|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-09-2008, 06:03 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 6
OS: xp
|
Apparent Malware/Spyware problem
Seem to have some sort of spyware/malware problem. My antivirus software isn't able to update itself and I can't access the websites for AVG, norton, mcafee, etc. Also, my web search results are redirected on google.
Here's my HJ logfile: -------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:35:08 PM, on 11/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\stsystra.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\regsvr32.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Documents and Settings\Dave Whalen\Application Data\gadcom\gadcom.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\PROGRA~1\AVG\AVG8\aAvgApi.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.ca.dell.com/content/defa...=ca&l=en&s=gen R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca O2 - BHO: C:\WINDOWS\system32\jsne87fidgf.dll - {c5bf49a2-94f3-42bd-f434-3604812c897d} - C:\WINDOWS\system32\jsne87fidgf.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [xtezvpoecqrgjoa] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\ffksqtcpfaaaeh.dll" O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\DAVEWH~1\LOCALS~1\Temp\winlogin.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [DriveSentry] C:\Program Files\DriveSentry\DriveSentry.exe O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Dave Whalen\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139 O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\DAVEWH~1\LOCALS~1\Temp\winlogin.exe O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\DAVEWH~1\LOCALS~1\Temp\csrssc.exe O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\.DEFAULT\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: FIFA 09 Registration.lnk = C:\Program Files\EA SPORTS\FIFA 09\Support\EAregister.exe O4 - Startup: NHL® 09 Registration.lnk = C:\Program Files\EA SPORTS\NHL 09\Support\EAregister.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1157038000312 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://nsprdnacw-vip.aliant.net/lwp/...XInstaller.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: karna.dat,avgrsstx.dll O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 12797 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-11-2008, 01:45 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Apparent Malware/Spyware problem
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ If you're not receiving help elsewhere and still require assistance for this issue, please follow the process outlined here: NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help After running through all the steps, you shall have a proper set of logs. Please post/attach as instructed. If you have trouble with one of the steps, simply move on to the next one, and make note of it in your next reply. ------------------------------------------------------ |
|
|
|
|
11-11-2008, 04:58 PM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 6
OS: xp
|
Re: Apparent Malware/Spyware problem
I've pasted/attached the requested scan info. Perhaps I should mention that I wasn't able to download either the dds or gmer download on my infected laptop. Instead, I downloaded the files on a desktop and transfered them over to the laptop.
cheers, DDS (Version 1.0) - NTFSx86 Run by Dave Whalen at 20:18:52.06 on Tue 11/11/2008 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.463 [GMT -3.5:30] ============== Psuedo HJT Report =============== uStart Page = www.google.com uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uDefault_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca uInternet Connection Wizard,ShellNext = hxxp://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca mSearchAssistant = hxxp://www.google.com BHO: {c5bf49a2-94f3-42bd-f434-3604812c897d} - c:\windows\system32\jsne87fidgf.dll TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - c:\progra~1\avg\avg8\AVGTOO~1.DLL TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - c:\progra~1\avg\avg8\AVGTOO~1.DLL uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent uRun: [DellTransferAgent] "c:\documents and settings\all users\application data\dell\transferagent\TransferAgent.exe" uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe uRun: [gadcom] "c:\documents and settings\dave whalen\application data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139 uRun: [Google Update] "c:\documents and settings\dave whalen\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [xsjfn83jkemfofght] c:\docume~1\davewh~1\locals~1\temp\winlogin.exe uRun: [Jnskdfmf9eldfd] c:\docume~1\davewh~1\locals~1\temp\csrssc.exe uRun: [Gool] "c:\documents and settings\dave whalen\application data\gool\Gool.exe" uRun: [Sen] "c:\windows\ssembl~1\dexplore.exe" -vt ndrv uRun: [Seznltci] "c:\documents and settings\dave whalen\application data\s?stem\?xplorer.exe" mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe" mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe" mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe" mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [xtezvpoecqrgjoa] c:\windows\system32\regsvr32.exe /s "c:\windows\system32\ffksqtcpfaaaeh.dll" mRun: [xsjfn83jkemfofght] c:\docume~1\davewh~1\locals~1\temp\winlogin.