|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-01-2008, 07:04 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Adware infection help needed
Any help would be greatly appreciated
after running spysweeper, it found Adware found: webdir Adware found: brilliant digital I'm getting popup like crazy. Plus the "your computer is infected" ballon also.. computer is running seiously slow now DDS (Version 1.0) - NTFSx86 Run by Owner at 21:36:02.10 on Mon 12/01/2008 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.99 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\OasClnt.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\Program Files\Digital Media Reader\readericon45G.exe c:\program files\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe "C:\WINDOWS\system32\drivers\svchost.exe" C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Owner\Desktop\dds.com ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.google.com/ie uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: {2793B8E2-28D1-4C49-91F2-C96F749CA9D6} - c:\windows\system32\pmnoLebX.dll BHO: {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll BHO: {A63E645F-13BD-45ED-B15F-6E8C1BD57279} - c:\windows\system32\cbXQgheF.dll BHO: {b429db82-b049-44a0-ae24-856bf1a8d90b} - c:\windows\system32\fhxbzp.dll TB: {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_1_0 uRun: [SVCHOST.EXE] c:\windows\system32\drivers\svchost.exe mRun: [readericon] "c:\program files\digital media reader\readericon45G.exe" mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] "nwiz.exe" /install mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [SoundMan] SOUNDMAN.EXE mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask mRun: [OASClnt] "c:\program files\mcafee.com\vso\oasclnt.exe" mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\mcupdate.exe mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe mRun: [MSKDetectorExe] "c:\progra~1\mcafee\spamki~1\MSKDetct.exe" /startup mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe" mRun: [VirusScan Online] c:\progra~1\mcafee.com\vso\mcvsshld.exe mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe mRun: [StormCodec_Helper] "c:\program files\ringz studio\storm codec\StormSet.exe" /S /opti mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe" mRun: [c450d3e9] rundll32.exe "c:\windows\system32\gkduhjqs.dll",b dRun: [Power2GoExpress] NA StartupFolder: c:\documents and settings\owner\start menu\programs\startup\PowerReg Scheduler V3.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Notify: cbXQgheF - cbXQgheF.dll AppInit_DLLs: fhxbzp.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {A63E645F-13BD-45ED-B15F-6E8C1BD57279} - c:\windows\system32\cbXQgheF.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll LSA: Authentication Packages = msv1_0 c:\windows\system32\pmnoLebX ============= SERVICES / DRIVERS =============== R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\ViewpointService.exe" [2007-10-28 24652] =============== Created Last 30 ================ 2008-12-01 20:03 250 a------- c:\windows\gmer.ini 2008-12-01 00:26 129,024 a------- c:\windows\system32\fhxbzp.dll 2008-12-01 00:26 129,024 a------- c:\windows\system32\iifjbolc.dll 2008-12-01 00:25 1,342,962 ---sh--- c:\windows\system32\sqjhudkg.ini 2008-12-01 00:25 72,704 a------- c:\windows\system32\gkduhjqs.dll 2008-11-30 23:50 129,024 a------- c:\windows\system32\wotrfk(2).dll 2008-11-30 23:49 872,944 a--sh--- c:\windows\system32\XbeLonmp.ini2 2008-11-30 23:49 872,944 a--sh--- c:\windows\system32\XbeLonmp.ini 2008-11-30 23:49 318,464 a------- c:\windows\system32\pmnoLebX.dll 2008-11-30 23:44 25,600 a------- c:\windows\system32\pmnoLdbA.dll 2008-11-30 23:44 25,600 a------- c:\windows\system32\cbXQgheF.dll 2008-11-30 23:39 22,528 a------- c:\windows\system32\digeste.dll 2008-11-30 23:39 22,528 a------- c:\documents and settings\owner\~.exe 2008-11-23 04:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\channels 2008-11-20 17:28 <DIR> --d----- c:\program files\UnRar for Windows 2008-11-20 14:36 <DIR> --d----- c:\docume~1\owner\applic~1\Free Sound Recorder 2008-11-20 14:36 479,232 