now, yes. I have Spybot for my antivirus, the others Ive disabled. Here are my logs: ComboFix 08-11-09.04 - billy crystal 2008-11-11 4:02:18.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.435 [GMT -8:00] Running from: c:\documents and settings\billy crystal\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\billy crystal\Desktop\CFscript.txt * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 12:01 --------- d-----w c:\documents and settings\billy crystal\Application Data\Skype 2008-11-11 11:47 --------- d-----w c:\documents and settings\billy crystal\Application Data\skypePM 2008-11-11 11:40 27,648 ----a-w c:\windows\system32\zlib.dll 2008-11-10 17:09 --------- d-----w c:\program files\trend micro 2007-07-27 05:45 47,360 ----a-w c:\documents and settings\billy crystal\Application Data\pcouffin.sys 2006-08-15 17:33 202 ----a-w c:\program files\Shortcut to CD Drive.lnk 2005-01-23 11:04 692,224 ----a-w c:\documents and settings\billy crystal\CHDAudPropShortcut.exe . ((((((((((((((((((((((((((((( snapshot@2008-11-10_ 8.53.36.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-16 14:59:10 3,080,568 ----a-w c:\windows\system32\FNTCACHE.DAT + 2007-02-11 11:26:32 3,080,512 ----a-w c:\windows\system32\FNTCACHE.DAT - 2008-11-10 16:51:44 53,166 ----a-w c:\windows\system32\perfc009.dat + 2007-02-11 11:28:51 53,166 ----a-w c:\windows\system32\perfc009.dat - 2008-11-10 16:51:44 380,918 ----a-w c:\windows\system32\perfh009.dat + 2007-02-11 11:28:51 380,918 ----a-w c:\windows\system32\perfh009.dat + 2008-11-11 11:43:56 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_254.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2007-07-26 1209584] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960] "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-21 7561216] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2007-07-29 136600] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 c:\windows\system32\CHDAudPropShortcut.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax "vidc.iv50"= c:\progra~1\REPLAY~1\ir50_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] backup=c:\windows\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] backup=c:\windows\pss\MiniEYE-MiniREAD Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] backup=c:\windows\pss\QuickShelf.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) "usnsvc"=3 (0x3) "LiveUpdate"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [ ] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 04:03:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???0S????????@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-11 4:04:52 ComboFix-quarantined-files.txt 2008-11-11 12:04:38 ComboFix2.txt 2008-11-11 11:48:55 ComboFix3.txt 2008-11-10 17:00:15 ComboFix4.txt 2007-03-10 13:28:25 Pre-Run: 19,004,923,904 bytes free Post-Run: 18,992,148,480 bytes free 95 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, November 11, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, November 11, 2008 11:02:48 Records in database: 1379718 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 68134 Threat name: 6 Infected objects: 35 Suspicious objects: 0 Duration of the scan: 01:59:50 File name / Threat name / Threats count C:\Documents and Settings\billy crystal\CHDAudPropShortcut.exe Infected: Trojan-Downloader.Win32.Bagle.to 1 C:\Documents and Settings\billy crystal\My Documents\XXXXXXXXXXXXXXX\LHBF Adds\Free Website Hits Counter 1.2\Free Website Hits Counter 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.jo 1 C:\Documents and Settings\billy crystal\My Documents\XXXXXXXXXXXXXXX\LHBF Adds\GetFLV Pro 2.5 (KeyGen)\GetFLV Pro 2.5 (KeyGen).exe Infected: Trojan-Downloader.Win32.Bagle.jr 1 C:\Qoobox\Quarantine\C\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe.vir Infected: Trojan-Downloader.Win32.Bagle.to 1 C:\Qoobox\Quarantine\C\Program Files\Synaptics\SynTP\SynTPEnh.exe.vir Infected: Trojan-Downloader.Win32.Bagle.to 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\hldrrr.exe.vir Infected: Trojan-Downloader.Win32.Bagle.to 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\mdelk.exe.vir Infected: Trojan-Downloader.Win32.Bagle.to 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_srosa_.sys.zip Infected: Trojan-Downloader.Win32.Bagle.mm 1 C:\Qoobox\Quarantine\[4]-Submit_2008-11-11@3.39.zip Infected: Backdoor.Win32.VB.bax 1 C:\Qoobox\Quarantine\[4]-Submit_2008-11-11@3.39.zip Infected: Trojan-Downloader.Win32.Small.eco 1 C:\WINDOWS\Modules\adapter.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\audiocap.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\c2c.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\c2s.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\cdkeys.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\dos.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\filemanager.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\firefox.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\installedapps.