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe dRun: [brastk] c:\windows\system32\brastk.exe StartupFolder: c:\docume~1\davewh~1\startm~1\programs\startup\fifa09~1.lnk - c:\program files\ea sports\fifa 09\support\EAregister.exe StartupFolder: c:\docume~1\davewh~1\startm~1\programs\startup\nhl09r~1.lnk - c:\program files\ea sports\nhl 09\support\EAregister.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE uPolicies-explorer: NoFolderOptions = 0 (0x0) IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html IE: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: igfxcui -igfxdev.dll AppInit_DLLs: karna.dat,avgrsstx.dll SSODL: {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll STS: {C5BF49A2-94F3-42BD-F434-3604812C897D} - c:\windows\system32\jsne87fidgf.dll ============= SERVICES / DRIVERS =============== R1 avgldx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe R2 wrconsumerservice;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe =============== Created Last 30 ================ 2008-11-11 20:14 250 a------- c:\windows\gmer.ini 2008-11-09 19:49 <DIR> --d----- C:\Binaries 2008-11-09 19:49 1,553,272 a------- c:\windows\WRSetup.dll 2008-11-09 19:49 <DIR> --d----- c:\docume~1\davewh~1\applic~1\Webroot 2008-11-09 19:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Webroot 2008-11-09 19:49 <DIR> --d----- c:\program files\Webroot 2008-11-09 19:40 164 a------- C:\install.dat 2008-11-09 17:47 1,374 a------- c:\windows\imsins.BAK 2008-11-09 15:12 <DIR> --d-h--- c:\program files\Outerinfo 2008-11-09 15:12 <DIR> --d----- c:\docume~1\davewh~1\applic~1\s?stem 2008-11-09 15:12 <DIR> --d----- c:\windows\?ssembly 2008-11-09 15:07 <DIR> --dsh--- c:\windows\RGF2ZSBXaGFsZW4 2008-11-09 14:52 <DIR> --d----- c:\docume~1\davewh~1\applic~1\Gool 2008-11-09 14:47 <DIR> --d----- c:\program files\Webtools 2008-11-09 14:42 <DIR> --d----- c:\program files\Mjcore 2008-11-08 19:59 <DIR> --d----- c:\program files\Enigma Software Group 2008-11-08 17:32 486,678 a------- C:\HaxFix.exe 2008-11-08 17:32 <DIR> --d----- C:\HaxFix 2008-11-08 16:18 <DIR> --d----- c:\windows\system32\NtmsData 2008-11-08 14:34 <DIR> --d----- c:\program files\Trend Micro 2008-11-07 23:02 2 a------- c:\windows\msoffice.ini 2008-11-07 21:15 <DIR> --d-h--- c:\windows\PIF 2008-11-07 21:14 380,928 -----r-- c:\windows\system32\pSOAP32.dll 2008-11-07 21:14 188,416 -----r-- c:\windows\system32\pocketHTTP.dll 2008-11-07 21:14 110,676 -----r-- c:\windows\system32\psDime.dll 2008-11-07 21:14 73,728 -----r-- c:\windows\system32\psProxy.dll 2008-11-07 20:56 <DIR> --d----- c:\program files\Lavasoft 2008-11-07 20:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Lavasoft 2008-11-07 20:55 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2008-11-07 20:36 1,435,272 a------- c:\windows\system32\Flash.ocx 2008-11-07 20:36 423,784 a------- c:\windows\system32\XceedBkp.dll 2008-11-07 20:36 389,120 a------- c:\windows\system32\ACTSKN43.OCX 2008-11-07 20:36 188,416 a------- c:\windows\system32\actsplash.ocx 2008-11-07 20:36 131,856 a------- c:\windows\system32\MSADODC.ocx 2008-11-07 20:36 101,888 a------- c:\windows\system32\VB6STKIT.DLL 2008-11-07 20:36 89,088 a------- c:\windows\system32\ProgressBar4.ocx 2008-11-07 20:36 11,012 a------- c:\windows\system32\threadapi.tlb 2008-11-07 19:36 <DIR> --d-h--- C:\$AVG8.VAULT$ 2008-11-07 19:28 97,928 a------- c:\windows\system32\drivers\avgldx86.sys 2008-11-07 19:28 10,520 a------- c:\windows\system32\avgrsstx.dll 2008-11-07 19:28 <DIR> --d----- c:\windows\system32\drivers\Avg 2008-11-07 19:28 <DIR> --d----- c:\docume~1\davewh~1\applic~1\AVGTOOLBAR 2008-11-07 17:54 <DIR> --d----- c:\program files\AVG 2008-11-07 17:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8 2008-11-07 14:45 309 a------- c:\windows\system32\wini108023.exe 2008-11-07 14:40 114 a------- c:\windows\system32\delself.bat 2008-11-07 14:32 2 a------- C:\-1341593358 2008-11-07 14:32 105,858 a------- c:\windows\system32\drivers\1a2def1.sys 2008-11-07 14:32 10,000 a------- c:\windows\system32\jsne87fidgf.dll 2008-11-07 14:32 44,544 a------- c:\windows\system32\rbsgam.dll 2008-11-07 14:32 1 a------- c:\windows\system32\kaxs.dat 2008-11-07 14:30 79,094 a------- c:\windows\system32\oexyhuvhtie.exe 2008-11-07 14:30 <DIR> --d----- c:\docume~1\davewh~1\applic~1\gadcom 2008-11-07 14:30 <DIR> --d----- c:\temp\1cb 2008-11-07 14:30 <DIR> --d----- c:\windows\system32\pg3 2008-11-07 14:30 <DIR> --d----- c:\windows\system32\OMS 2008-11-07 14:30 <DIR> --d----- c:\windows\system32\emi 2008-11-07 14:30 <DIR> --d----- c:\windows\system32\db1 2008-11-07 14:30 <DIR> --d----- c:\windows\system32\sX3i19 2008-11-07 14:30 <DIR> --d----- c:\temp\PRE45 2008-11-07 14:30 <DIR> --d----- C:\Temp 2008-10-24 19:53 <DIR> --d----- c:\windows\Logs 2008-10-19 23:01 3,786,760 a------- c:\windows\system32\D3DX9_37.dll 2008-10-19 23:01 3,727,720 a------- c:\windows\system32\d3dx9_35.dll 2008-10-19 23:01 3,497,832 a------- c:\windows\system32\d3dx9_34.dll 2008-10-19 23:01 