a------- c:\windows\system32\NCTAudioVisualization2.dll 2008-11-20 14:36 417,792 a------- c:\windows\system32\NCTTextToAudio2.dll 2008-11-20 14:36 348,160 a------- c:\windows\system32\NCTWMAFile2.dll 2008-11-20 14:36 113,486 a------- c:\windows\system32\NCTWMAProfiles.prx 2008-11-20 14:36 1,986,560 a------- c:\windows\system32\NCTAudioFile2.dll 2008-11-20 14:36 1,212,416 a------- c:\windows\system32\NCTAudioInformation2.dll 2008-11-20 14:36 880,640 a------- c:\windows\system32\NCTAudioEditor2.dll 2008-11-20 14:36 835,584 a------- c:\windows\system32\NCTAudioCDGrabber2.dll 2008-11-20 14:36 602,112 a------- c:\windows\system32\NCTAudioTransform2.dll 2008-11-20 14:36 458,752 a------- c:\windows\system32\NCTAudioRecord2.dll 2008-11-20 14:36 458,752 a------- c:\windows\system32\NCTAudioPlayer2.dll 2008-11-20 14:36 <DIR> --d----- c:\program files\Free Sound Recorder 2008-11-15 15:21 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys 2008-11-15 15:21 15,104 a------- c:\windows\system32\drivers\usbscan.sys 2008-11-15 15:21 87,040 ac------ c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-15 15:21 87,040 a------- c:\windows\system32\wiafbdrv.dll 2008-11-15 15:21 69,632 a------- c:\windows\system32\lxbkscin.dll 2008-11-15 15:21 <DIR> --d----- c:\program files\Lexmark X1100 Series ==================== Find3M ==================== 2008-12-01 20:12 <DIR> --d----- c:\program files\Puppy Luv 2008-12-01 01:12 <DIR> --d----- c:\program files\FTP Commander 2008-11-05 06:56 <DIR> --d----- c:\program files\DivX 2008-10-28 17:36 823,296 a------- c:\windows\system32\divx_xx0c.dll 2008-10-28 17:36 823,296 a------- c:\windows\system32\divx_xx07.dll 2008-10-28 17:35 815,104 a------- c:\windows\system32\divx_xx0a.dll 2008-10-28 17:35 802,816 a------- c:\windows\system32\divx_xx11.dll 2008-10-28 17:35 684,032 a------- c:\windows\system32\DivX.dll 2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll 2008-09-25 03:03 524,288 a------- c:\windows\system32\DivXsm.exe 2008-09-25 03:03 196,608 a------- c:\windows\system32\dtu100.dll 2008-09-25 03:03 81,920 a------- c:\windows\system32\dpl100.dll 2008-09-25 03:03 53,248 a------- c:\windows\system32\dpuGUI10.dll 2008-09-25 03:03 593,920 a------- c:\windows\system32\dpuGUI11.dll 2008-09-25 03:03 344,064 a------- c:\windows\system32\dpus11.dll 2008-09-25 03:03 57,344 a------- c:\windows\system32\dpv11.dll 2008-09-25 03:03 294,912 a------- c:\windows\system32\dpu11.dll 2008-09-25 03:03 294,912 a------- c:\windows\system32\dpu10.dll 2008-09-25 03:03 161,096 a------- c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-19 16:57 3,596,288 a------- c:\windows\system32\qt-dx331.dll 2008-09-19 16:55 1,044,480 a------- c:\windows\system32\libdivx.dll 2008-09-19 16:55 200,704 a------- c:\windows\system32\ssldivx.dll 2008-09-19 16:54 12,288 a------- c:\windows\system32\DivXWMPExtType.dll 2008-09-17 23:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com Personal Firewall 2008-09-15 06:57 1,846,016 a------- c:\windows\system32\win32k.sys 2008-09-10 02:07 <DIR> --d----- c:\docume~1\owner\applic~1\DNA 2008-09-06 12:54 <DIR> --d----- c:\docume~1\owner\applic~1\CVS 2008-09-04 11:42 1,106,944 a------- c:\windows\system32\msxml3.dll 2008-08-07 23:27 <DIR> --d----- c:\docume~1\owner\applic~1\Thinstall 2008-05-11 08:36 <DIR> --d----- c:\docume~1\owner\applic~1\McAfee.com Personal Firewall 2008-04-27 18:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com 2008-01-14 20:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\HipSoft 2008-01-14 19:33 <DIR> --d----- c:\docume~1\owner\applic~1\Jane s Hotel 2008-01-11 16:10 <DIR> --d----- c:\docume~1\owner\applic~1\PlayFirst 2008-01-07 19:01 <DIR> --d----- c:\docume~1\owner\applic~1\FunWebProducts 2007-12-20 18:49 <DIR> --d----- c:\docume~1\owner\applic~1\Viewpoint 2007-10-28 14:06 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2007-09-24 16:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Napster 2007-09-24 16:23 <DIR> --d----- c:\docume~1\owner\applic~1\AOL 2007-02-02 20:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Prism Deploy 2007-02-02 18:29 <DIR> --d----- c:\docume~1\owner\applic~1\You've Got Pictures Screensaver 2007-02-02 18:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Pure Networks 2008-08-29 11:10 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082920080830\index.dat ============= FINISH: 21:37:13.40 =============== Last edited by basskiller; 12-01-2008 at 07:10 PM. |