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\keylogger.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\listprocesses.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\listwindows.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\main.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\miscspy.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\pass.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\portredir.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\power.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\proxy.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\registry.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\screencap.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\search.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\services.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\sniffer.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\sysinfo.dll Infected: Backdoor.Win32.VB.bax 1 C:\WINDOWS\Modules\webcam.dll Infected: Backdoor.Win32.VB.bax 1 The selected area was scanned. Logfile of random's system information tool 1.04 (written by random/random) Run by billy crystal at 2008-11-11 06:39:17 Microsoft Windows XP Home Edition Service Pack 2 System drive C: has 18 GB (28%) free of 66 GB Total RAM: 959 MB (54% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:39:30 AM, on 11/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Allume\StuffIt\MXTask.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Allume\StuffIt\mxtask.exe C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Java\jre6\bin\java.exe C:\Documents and Settings\billy crystal\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\billy crystal.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: &Lookup in Bookshelf - res://C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\bsdef.dll/#1001 O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O8 - Extra context menu item: Download linked FLV with GetFLV - C:\Program Files\GetFLV\iemenu\DownloadLinkFLV.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - C:\PROGRA~1\Allume\StuffIt\MXTask.exe -- End of file - 5698 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2007-07-29 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2007-07-29 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2007-07-29 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-04-18 61952] "Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2006-01-26 40960] "RecGuard"=C:\Windows\SMINST\RecGuard.exe [2005-10-11 1187840] "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952] "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392] "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168] "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-21 7561216] "QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-03-23 131072] "HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2007-07-29 136600] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "ccleaner"=C:\Program Files\CCleaner\ccleaner.exe [2007-07-26 1209584] "Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] C:\PROGRA~1\HEWLET~1\HPPAVI~1\tsnp2std.exe [2006-03-30 98304] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] C:\PROGRA~1\MICROS~4\MICROS~1.0\qshelf.exe [2000-12-20 36911] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 "usnsvc"=3 "LiveUpdate"=3 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BgLiveSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= "NoDriveAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" ======File associations====== .js - edit - .js - open - .reg - edit - .reg - open - C:\I386\REGEDIT.EXE %1 .txt - open - ======List of files/folders created in the last 1 months====== 2008-11-11 05:04:55 ----SHD---- C:\RECYCLER 2008-11-11 04:04:52 ----A---- C:\ComboFix.txt 2008-11-11 04:03:32 ----A---- C:\WINDOWS\PSEXESVC.EXE 2008-11-11 03:36:48 ----A---- C:\WINDOWS\NIRCMD.exe 2008-11-10 03:54:16 ----A---- C:\Boot.bak 2008-11-10 03:54:01 ----RASHD---- C:\cmdcons 2008-11-10 03:50:03 ----A---- C:\WINDOWS\zip.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\VFIND.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\SWSC.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\SWREG.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\sed.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\grep.exe 2008-11-10 03:50:03 ----A---- C:\WINDOWS\fdsv.exe ======List of files/folders modified in the last 1 months====== 2008-11-11 04:13:08 ----D---- C:\Documents and Settings\billy crystal\Application Data\Skype 2008-11-11 04:05:49 ----D---- C:\Program Files\Mozilla Firefox 2008-11-11 04:04:57 ----D---- C:\WINDOWS\Temp 2008-11-11 04:04:56 ----D---- C:\WINDOWS\system32 2008-11-11 04:04:56 ----D---- C:\Qoobox 2008-11-11 04:03:34 ----D---- C:\WINDOWS 2008-11-11 04:03:34 ----A---- C:\WINDOWS\system.ini 2008-11-11 04:03:06 ----HD---- C:\WINDOWS\system32\drivers 2008-11-11 04:03:06 ----D---- C:\Program Files\Common Files 2008-11-11 04:03:05 ----D---- C:\WINDOWS\AppPatch 2008-11-11 04:01:46 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-11-11 03:58:43 ----D---- C:\Program Files 2008-11-11 03:48:26 ----D---- C:\WINDOWS\ERDNT 2008-11-11 03:47:15 ----D---- C:\Documents and Settings\billy crystal\Application Data\skypePM 2008-11-11 03:42:00 ----AC---- C:\WINDOWS\MXDebug2.ini 2008-11-11 03:40:16 ----A---- C:\WINDOWS\system32\zlib.dll 2008-11-10 09:09:15 ----D---- C:\Program Files\trend micro 2008-11-10 09:03:52 ----D---- C:\WINDOWS\Debug 2008-11-10 09:03:05 ----D---- C:\WINDOWS\Prefetch 2008-11-10 03:54:17 ----RASH---- C:\boot.