81,768 a------- c:\windows\system32\xinput1_3.dll 2008-10-19 23:01 3,495,784 a------- c:\windows\system32\d3dx9_33.dll 2008-10-19 23:01 3,426,072 a------- c:\windows\system32\d3dx9_32.dll 2008-10-19 23:01 2,414,360 a------- c:\windows\system32\d3dx9_31.dll 2008-10-14 12:09 171,520 a------- c:\windows\system32\ffksqtcpfaaaeh.dll ==================== Find3M ==================== 2008-11-10 00:39 <DIR> --d----- c:\program files\Virtools 2008-11-07 23:02 <DIR> --d----- c:\program files\common files\AOL 2008-11-04 19:04 <DIR> --d----- c:\program files\common files\HP 2008-11-04 18:49 <DIR> --d----- c:\program files\HP 2008-10-24 19:54 <DIR> --d----- c:\program files\EA SPORTS 2008-10-23 18:09 2,215 a------- c:\windows\mozver.dat 2008-10-19 23:13 107,888 a------- c:\windows\system32\CmdLineExt.dll 2008-10-19 23:12 5,526 a------- c:\windows\system32\ealregsnapshot1.reg 2008-10-15 13:27 332,800 -------- c:\windows\system32\dllcache\netapi32.dll 2008-10-03 14:11 6,066,176 -------- c:\windows\system32\dllcache\ieframe.dll 2008-09-15 08:27 1,846,016 a------- c:\windows\system32\win32k.sys 2008-09-15 08:27 1,846,016 -------- c:\windows\system32\dllcache\win32k.sys 2008-08-28 06:34 333,056 -------- c:\windows\system32\dllcache\srv.sys 2008-08-27 13:54 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll 2008-08-25 05:08 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe 2008-08-25 05:07 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe 2008-08-23 02:26 635,848 -------- c:\windows\system32\dllcache\iexplore.exe 2008-08-23 02:24 161,792 -------- c:\windows\system32\dllcache\ieakui.dll 2008-08-20 02:03 1,499,136 -------- c:\windows\system32\dllcache\shdocvw.dll 2008-08-20 02:03 1,024,000 -------- c:\windows\system32\dllcache\browseui.dll 2008-08-20 02:03 474,112 -------- c:\windows\system32\dllcache\shlwapi.dll 2008-08-20 02:03 1,054,208 -------- c:\windows\system32\dllcache\danim.dll 2008-08-20 02:03 151,040 -------- c:\windows\system32\dllcache\cdfview.dll 2008-08-14 06:27 2,185,984 -------- c:\windows\system32\dllcache\ntoskrnl.exe 2008-08-14 06:25 2,142,720 a------- c:\windows\system32\ntoskrnl.exe 2008-08-14 06:25 2,142,720 -------- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-08-14 06:21 138,368 -------- c:\windows\system32\dllcache\afd.sys 2008-08-14 05:48 2,020,864 a------- c:\windows\system32\ntkrnlpa.exe 2008-08-14 05:48 2,020,864 -------- c:\windows\system32\dllcache\ntkrpamp.exe 2008-08-14 05:48 2,062,976 -------- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-01-27 18:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Dell 2007-02-14 01:10 <DIR> --d----- c:\docume~1\davewh~1\applic~1\Viewpoint 2007-02-01 00:02 <DIR> --d----- c:\docume~1\davewh~1\applic~1\BitTorrent 2006-12-13 18:33 <DIR> --d----- c:\docume~1\davewh~1\applic~1\PACE Anti-Piracy 2006-12-13 18:33 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PACE Anti-Piracy 2006-10-01 14:15 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2006-08-18 20:19 <DIR> --d----- c:\docume~1\davewh~1\applic~1\AOL 2006-08-18 20:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com 2006-08-18 17:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com Personal Firewall 2006-08-18 16:28 <DIR> --d----- c:\docume~1\davewh~1\applic~1\McAfee.com Personal Firewall 2006-08-07 21:01 <DIR> --d----- c:\docume~1\davewh~1\applic~1\You've Got Pictures Screensaver 2006-08-07 21:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2006-08-07 20:56 <DIR> --d----- c:\docume~1\davewh~1\applic~1\Intel 2006-08-07 20:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intel 2004-08-10 14:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBSI 2005-08-02 16:46 187,904 a--shr-- c:\windows\rgf2zsbxagfszw4\asappsrv.dll 2005-07-29 16:24 472 a--shr-- c:\windows\rgf2zsbxagfszw4\l3IZtm1ru3IPtqb.vbs ============= FINISH: 20:20:01.95 =============== |
|
|
|
|
11-11-2008, 06:10 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Apparent Malware/Spyware problem
Hello dwdwdw.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ It appears that you have two antivirus programs installed and running, Avira and AVG. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ Download the tools needed to a flash drive or other removable media, and transfer them to the desktop of the infected computer. ------------------------------------------------------ Download ComboFix from any of the links below. You must rename it before saving it. Save it to your Desktop. Link 1 Link 2 Link 3   * IMPORTANT !!! Save Combo-Fix.exe to your Desktop ------------------------------------------------------ With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named to your Desktop. ------------------------------------------------------ Transfer all files you just downloaded, to the desktop of the infected computer. ------------------------------------------------------ Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools. 
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
11-11-2008, 08:09 PM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 6
OS: xp
|
Re: Apparent Malware/Spyware problem
I followed the steps and here and the new logs from combofix and HJ.