|
     |
| Sponsored Links |
|
12-02-2008, 09:59 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs: Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here and Here ============ Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Place combofix.exe on your Desktop [*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. [*]Double click on combofix.exe & follow the prompts. [*]As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes, to continue scanning for malware. [*]Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. [*] When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. =========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. =========== Logs Required C:\Combofix.txt Hijackthis Log If there is no response to this post within 72hrs, this thread will be closed.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information.  Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
12-02-2008, 01:05 PM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
First let me thank you for your help TheBruce1 !! It is truely appreciated.
Apparently I screwed up when by closing out the combofix log. Assuming by closing it, it would allow me to save it as a text file. I was wrong. By closing it, it closed completely. I appologise. I'm not sure if there is a way to recreate this. I would also assume that running Combofix again, will not show what the program fixed.. Again.. I appologise The Hijackthis log is below |
|
|
|
|
12-02-2008, 01:50 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
The log can be found at C:\Combofix.txt. Also, just copy/paste the logs into you`re posts rather than attaching.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
12-02-2008, 02:12 PM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
I searched but I keep getting
cannot find 'file:///C:\ComboFix.txt' sorry TheBruce1 Can I run the combofix again? BTW No Popups so far HijackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:56, on 2008-12-02 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Program Files\Digital Media Reader\readericon45G.exe C:\Program Files\McAfee.com\VSO\oasclnt.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe c:\program files\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\rsvp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [readericon] "C:\Program Files\Digital Media Reader\readericon45G.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [OASClnt] "C:\Program Files\McAfee.com\VSO\oasclnt.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [MSKDetectorExe] "C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: PowerReg Scheduler V3.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O24 - Desktop Component 0: (no name) - http://www.hollisterco.com/hol/image...ringbettys.jpg -- End of file - 6661 bytes Last edited by basskiller; 12-02-2008 at 02:24 PM. |
|
|
|
|
12-02-2008, 02:33 PM
|
#6 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello again
Quote:
C:\Combofix.txt Click ok. The Combofix.txt should appear, if not,try this. Click start>Click on My Computer> Double-Click on Local Disk(C)>Click on the Combofix folder and the txt should be inside that folder. Quote:
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating Last edited by TheBruce1; 12-02-2008 at 02:35 PM. |
||
|
|
|
|
12-02-2008, 03:01 PM
|
#7 (permalink) | |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
Did both and both came back with nothing.
there are only a couple text files in the folder and none of them are combofix.txt Quote:
|
|
|
|
|
|
12-02-2008, 03:11 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Ok, run Combofix and post the Combofix.txt in your reply.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
12-02-2008, 03:22 PM
|
#9 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
again.. sorry for the trouble Thebruce..