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 36864] R1 eabfiltr;eabfiltr; C:\WINDOWS\system32\DRIVERS\eabfiltr.sys [2005-09-19 7808] R1 GEARAspiWDM;GearAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848] R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [] R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-02-15 12672] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-01-19 424320] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2005-09-19 9344] R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2006-04-18 569856] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2006-03-09 995712] R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2006-03-09 206976] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-21 3659872] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-03 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-03 13056] R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 11136] R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928] R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840] R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-11-01 308992] R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-03 192736] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-03 78464] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2006-03-09 726400] S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [] S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [] S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128] S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 eabusb;eabusb; C:\WINDOWS\system32\DRIVERS\eabusb.sys [2005-09-19 5760] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [] S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-03 51328] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-04-11 47360] S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [] S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-04 11136] S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-04 10240] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20061025.029\symidsco.sys [] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [] S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368] S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928] S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752] S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008] S4 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [] S4 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [] S4 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [] S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952] S4 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\DRIVERS\iaStor.sys [2005-10-13 874240] S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088] S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-03-15 135168] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2007-07-29 147456] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-02-17 73728] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-21 143427] R2 StuffIt Task Manager;StuffIt Task Manager; C:\PROGRA~1\Allume\StuffIt\MXTask.exe [2005-06-13 155648] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] S2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe /service [] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-06-08 208896] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-04-16 91184] S4 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [] S4 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [] S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service [] S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service [] S4 bdss;BitDefender Scan Server; C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe /service [] S4 VSSERV;BitDefender Virus Shield; C:\Program Files\Softwin\BitDefender10\vsserv.exe /service [] S4 XCOMM;BitDefender Communicator; C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe /service [] -----------------EOF----------------- |
|
|
|
|
11-11-2008, 09:04 AM
|
#6 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello again
When i ask for a Hijackthis Log, just run Hijackthis and not RSIT. ======== Please upload this file: C:\Qoobox\Quarantine\[4]-Submit_2008-11-11@3.39.zip To this website: http://www.bleepingcomputer.com/subm....php?channel=4 Include this link in you`re submission: http://www.techsupportforum.com/security-center/hijackthis-log-help/310413-infected-bagel-virus-trojan-downloader-etc.html Let me know if you were successful/unsuccessful. ========== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== Quote:
========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Avira Scan Report Hijackthis Log |
||
|
|
|
|
11-11-2008, 09:55 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
c:\windows\Modules\adapter.dll
c:\windows\Modules\audiocap.dll c:\windows\Modules\c2c.dll c:\windows\Modules\c2s.dll c:\windows\Modules\cdkeys.dll c:\windows\Modules\dos.dll c:\windows\Modules\filemanager.dll c:\windows\Modules\firefox.dll c:\windows\Modules\installedapps.dll c:\windows\Modules\keylogger.dll c:\windows\Modules\listprocesses.dll c:\windows\Modules\listwindows.dll c:\windows\Modules\main.dll c:\windows\Modules\miscspy.dll c:\windows\Modules\pass.dll c:\windows\Modules\portredir.dll c:\windows\Modules\power.dll c:\windows\Modules\proxy.dll c:\windows\Modules\registry.dll c:\windows\Modules\screencap.dll c:\windows\Modules\search.dll c:\windows\Modules\services.dll c:\windows\Modules\sniffer.dll c:\windows\Modules\sysinfo.dll c:\windows\Modules\webcam.dll . ((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 12:13 --------- d-----w c:\documents and settings\billy crystal\Application Data\Skype 2008-11-11 11:47 --------- d-----w c:\documents and settings\billy crystal\Application Data\skypePM 2008-11-11 11:40 27,648 ----a-w c:\windows\system32\zlib.dll 2008-11-10 17:09 --------- d-----w c:\program files\trend micro 2007-07-27 05:45 47,360 ----a-w c:\documents and settings\billy crystal\Application Data\pcouffin.sys 2006-08-15 17:33 202 ----a-w c:\program files\Shortcut to CD Drive.lnk . ((((((((((((((((((((((((((((( snapshot@2008-11-10_ 8.53.36.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-16 14:59:10 3,080,568 ----a-w c:\windows\system32\FNTCACHE.DAT + 2007-02-11 11:26:32 3,080,512 ----a-w c:\windows\system32\FNTCACHE.DAT - 2008-11-10 16:51:44 53,166 ----a-w c:\windows\system32\perfc009.dat + 2007-02-11 11:28:51 53,166 ----a-w c:\windows\system32\perfc009.dat - 2008-11-10 16:51:44 380,918 ----a-w c:\windows\system32\perfh009.dat + 2007-02-11 11:28:51 380,918 ----a-w c:\windows\system32\perfh009.dat + 2008-11-11 11:43:56 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_254.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2007-07-26 1209584] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960] "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-21 7561216] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2007-07-29 136600] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 c:\windows\system32\CHDAudPropShortcut.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax "vidc.iv50"= c:\progra~1\REPLAY~1\ir50_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] backup=c:\windows\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] backup=c:\windows\pss\MiniEYE-MiniREAD Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] backup=c:\windows\pss\QuickShelf.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) "usnsvc"=3 (0x3) "LiveUpdate"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [ ] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 09:45:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???0S????????@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-11 9:46:21 ComboFix-quarantined-files.txt 2008-11-11 17:45:45 ComboFix2.txt 2008-11-11 12:04:52 ComboFix3.txt 2008-11-11 11:48:55 ComboFix4.txt 2008-11-10 17:00:15 ComboFix5.txt 2008-11-11 17:39:49 Pre-Run: 18,915,287,040 bytes free Post-Run: 18,950,156,288 bytes free 1126 Last edited by mokkori; 11-11-2008 at 10:07 PM. |
|
|
|
|
11-11-2008, 11:18 PM
|
#8 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:28 PM, on 11/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Allume\StuffIt\MXTask.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Allume\StuffIt\mxtask.exe C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\QuickTime\QuickTimePlayer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\trend micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: &Lookup in Bookshelf - res://C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\bsdef.dll/#1001 O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O8 - Extra context menu item: Download linked FLV with GetFLV - C:\Program Files\GetFLV\iemenu\DownloadLinkFLV.