-------- ComboFix 08-11-10.01 - Dave Whalen 2008-11-11 23:15:22.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.636 [GMT -3.5:30] Command switches used :: c:\documents and settings\Dave Whalen\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Dave Whalen\Application Data\gadcom c:\documents and settings\Dave Whalen\Application Data\Gool c:\documents and settings\Dave Whalen\Application Data\Gool\Gool.exe c:\documents and settings\Dave Whalen\Application Data\SSTEM~1 c:\documents and settings\Dave Whalen\Application Data\SSTEM~1\?xplorer.exe c:\documents and settings\Dave Whalen\Local Settings\Temporary Internet Files\bestwiner.stt c:\documents and settings\Dave Whalen\Local Settings\Temporary Internet Files\CPV.stt c:\documents and settings\Dave Whalen\Local Settings\Temporary Internet Files\fbk.sts c:\program files\Instafinder c:\program files\Instafinder\uninstall.exe c:\program files\Mjcore c:\program files\Mjcore\Mjcore.dll c:\program files\Need2Find c:\program files\Need2Find\bar\1.bin\N2FFXTBR.JAR c:\program files\Need2Find\bar\1.bin\N2NTSTBR.JAR c:\program files\Need2Find\bar\1.bin\PARTNER.DAT c:\program files\Need2Find\bar\Cache\0188B18A c:\program files\Need2Find\bar\Cache\0188B38E c:\program files\Need2Find\bar\Cache\files.ini c:\program files\Need2Find\bar\History\search c:\program files\Need2Find\bar\Settings\prevcfg.htm c:\program files\outerinfo c:\temp\1cb c:\temp\1cb\syscheck.log c:\windows\Fonts\acrsecB.fon c:\windows\Fonts\acrsecI.fon c:\windows\smdat32m.sys c:\windows\ssembl~1 c:\windows\ssembl~1\?ssembly\ c:\windows\ssembl~1\dexplore.exe c:\windows\system32\DelSelf.bat c:\windows\system32\drivers\1a2def1.sys c:\windows\system32\drivers\TDSSpqlt.sys c:\windows\system32\kaxs.dat c:\windows\system32\MSINET.oca c:\windows\system32\rbsgam.dll c:\windows\system32\TDSShrxx.dll c:\windows\system32\TDSSlxcp.dll c:\windows\system32\TDSSmtvd.dat c:\windows\system32\TDSSmxoe.log c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSoiqt.dll c:\windows\system32\TDSSotpa.log c:\windows\system32\TDSSsahc.dll c:\windows\system32\TDSSvkql.dll c:\windows\system32\TDSSxfmm.dll c:\windows\system32\testdll.dll c:\windows\system32\wini108023.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSSERV.SYS -------\Legacy_TDSSSERV.SYS -------\Legacy_cmdservice -------\Legacy_network_monitor -------\Service_1a2def1 ((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 ))))))))))))))))))))))))))))))) . 2008-11-11 20:14 . 2008-11-11 20:14 250 --a------ c:\windows\gmer.ini 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\program files\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\documents and settings\Dave Whalen\Application Data\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- C:\Binaries 2008-11-09 19:49 . 2008-10-12 13:18 1,553,272 --a------ c:\windows\WRSetup.dll 2008-11-09 19:40 . 2008-11-09 19:40 164 --a------ C:\install.dat 2008-11-09 17:47 . 2008-11-09 17:47 1,374 --a------ c:\windows\imsins.BAK 2008-11-09 15:07 . 2008-11-10 23:17 <DIR> d--hs---- c:\windows\RGF2ZSBXaGFsZW4 2008-11-09 14:47 . 2008-11-09 14:47 <DIR> d-------- c:\program files\Webtools 2008-11-08 19:59 . 2008-11-08 19:59 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-08 17:32 . 2008-11-10 01:28 <DIR> d-------- C:\HaxFix 2008-11-08 17:32 . 2008-11-08 17:31 486,678 --a------ C:\HaxFix.exe 2008-11-08 16:18 . 2008-11-08 16:19 <DIR> d-------- c:\windows\system32\NtmsData 2008-11-08 14:34 . 2008-11-08 14:34 <DIR> d-------- c:\program files\Trend Micro 2008-11-07 23:02 . 2008-11-07 23:02 2 --a------ c:\windows\msoffice.ini 2008-11-07 21:15 . 2008-11-07 21:15 <DIR> d--h----- c:\windows\PIF 2008-11-07 21:14 . 2006-03-14 08:35 380,928 -r------- c:\windows\system32\pSOAP32.dll 2008-11-07 21:14 . 2006-03-14 08:35 188,416 -r------- c:\windows\system32\pocketHTTP.dll 2008-11-07 21:14 . 2006-03-14 08:35 110,676 -r------- c:\windows\system32\psDime.dll 2008-11-07 21:14 . 2006-03-14 08:35 73,728 -r------- c:\windows\system32\psProxy.dll 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\program files\Lavasoft 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-07 20:55 . 2008-11-07 20:55 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-07 20:36 . 2005-08-27 02:38 1,435,272 --a------ c:\windows\system32\Flash.ocx 2008-11-07 20:36 . 2004-05-11 10:56 423,784 --a------ c:\windows\system32\XceedBkp.dll 2008-11-07 20:36 . 2004-02-05 21:53 389,120 --a------ c:\windows\system32\ACTSKN43.OCX 2008-11-07 20:36 . 2004-01-09 11:54 188,416 --a------ c:\windows\system32\actsplash.ocx 2008-11-07 20:36 . 2004-03-09 00:00 131,856 --a------ c:\windows\system32\MSADODC.ocx 2008-11-07 20:36 . 2000-07-15 06:00 101,888 --a------ c:\windows\system32\VB6STKIT.DLL 2008-11-07 20:36 . 2001-03-28 23:02 89,088 --a------ c:\windows\system32\ProgressBar4.ocx 2008-11-07 20:36 . 1999-01-26 19:36 11,012 --a------ c:\windows\system32\threadapi.tlb 2008-11-07 19:36 . 2008-11-08 21:02 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-07 19:28 . 2008-11-11 23:25 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-07 19:28 . 2008-11-08 20:02 <DIR> d-------- c:\documents and settings\Dave Whalen\Application Data\AVGTOOLBAR 2008-11-07 19:28 . 2008-11-07 19:28 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-07 19:28 . 2008-11-07 19:28 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-07 17:54 . 2008-11-07 17:54 <DIR> d-------- c:\program files\AVG 2008-11-07 17:54 . 2008-11-07 19:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-07 14:32 . 2008-11-07 14:32 10,000 --a------ c:\windows\system32\jsne87fidgf.dll 2008-11-07 14:32 . 