ComboFix 08-12-01.03 - Owner 2008-12-02 6:16:21.2 - NTFSx86 Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 ))))))))))))))))))))))))))))))) . 2008-12-02 15:55 . 2008-12-02 15:55 <DIR> d-------- c:\program files\Trend Micro 2008-12-01 20:03 . 2008-12-01 20:13 250 --a------ c:\windows\gmer.ini 2008-11-30 23:39 . 2008-11-30 23:39 22,528 --a------ c:\documents and settings\Owner\~.exe 2008-11-23 04:30 . 2008-11-23 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\channels 2008-11-20 17:28 . 2008-11-20 17:28 <DIR> d-------- c:\program files\UnRar for Windows 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\program files\Free Sound Recorder 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\documents and settings\Owner\Application Data\Free Sound Recorder 2008-11-20 14:36 . 2005-05-17 12:37 1,986,560 --a------ c:\windows\system32\NCTAudioFile2.dll 2008-11-20 14:36 . 2005-05-18 11:52 1,212,416 --a------ c:\windows\system32\NCTAudioInformation2.dll 2008-11-20 14:36 . 2005-04-15 12:08 880,640 --a------ c:\windows\system32\NCTAudioEditor2.dll 2008-11-20 14:36 . 2004-11-04 13:31 835,584 --a------ c:\windows\system32\NCTAudioCDGrabber2.dll 2008-11-20 14:36 . 2005-04-04 17:21 602,112 --a------ c:\windows\system32\NCTAudioTransform2.dll 2008-11-20 14:36 . 2005-03-28 15:54 479,232 --a------ c:\windows\system32\NCTAudioVisualization2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioRecord2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioPlayer2.dll 2008-11-20 14:36 . 2005-03-28 15:52 417,792 --a------ c:\windows\system32\NCTTextToAudio2.dll 2008-11-20 14:36 . 2005-02-24 11:51 348,160 --a------ c:\windows\system32\NCTWMAFile2.dll 2008-11-20 14:36 . 2006-03-23 12:56 113,486 --a------ c:\windows\system32\NCTWMAProfiles.prx 2008-11-15 15:21 . 2008-11-16 18:51 <DIR> d-------- c:\program files\Lexmark X1100 Series 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-15 15:21 . 2003-08-18 06:56 69,632 --a------ c:\windows\system32\lxbkscin.dll 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 20:11 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-12-02 01:12 --------- d-----w c:\program files\Puppy Luv 2008-12-02 01:12 --------- d-----w c:\program files\CyberLink 2008-12-02 01:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-01 06:12 --------- d-----w c:\program files\FTP Commander 2008-11-05 11:56 --------- d-----w c:\program files\DivX 2008-11-03 17:34 362 ----a-w c:\windows\Fonts\BOISTERC.PFM 2008-11-03 17:34 1,482 ----a-w c:\windows\Fonts\BOISTERB.PFM 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-04-21 13:00 0 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2008-08-29 16:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-11 86016] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656] "VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552] "OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248] "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104] "MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992] "MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592] "MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 1121792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 163840] "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-09-27 999424] "StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-09-30 96984] "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344] "nwiz"="nwiz.exe" [2005-10-11 c:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] c:\documents and settings\Owner\Start Menu\Programs\Startup\ PowerReg Scheduler V3.exe [2007-12-23 225280] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=lwrdgc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\PROGRA~1\\RINGZS~1\\STORMC~1\\Stormser.exe"= *Newly Created Service* - RSVP . Contents of the 'Scheduled Tasks' folder 2007-02-02 c:\windows\Tasks\ISP signup reminder 1.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 3.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] . . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\i4ats6w5.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 06:19:00 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-12-02 6:20:26 ComboFix-quarantined-files.txt 2008-12-02 11:19:38 ComboFix2.txt 2008-12-02 20:46:39 Pre-Run: 193,820,241,920 bytes free Post-Run: 193,853,411,328 bytes free 157 --- E O F --- 2008-11-13 22  05
|
|
|
|
|
12-02-2008, 04:14 PM
|
#10 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello again
Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly ========= Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========= Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ========= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
This animation will guide you through the process:  To optimize scanning time and produce a more sensible report for review:
========= From your logs it would seem that the Mcafee version that is installed is from 2005, if you have a valid subscription you can update to the latest version. Log in to you`re account using the e-mail and password you originally used. https://us.mcafee.com/root/login.asp If you are no longer are entitled to update, then i can suggest some good free antivirus programs. ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Kaspersky Scan Report Hijackthis Log How is your system running now.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
|
12-02-2008, 08:55 PM
|
#11 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
Hi TheBruce, The computer is seems to be running alot better and no pop ups since the first combofix run. Thank you ever so much!!!