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - C:\PROGRA~1\Allume\StuffIt\MXTask.exe -- End of file - 6406 bytes Avira AntiVir Personal Report file date: Tuesday, November 11, 2008 21:07 Scanning for 1026777 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: PC197816517210 Version information: BUILD.DAT : 8.2.0.336 16933 Bytes 10/30/2008 11:40:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 6/26/2008 18:57:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 17:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 22:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 17:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 18:04:58 ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 11/9/2008 18:05:02 ANTIVIR2.VDF : 7.1.0.57 2048 Bytes 11/9/2008 18:05:02 ANTIVIR3.VDF : 7.1.0.70 84480 Bytes 11/11/2008 18:05:03 Engineversion : 8.2.0.31 AEVDF.DLL : 8.1.0.6 102772 Bytes 10/14/2008 20:05:56 AESCRIPT.DLL : 8.1.1.15 332156 Bytes 11/11/2008 18:05:19 AESCN.DLL : 8.1.1.5 123251 Bytes 11/11/2008 18:05:18 AERDL.DLL : 8.1.1.3 438645 Bytes 11/11/2008 18:05:17 AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 18:05:15 AEOFFICE.DLL : 8.1.0.30 196986 Bytes 11/11/2008 18:05:14 AEHEUR.DLL : 8.1.0.71 1487222 Bytes 11/11/2008 18:05:13 AEHELP.DLL : 8.1.1.3 119157 Bytes 11/11/2008 18:05:08 AEGEN.DLL : 8.1.1.0 319859 Bytes 11/11/2008 18:05:07 AEEMU.DLL : 8.1.0.9 393588 Bytes 10/14/2008 20:05:56 AECORE.DLL : 8.1.4.1 172405 Bytes 11/11/2008 18:05:06 AEBB.DLL : 8.1.0.3 53618 Bytes 10/14/2008 20:05:56 AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 18:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 19:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 11/11/2008 18:05:04 AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 21:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 18:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 22:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 03:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 22:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 22:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 23:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 23:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Tuesday, November 11, 2008 21:07 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'wordpad.exe' - '1' Module(s) have been scanned Scan process 'HijackThis.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'QuickTimePlayer.exe' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'MXTask.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'hpqwmiex.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'MXTask.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 38 processes with 38 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '63' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' <D> End of the scan: Tuesday, November 11, 2008 22:03 Used time: 56:40 Minute(s) The scan has been done completely. 5486 Scanning directories 297971 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 297969 Files not concerned 9131 Archives were scanned 2 Warnings 0 Notes |
|
|
|
|
11-12-2008, 07:31 AM
|
#9 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello again
File uploaded successfully, thank you. ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:. =========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ============ Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
11-12-2008, 08:42 AM
|
#10 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
ComboFix 08-11-09.04 - billy crystal 2008-11-12 7:30:42.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.357 [GMT -8:00] Running from: c:\documents and settings\billy crystal\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\billy crystal\Desktop\CFscript.txt * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 ))))))))))))))))))))))))))))))) . 2008-11-11 10:01 . 2008-11-11 10:01 <DIR> d-------- c:\program files\Avira 2008-11-11 10:01 . 2008-11-11 10:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 18:53 --------- d-----w c:\program files\Replay Converter 2008-11-11 12:13 --------- d-----w c:\documents and settings\billy crystal\Application Data\Skype 2008-11-11 11:47 --------- d-----w c:\documents and settings\billy crystal\Application Data\skypePM 2008-11-11 11:40 27,648 ----a-w c:\windows\system32\zlib.dll 2008-11-10 17:09 --------- d-----w c:\program files\trend micro 2007-07-27 05:45 47,360 ----a-w c:\documents and settings\billy crystal\Application Data\pcouffin.sys 2006-08-15 17:33 202 ----a-w c:\program files\Shortcut to CD Drive.lnk . ((((((((((((((((((((((((((((( snapshot@2008-11-10_ 8.53.36.40 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-09 21:15:51 45,376 ----a-w c:\windows\system32\drivers\avgntdd.sys + 2008-01-22 02:11:28 22,336 ----a-w c:\windows\system32\drivers\avgntmgr.sys + 2008-11-11 18:05:22 75,072 ----a-w c:\windows\system32\drivers\avipbb.sys + 2007-03-01 18:34:22 28,352 ----a-w c:\windows\system32\drivers\ssmdrv.sys - 2008-01-16 14:59:10 3,080,568 ----a-w c:\windows\system32\FNTCACHE.DAT + 2007-02-11 11:26:32 3,080,512 ----a-w c:\windows\system32\FNTCACHE.DAT - 2008-11-10 16:51:44 53,166 ----a-w c:\windows\system32\perfc009.dat + 2007-02-11 11:28:51 53,166 ----a-w c:\windows\system32\perfc009.dat - 2008-11-10 16:51:44 380,918 ----a-w c:\windows\system32\perfh009.dat + 2007-02-11 11:28:51 380,918 ----a-w c:\windows\system32\perfh009.dat + 2008-11-11 11:43:56 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_254.