2008-11-07 14:32 2 --a------ C:\-1341593358 2008-11-07 14:30 . 2008-11-07 14:30 <DIR> d-------- c:\windows\system32\sX3i19 2008-11-07 14:30 . 2008-11-07 19:21 <DIR> d-------- c:\windows\system32\pg3 2008-11-07 14:30 . 2008-11-07 19:21 <DIR> d-------- c:\windows\system32\OMS 2008-11-07 14:30 . 2008-11-07 19:20 <DIR> d-------- c:\windows\system32\emi 2008-11-07 14:30 . 2008-11-07 14:30 <DIR> d-------- c:\windows\system32\db1 2008-11-07 14:30 . 2008-11-07 14:30 <DIR> d-------- c:\temp\PRE45 2008-11-07 14:30 . 2008-11-11 23:16 <DIR> d-------- C:\Temp 2008-11-07 14:30 . 2008-11-07 14:30 79,094 --a------ c:\windows\system32\oexyhuvhtie.exe 2008-10-24 19:53 . 2008-10-24 19:53 <DIR> d-------- c:\windows\Logs 2008-10-19 23:01 . 2008-03-05 15:26 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll 2008-10-19 23:01 . 2007-07-19 17:44 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2008-10-19 23:01 . 2007-05-16 16:15 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll 2008-10-19 23:01 . 2007-03-12 16:12 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll 2008-10-19 23:01 . 2006-11-29 12:36 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll 2008-10-19 23:01 . 2006-09-28 15:35 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll 2008-10-19 23:01 . 2007-04-04 18:23 81,768 --a------ c:\windows\system32\xinput1_3.dll 2008-10-14 12:09 . 2008-10-14 12:09 171,520 --a------ c:\windows\system32\ffksqtcpfaaaeh.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-12 02:23 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-11-11 23:01 --------- d-----w c:\program files\Common Files\Adobe 2008-11-10 04:09 --------- d-----w c:\program files\Virtools 2008-11-08 03:51 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-08 02:32 --------- d-----w c:\program files\Common Files\AOL 2008-11-08 02:32 --------- d-----w c:\documents and settings\All Users\Application Data\AOL 2008-11-04 22:34 --------- d-----w c:\program files\Common Files\HP 2008-11-04 22:20 --------- d-----w c:\program files\Hewlett-Packard 2008-11-04 22:19 --------- d-----w c:\program files\HP 2008-10-24 23:24 --------- d-----w c:\program files\EA SPORTS 2008-10-02 07:45 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys 2008-10-02 07:45 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys 2008-10-02 07:45 170,608 ----a-w c:\windows\system32\drivers\ssidrv.sys 2008-04-18 15:48 43,432 ----a-w c:\documents and settings\Dave Whalen\Application Data\GDIPFONTCACHEV1.DAT 2005-08-02 20:16 187,904 --sha-r c:\windows\RGF2ZSBXaGFsZW4\asappsrv.dll 2005-07-29 19:54 472 --sha-r c:\windows\RGF2ZSBXaGFsZW4\l3IZtm1ru3IPtqb.vbs . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33CD1052-E42E-65E7-6C28-CE8E11FBCA4A}] 2008-10-14 12:09 171520 --a------ c:\windows\system32\ffksqtcpfaaaeh.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Seznltci"="c:\documents and settings\Dave Whalen\Application Data\s?stem\?xplorer.exe" [?] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992] "DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "Google Update"="c:\documents and settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-02-15 185896] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-02-01 385024] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "xtezvpoecqrgjoa"="c:\windows\system32\ffksqtcpfaaaeh.dll" [2008-10-14 171520] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-07 1234712] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe] c:\documents and settings\Dave Whalen\Start Menu\Programs\Startup\ FIFA 09 Registration.lnk - c:\program files\EA SPORTS\FIFA 09\Support\EAregister.exe [2008-10-19 4369408] NHLr 09 Registration.lnk - c:\program files\EA SPORTS\NHL 09\Support\EAregister.exe [2008-10-24 4374792] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-08-07 24576] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=karna.dat,avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wrconsumerservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\EA SPORTS\\NHL 09\\nhl2009.exe"= "c:\\Program Files\\EA SPORTS\\FIFA 09\\FIFA09.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2008-10-02 29808] R1 avgldx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-07 97928] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-07 231704] R2 wrconsumerservice;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2008-10-12 1066360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0fd0bde-d83c-11dc-8877-001302d557fe}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-11-12 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-08 00:57] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Sen - c:\windows\SSEMBL~1\dexplore.exe HKU-Default-Run-brastk - c:\windows\system32\brastk.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Dave Whalen\Application Data\Mozilla\Firefox\Profiles\2hpyyq4s.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official FF -: plugin - c:\documents and settings\Dave Whalen\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 23:23:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Dell\QuickSet\NicConfigSvc.exe c:\windows\system32\HPZipm12.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\Webroot\WebrootSecurity\SpySweeper.exe c:\windows\system32\igfxsrvc.exe c:\windows\system32\regsvr32.exe c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe c:\program files\Internet Explorer\iexplore.