If you could suggest some good free antivirus programs, that would be excellent addd the file to Combofix , which prompted it run again. ( log below). Deleted all java and installed the updated version. Ran the cleaner. ran the Kaspersky online scan (log below) Ran HijackThis and posted results below ComboFix log ComboFix 08-12-01.03 - Owner 2008-12-02 7:17:39.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.121 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFscript.txt * Created a new restore point * Resident AV is active FILE :: c:\documents and settings\Owner\~.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Viewpoint c:\documents and settings\Owner\~.exe . ((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 ))))))))))))))))))))))))))))))) . 2008-12-02 15:55 . 2008-12-02 15:55 <DIR> d-------- c:\program files\Trend Micro 2008-12-01 20:03 . 2008-12-01 20:13 250 --a------ c:\windows\gmer.ini 2008-11-23 04:30 . 2008-11-23 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\channels 2008-11-20 17:28 . 2008-11-20 17:28 <DIR> d-------- c:\program files\UnRar for Windows 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\program files\Free Sound Recorder 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\documents and settings\Owner\Application Data\Free Sound Recorder 2008-11-20 14:36 . 2005-05-17 12:37 1,986,560 --a------ c:\windows\system32\NCTAudioFile2.dll 2008-11-20 14:36 . 2005-05-18 11:52 1,212,416 --a------ c:\windows\system32\NCTAudioInformation2.dll 2008-11-20 14:36 . 2005-04-15 12:08 880,640 --a------ c:\windows\system32\NCTAudioEditor2.dll 2008-11-20 14:36 . 2004-11-04 13:31 835,584 --a------ c:\windows\system32\NCTAudioCDGrabber2.dll 2008-11-20 14:36 . 2005-04-04 17:21 602,112 --a------ c:\windows\system32\NCTAudioTransform2.dll 2008-11-20 14:36 . 2005-03-28 15:54 479,232 --a------ c:\windows\system32\NCTAudioVisualization2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioRecord2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioPlayer2.dll 2008-11-20 14:36 . 2005-03-28 15:52 417,792 --a------ c:\windows\system32\NCTTextToAudio2.dll 2008-11-20 14:36 . 2005-02-24 11:51 348,160 --a------ c:\windows\system32\NCTWMAFile2.dll 2008-11-20 14:36 . 2006-03-23 12:56 113,486 --a------ c:\windows\system32\NCTWMAProfiles.prx 2008-11-15 15:21 . 2008-11-16 18:51 <DIR> d-------- c:\program files\Lexmark X1100 Series 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-15 15:21 . 2003-08-18 06:56 69,632 --a------ c:\windows\system32\lxbkscin.dll 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 01:12 --------- d-----w c:\program files\Puppy Luv 2008-12-02 01:12 --------- d-----w c:\program files\CyberLink 2008-12-02 01:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-01 06:12 --------- d-----w c:\program files\FTP Commander 2008-11-05 11:56 --------- d-----w c:\program files\DivX 2008-11-03 17:34 362 ----a-w c:\windows\Fonts\BOISTERC.PFM 2008-11-03 17:34 1,482 ----a-w c:\windows\Fonts\BOISTERB.PFM 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-04-21 13:00 0 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2008-08-29 16:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-11 86016] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656] "VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552] "OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248] "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104] "MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992] "MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592] "MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 1121792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 163840] "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-09-27 999424] "StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-09-30 96984] "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344] "nwiz"="nwiz.exe" [2005-10-11 c:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] c:\documents and settings\Owner\Start Menu\Programs\Startup\ PowerReg Scheduler V3.exe [2007-12-23 225280] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\PROGRA~1\\RINGZS~1\\STORMC~1\\Stormser.exe"= *Newly Created Service* - RSVP . Contents of the 'Scheduled Tasks' folder 2007-02-02 c:\windows\Tasks\ISP signup reminder 1.