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2007-07-26 1209584] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960] "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-21 7561216] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2007-07-29 136600] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 c:\windows\system32\CHDAudPropShortcut.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax "vidc.iv50"= c:\progra~1\REPLAY~1\ir50_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk] backup=c:\windows\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk] backup=c:\windows\pss\MiniEYE-MiniREAD Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickShelf.lnk] backup=c:\windows\pss\QuickShelf.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^billy crystal^Start Menu^Programs^StartUp^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) "usnsvc"=3 (0x3) "LiveUpdate"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [ ] *Newly Created Service* - ANTIVIRSCHEDULER *Newly Created Service* - ANTIVIRSERVICE *Newly Created Service* - AVGIO *Newly Created Service* - AVGNTFLT *Newly Created Service* - AVIPBB . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-12 07:31:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???0S????????@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-12 7:35:20 ComboFix-quarantined-files.txt 2008-11-12 15:35:14 ComboFix2.txt 2008-11-11 17:46:22 ComboFix3.txt 2008-11-11 12:04:52 ComboFix4.txt 2008-11-11 11:48:55 ComboFix5.txt 2008-11-12 15:29:16 Pre-Run: 18,937,827,328 bytes free Post-Run: 18,927,116,288 bytes free 109 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:40:06 AM, on 11/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Allume\StuffIt\MXTask.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Allume\StuffIt\mxtask.exe C:\WINDOWS\System32\NOTEPAD.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\QuickTime\QuickTimePlayer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\trend micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: &Lookup in Bookshelf - res://C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\bsdef.dll/#1001 O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O8 - Extra context menu item: Download linked FLV with GetFLV - C:\Program Files\GetFLV\iemenu\DownloadLinkFLV.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q306&bd=pavilion&pf=laptop O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - C:\PROGRA~1\Allume\StuffIt\MXTask.exe -- End of file - 6269 bytes |
|
|
|
|
11-13-2008, 04:50 AM
|
#11 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello again
Did you install a two-way firewall as set out in my last post, a two way firewall will offer you greater protection that windows firewall, which only offers inbound protection. ======== Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe (file missing) Please remember to close all other windows, including browsers then click Fix checked. ========= If there are no further issues, continue below. ========= Delete RSIT from your desktop, also delete this folder c:\rsit. Uninstall Hijackthis via add/remove. =========== Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ============= Clear IE6 cookies *Open IE and click Tools *Click on Internet Options *Click on General Tab *Click on Delte Temp Files & Cookies buttons. Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place.
------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
|
11-13-2008, 11:25 AM
|
#12 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Okay, Ive followed everything and my computers working great! So many thanks to you!
I installed the firewall yes. However, just trying to run some applications like Dr.WebCureit, Spybot, and Combofix (regular one) but they wouldnt run saying it wasnt a valid win32 application. Is that a problem? Thanks again! 
|
|
|
|
|
11-13-2008, 01:32 PM
|
#13 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Hello again
Quote:
Quote:
Last edited by TheBruce1; 11-13-2008 at 01:34 PM. |
||
|
|
|
|
11-13-2008, 10:12 PM
|
#14 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 12
OS: xp
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
I didnt know that about combofix, Ill be more careful.
All applications give me the exact same message (except for the address): C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe is not a valid Win32 application |
|
|
|
|
11-14-2008, 06:28 AM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Infected with Bagel Virus, Trojan Downloader, etc
Because you installed crack programs and in turn they installed backdoor trojans you`re system might be unstable and/or wide open to re-infection, there is no way for us to know where these backdoor`s are, if this has happen a couple of times, you should consider formatting, as this is the only way to be sure you are clean.
Hopefully you will learn NOT to use crack software, unless you are prepared to format everytime, which makes the whole exercise of installing crack programs, pointless. |
|
|
|
| Thread Tools | |
|
|