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Java\jre1.6.0_05\bin\jucheck.exe . ************************************************************************** . Completion time: 2008-11-11 23:28:38 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-12 02:58:29 Pre-Run: 69,465,575,424 bytes free Post-Run: 75,309,957,120 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 275 --- E O F --- 2008-11-11 17:04:20 ------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:33:46 PM, on 11/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\stsystra.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\regsvr32.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca O2 - BHO: netupbanner browser enhancer - {33CD1052-E42E-65E7-6C28-CE8E11FBCA4A} - C:\WINDOWS\system32\ffksqtcpfaaaeh.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [xtezvpoecqrgjoa] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\ffksqtcpfaaaeh.dll" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Seznltci] "C:\Documents and Settings\Dave Whalen\Application Data\s?stem\?xplorer.exe" O4 - Startup: FIFA 09 Registration.lnk = C:\Program Files\EA SPORTS\FIFA 09\Support\EAregister.exe O4 - Startup: NHL® 09 Registration.lnk = C:\Program Files\EA SPORTS\NHL 09\Support\EAregister.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [international] International* O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1157038000312 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/.../installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://nsprdnacw-vip.aliant.net/lwp/...XInstaller.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: karna.dat,avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Webroot Spy Sweeper Engine (webrootspysweeperservice) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Webroot Client Service (wrconsumerservice) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe -- End of file - 11268 bytes |
|
|
|
|
11-11-2008, 08:35 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Apparent Malware/Spyware problem
Hello, dwdwdw.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please click Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt new HijackThis log |
|
|
|
|
|
11-11-2008, 09:12 PM
|
#7 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 6
OS: xp
|
Re: Apparent Malware/Spyware problem
Here are the latest logs from combofix and HJ:
ComboFix 08-11-10.01 - Dave Whalen 2008-11-12 0:34:34.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.508 [GMT -3.5:30] Running from: c:\documents and settings\Dave Whalen\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Dave Whalen\Desktop\CFScript.txt * Created a new restore point FILE :: C:\-1341593358 c:\windows\RGF2ZSBXaGFsZW4\asappsrv.dll c:\windows\RGF2ZSBXaGFsZW4\l3IZtm1ru3IPtqb.vbs c:\windows\system32\ffksqtcpfaaaeh.dll c:\windows\system32\jsne87fidgf.dll c:\windows\system32\oexyhuvhtie.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\-1341593358 c:\program files\Enigma Software Group c:\program files\Enigma Software Group\SpyHunter\AXList.txt c:\program files\Enigma Software Group\SpyHunter\key.dat c:\program files\Enigma Software Group\SpyHunter\scan.log c:\program files\Enigma Software Group\SpyHunter\spyhunter.log c:\program files\Enigma Software Group\SpyHunter\SpyHunterInstance.lock c:\program files\Enigma Software Group\SpyHunter\support.log c:\temp\PRE45 c:\temp\PRE45\pG8.log c:\windows\RGF2ZSBXaGFsZW4 c:\windows\RGF2ZSBXaGFsZW4\asappsrv.dll c:\windows\RGF2ZSBXaGFsZW4\l3IZtm1ru3IPtqb.vbs c:\windows\system32\db1 c:\windows\system32\db1\ZVRE2I25.exe c:\windows\system32\emi c:\windows\system32\ffksqtcpfaaaeh.dll c:\windows\system32\jsne87fidgf.dll c:\windows\system32\oexyhuvhtie.exe c:\windows\system32\OMS c:\windows\system32\pg3 c:\windows\system32\sX3i19 c:\windows\system32\sX3i19\sX3i191065.exe . ((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 ))))))))))))))))))))))))))))))) . 2008-11-11 20:14 . 2008-11-11 20:14 250 --a------ c:\windows\gmer.ini 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\program files\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\documents and settings\Dave Whalen\Application Data\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Webroot 2008-11-09 19:49 . 2008-11-09 19:49 <DIR> d-------- C:\Binaries 2008-11-09 19:49 . 2008-10-12 13:18 1,553,272 --a------ c:\windows\WRSetup.dll 2008-11-09 19:40 . 2008-11-09 19:40 164 --a------ C:\install.dat 2008-11-09 17:47 . 2008-11-09 17:47 1,374 --a------ c:\windows\imsins.BAK 2008-11-09 14:47 . 2008-11-09 14:47 <DIR> d-------- c:\program files\Webtools 2008-11-08 17:32 . 2008-11-10 01:28 <DIR> d-------- C:\HaxFix 2008-11-08 17:32 . 2008-11-08 17:31 486,678 --a------ C:\HaxFix.exe 2008-11-08 16:18 . 2008-11-08 16:19 <DIR> d-------- c:\windows\system32\NtmsData 2008-11-08 14:34 . 2008-11-08 14:34 <DIR> d-------- c:\program files\Trend Micro 2008-11-07 23:02 . 2008-11-07 23:02 2 --a------ c:\windows\msoffice.ini 2008-11-07 21:15 . 2008-11-07 21:15 <DIR> d--h----- c:\windows\PIF 2008-11-07 21:14 . 2006-03-14 08:35 380,928 -r------- c:\windows\system32\pSOAP32.dll 2008-11-07 21:14 . 2006-03-14 08:35 188,416 -r------- c:\windows\system32\pocketHTTP.dll 2008-11-07 21:14 . 2006-03-14 08:35 110,676 -r------- c:\windows\system32\psDime.dll 2008-11-07 21:14 . 2006-03-14 08:35 73,728 -r------- c:\windows\system32\psProxy.dll 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\program files\Lavasoft 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-07 20:55 . 2008-11-07 20:55 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-07 20:36 . 2005-08-27 02:38 1,435,272 --a------ c:\windows\system32\Flash.ocx 2008-11-07 20:36 . 2004-05-11 10:56 423,784 --a------ c:\windows\system32\XceedBkp.dll 2008-11-07 20:36 . 2004-02-05 21:53 389,120 --a------ c:\windows\system32\ACTSKN43.OCX 2008-11-07 20:36 . 