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 3.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 07:19:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-12-02 7:21:09 ComboFix-quarantined-files.txt 2008-12-02 12:20:22 ComboFix2.txt 2008-12-02 11:20:27 ComboFix3.txt 2008-12-02 20:46:39 Pre-Run: 193,836,892,160 bytes free Post-Run: 193,831,616,512 bytes free 154 --- E O F --- 2008-11-13 22 05__________________________________________________________ Kaspersky scan -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, December 2, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, December 02, 2008 20:35:17 Records in database: 1432531 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Files scanned: 78016 Threat name: 4 Infected objects: 7 Suspicious objects: 0 Duration of the scan: 02:37:30 File name / Threat name / Threats count C:\Documents and Settings\Owner\My Documents\dad\4363abc\Codecs\AVICodecPackPlus210.exe Infected: not-a-virus:AdWare.Win32.Webdir.b 1 C:\Documents and Settings\Owner\My Documents\programs\applications\Codecs\AVICodecPackPlus210.exe Infected: not-a-virus:AdWare.Win32.Webdir.b 1 C:\Documents and Settings\Owner\My Documents\programs\Codecs\AVICodecPackPlus210.exe Infected: not-a-virus:AdWare.Win32.Webdir.b 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\cbXQgheF.dll.vir Infected: Trojan.Win32.Monderb.xio 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\svchost.exe.vir Infected: Trojan-Downloader.Win32.Small.ackc 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnoLdbA.dll.vir Infected: Trojan.Win32.Monderb.xio 1 D:\i386\Apps\App17981\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 The selected area was scanned. __________________________________________________________ HijackThis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:42:42 AM, on 12/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jqs.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\OasClnt.exe c:\program files\mcafee.com\vso\mcvsshld.exe C:\Program Files\Digital Media Reader\readericon45G.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Java\jre6\bin\java.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [readericon] "C:\Program Files\Digital Media Reader\readericon45G.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [OASClnt] "C:\Program Files\McAfee.com\VSO\oasclnt.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [MSKDetectorExe] "C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" /startup O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: PowerReg Scheduler V3.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O24 - Desktop Component 0: (no name) - http://www.hollisterco.com/hol/image...ringbettys.jpg -- End of file - 6692 bytes |
|
|
|
|
12-03-2008, 04:53 AM
|
#12 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello again
Quote:
Avast Free AVG Free Avira Free And save it to your desktop. Do not run/install just yet ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Once Combofix has finished disconnect from the internet. The click start> Control Panel> Add/Remove. Unistall Mcafee, security centre Must be uninstalled last. Once Mcafee has been uninstall, reboot. Now click on the installer file and follow the prompts, reconnect to the internet when the programme wishes to update. Also run a full system scan, save the report and post it in your reply. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. =========== Logs Required C:\Combofix.txt AV Scan Report Hijackthis Log
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
||
|
|
|
|
12-03-2008, 11:59 AM
|
#13 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
Good afternoon TheBruce1