2004-01-09 11:54 188,416 --a------ c:\windows\system32\actsplash.ocx 2008-11-07 20:36 . 2004-03-09 00:00 131,856 --a------ c:\windows\system32\MSADODC.ocx 2008-11-07 20:36 . 2000-07-15 06:00 101,888 --a------ c:\windows\system32\VB6STKIT.DLL 2008-11-07 20:36 . 2001-03-28 23:02 89,088 --a------ c:\windows\system32\ProgressBar4.ocx 2008-11-07 20:36 . 1999-01-26 19:36 11,012 --a------ c:\windows\system32\threadapi.tlb 2008-11-07 19:36 . 2008-11-08 21:02 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-07 19:28 . 2008-11-11 23:27 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-07 19:28 . 2008-11-08 20:02 <DIR> d-------- c:\documents and settings\Dave Whalen\Application Data\AVGTOOLBAR 2008-11-07 19:28 . 2008-11-07 19:28 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-07 19:28 . 2008-11-07 19:28 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-07 17:54 . 2008-11-07 17:54 <DIR> d-------- c:\program files\AVG 2008-11-07 17:54 . 2008-11-07 19:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-07 14:30 . 2008-11-12 00:34 <DIR> d-------- C:\Temp 2008-10-24 19:53 . 2008-10-24 19:53 <DIR> d-------- c:\windows\Logs 2008-10-19 23:01 . 2008-03-05 15:26 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll 2008-10-19 23:01 . 2007-07-19 17:44 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2008-10-19 23:01 . 2007-05-16 16:15 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll 2008-10-19 23:01 . 2007-03-12 16:12 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll 2008-10-19 23:01 . 2006-11-29 12:36 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll 2008-10-19 23:01 . 2006-09-28 15:35 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll 2008-10-19 23:01 . 2007-04-04 18:23 81,768 --a------ c:\windows\system32\xinput1_3.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-12 02:23 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-11-11 23:01 --------- d-----w c:\program files\Common Files\Adobe 2008-11-10 04:09 --------- d-----w c:\program files\Virtools 2008-11-08 03:51 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-08 02:32 --------- d-----w c:\program files\Common Files\AOL 2008-11-08 02:32 --------- d-----w c:\documents and settings\All Users\Application Data\AOL 2008-11-04 22:34 --------- d-----w c:\program files\Common Files\HP 2008-11-04 22:20 --------- d-----w c:\program files\Hewlett-Packard 2008-11-04 22:19 --------- d-----w c:\program files\HP 2008-10-24 23:24 --------- d-----w c:\program files\EA SPORTS 2008-10-20 02:43 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-20 02:42 5,526 ----a-w c:\windows\system32\ealregsnapshot1.reg 2008-10-15 16:57 332,800 ------w c:\windows\system32\dllcache\netapi32.dll 2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll 2008-10-02 07:45 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys 2008-10-02 07:45 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys 2008-10-02 07:45 170,608 ----a-w c:\windows\system32\drivers\ssidrv.sys 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-15 11:57 1,846,016 ------w c:\windows\system32\dllcache\win32k.sys 2008-08-28 10:04 333,056 ------w c:\windows\system32\dllcache\srv.sys 2008-08-27 17:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll 2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll 2008-08-20 05:33 474,112 ------w c:\windows\system32\dllcache\shlwapi.dll 2008-08-20 05:33 151,040 ------w c:\windows\system32\dllcache\cdfview.dll 2008-08-20 05:33 1,499,136 ------w c:\windows\system32\dllcache\shdocvw.dll 2008-08-20 05:33 1,054,208 ------w c:\windows\system32\dllcache\danim.dll 2008-08-20 05:33 1,024,000 ------w c:\windows\system32\dllcache\browseui.dll 2008-08-14 09:57 2,185,984 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2008-08-14 09:55 2,142,720 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:55 2,142,720 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2008-08-14 09:51 138,368 ------w c:\windows\system32\dllcache\afd.sys 2008-08-14 09:18 2,062,976 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2008-08-14 09:18 2,020,864 ----a-w c:\windows\system32\ntkrnlpa.exe 2008-08-14 09:18 2,020,864 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2008-04-18 15:48 43,432 ----a-w c:\documents and settings\Dave Whalen\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992] "DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "Google Update"="c:\documents and settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-02-15 185896] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-02-01 385024] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-07 1234712] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe] c:\documents and settings\Dave Whalen\Start Menu\Programs\Startup\ FIFA 09 Registration.lnk - c:\program files\EA SPORTS\FIFA 09\Support\EAregister.exe [2008-10-19 4369408] NHLr 09 Registration.lnk - c:\program files\EA SPORTS\NHL 09\Support\EAregister.exe [2008-10-24 4374792] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-08-07 24576] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wrconsumerservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\EA SPORTS\\NHL 09\\nhl2009.exe"= "c:\\Program Files\\EA SPORTS\\FIFA 09\\FIFA09.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2008-10-02 29808] R1 avgldx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-07 97928] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-07 231704] R2 wrconsumerservice;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2008-10-12 1066360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0fd0bde-d83c-11dc-8877-001302d557fe}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-11-12 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-08 00:57] . - - - - ORPHANS REMOVED - - - - HKLM-Run-xtezvpoecqrgjoa - c:\windows\system32\ffksqtcpfaaaeh.dll ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-12 00:36:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-12 0:37:56 ComboFix-quarantined-files.txt 2008-11-12 04:07:45 ComboFix2.txt 2008-11-12 02:58:41 Pre-Run: 75,302,264,832 bytes free Post-Run: 75,288,117,248 bytes free 217 --- E O F --- 2008-11-11 17:04:20 ---------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:38:49 AM, on 11/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\stsystra.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - Startup: FIFA 09 Registration.lnk = C:\Program Files\EA SPORTS\FIFA 09\Support\EAregister.exe O4 - Startup: NHL® 09 Registration.lnk = C:\Program Files\EA SPORTS\NHL 09\Support\EAregister.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [international] International* O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1157038000312 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/.../installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://nsprdnacw-vip.aliant.net/lwp/...XInstaller.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Webroot Spy Sweeper Engine (webrootspysweeperservice) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Webroot Client Service (wrconsumerservice) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe -- End of file - 10720 bytes |
|
|
|
|
11-12-2008, 05:06 AM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Apparent Malware/Spyware problem
Hello again, dwdwdw. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. Please close HijackThis now. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
11-12-2008, 01:04 PM
|
#9 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 6
OS: xp
|
Re: Apparent Malware/Spyware problem
Here are the kaspersky and HJ reports.
The problem seems to be solved. My google searches aren't being redirected and AVG can now update itself. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, November 12, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, November 12, 2008 14:58:32 Records in database: 1381688 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 74340 Threat name: 12 Infected objects: 14 Suspicious objects: 0 Duration of the scan: 01:36:21 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\Documents and Settings\Dave Whalen\Application Data\Gool\Gool.exe.vir Infected: Trojan.Win32.Agent.amiw 1 C:\Qoobox\Quarantine\C\Documents and Settings\Dave Whalen\Application Data\SSTEM~1\еxplorer.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.jw 1 C:\Qoobox\Quarantine\C\WINDOWS\RGF2ZSBXaGFsZW4\asappsrv.dll.vir Infected: not-a-virus:AdWare.Win32.CommAd.a 1 C:\Qoobox\Quarantine\C\WINDOWS\SSEMBL~1\dexplore.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fk 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\db1\ZVRE2I25.exe.vir Infected: not-a-virus:AdWare.Win32.Agent.hcj 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSpqlt.sys.vir Infected: Backdoor.Win32.TDSS.bkw 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_1a2def1_.sys.zip Infected: Backdoor.Win32.Agent.tzc 2 C:\Qoobox\Quarantine\C\WINDOWS\system32\ffksqtcpfaaaeh.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.hcj 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\rbsgam.dll.vir Infected: Trojan-Downloader.Win32.BHO.yv 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\sX3i19\sX3i191065.exe.vir Infected: Trojan-Downloader.Win32.VB.irr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSShrxx.dll.vir Infected: Backdoor.Win32.TDSS.asz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSvkql.dll.vir Infected: Backdoor.Win32.TDSS.atb 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxfmm.dll.vir Infected: Rootkit.Win32.Clbd.lb 1 The selected area was scanned. ------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:30:07 PM, on 11/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\stsystra.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave Whalen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - Startup: FIFA 09 Registration.lnk = C:\Program Files\EA SPORTS\FIFA 09\Support\EAregister.exe O4 - Startup: NHL® 09 Registration.lnk = C:\Program Files\EA SPORTS\NHL 09\Support\EAregister.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [international] International* O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1157038000312 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/.../installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://nsprdnacw-vip.aliant.net/lwp/...XInstaller.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Webroot Spy Sweeper Engine (webrootspysweeperservice) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Webroot Client Service (wrconsumerservice) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe -- End of file - 10946 bytes |
|
|
|
|
11-12-2008, 01:32 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,294
OS: XP SP3
|
Re: Apparent Malware/Spyware problem
Congratulations. Well done! Your logs appear clean. You should be good to go.
Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: C:\WINDOWS\gmer_uninstall.cmd Press any key to continue once you see that message. ------------------------------------------------------ As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. FIREWALL Using a third-party Firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one Firewall program as they will conflict with each other.SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