Followed everything as instructed. with the av scan, While it did detect a few things, I took no action as yet. I wanted to make sure with you first. ******************************************************** Combofix log ******************************************************** ComboFix 08-12-01.03 - Owner 2008-12-03 11:28:59.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.129 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFscript.txt * Created a new restore point * Resident AV is active . - REDUCED FUNCTIONALITY MODE - FILE :: c:\documents and settings\Owner\My Documents\dad\4363abc\Codecs\AVICodecPackPlus210.exe c:\documents and settings\Owner\My Documents\programs\applications\Codecs\AVICodecPackPlus210.exe c:\documents and settings\Owner\My Documents\programs\Codecs\AVICodecPackPlus210.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Owner\My Documents\dad\4363abc\Codecs\AVICodecPackPlus210.exe c:\documents and settings\Owner\My Documents\programs\applications\Codecs\AVICodecPackPlus210.exe c:\documents and settings\Owner\My Documents\programs\Codecs\AVICodecPackPlus210.exe . ((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 ))))))))))))))))))))))))))))))) . 2008-12-03 03:29 . 2008-12-03 03:29 <DIR> d-------- c:\documents and settings\Owner\Application Data\Cool Record Edit Pro 2008-12-02 15:55 . 2008-12-02 15:55 <DIR> d-------- c:\program files\Trend Micro 2008-12-02 07:52 . 2008-12-02 07:52 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-02 07:52 . 2008-12-02 07:52 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-02 07:51 . 2008-12-02 07:51 <DIR> d-------- c:\program files\Java 2008-12-01 20:03 . 2008-12-01 20:13 250 --a------ c:\windows\gmer.ini 2008-11-23 04:30 . 2008-11-23 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\channels 2008-11-20 17:28 . 2008-11-20 17:28 <DIR> d-------- c:\program files\UnRar for Windows 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\program files\Free Sound Recorder 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\documents and settings\Owner\Application Data\Free Sound Recorder 2008-11-20 14:36 . 2005-05-17 12:37 1,986,560 --a------ c:\windows\system32\NCTAudioFile2.dll 2008-11-20 14:36 . 2005-05-18 11:52 1,212,416 --a------ c:\windows\system32\NCTAudioInformation2.dll 2008-11-20 14:36 . 2005-04-15 12:08 880,640 --a------ c:\windows\system32\NCTAudioEditor2.dll 2008-11-20 14:36 . 2004-11-04 13:31 835,584 --a------ c:\windows\system32\NCTAudioCDGrabber2.dll 2008-11-20 14:36 . 2005-04-04 17:21 602,112 --a------ c:\windows\system32\NCTAudioTransform2.dll 2008-11-20 14:36 . 2005-03-28 15:54 479,232 --a------ c:\windows\system32\NCTAudioVisualization2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioRecord2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioPlayer2.dll 2008-11-20 14:36 . 2005-03-28 15:52 417,792 --a------ c:\windows\system32\NCTTextToAudio2.dll 2008-11-20 14:36 . 2005-02-24 11:51 348,160 --a------ c:\windows\system32\NCTWMAFile2.dll 2008-11-20 14:36 . 2006-03-23 12:56 113,486 --a------ c:\windows\system32\NCTWMAProfiles.prx 2008-11-15 15:21 . 2008-11-16 18:51 <DIR> d-------- c:\program files\Lexmark X1100 Series 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-15 15:21 . 2003-08-18 06:56 69,632 --a------ c:\windows\system32\lxbkscin.dll 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 12:40 --------- d-----w c:\program files\Smiley Arcade 2008-12-02 07:32 --------- d-----w c:\program files\FTP Commander 2008-12-02 01:12 --------- d-----w c:\program files\Puppy Luv 2008-12-02 01:12 --------- d-----w c:\program files\CyberLink 2008-12-02 01:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-05 11:56 --------- d-----w c:\program files\DivX 2008-11-03 17:34 362 ----a-w c:\windows\Fonts\BOISTERC.PFM 2008-11-03 17:34 1,482 ----a-w c:\windows\Fonts\BOISTERB.PFM 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-04-21 13:00 0 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2008-08-29 16:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-12-02_15.45.00.35 ))))))))))))))))))))))))))))))))))))))))) . - 2008-02-22 05:23:35 135,168 ----a-w c:\windows\system32\java.exe + 2008-12-02 12:52:00 144,792 ----a-w c:\windows\system32\java.exe - 2008-02-22 05:23:39 135,168 ----a-w c:\windows\system32\javaw.exe + 2008-12-02 12:52:00 144,792 ----a-w c:\windows\system32\javaw.exe - 2008-02-22 06:33:32 139,264 ----a-w c:\windows\system32\javaws.exe + 2008-12-02 12:52:00 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-12-02 17:24:16 16,384 ----atw c:\windows\temp\Perflib_Perfdata_678.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-11 86016] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656] "VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552] "OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248] "MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104] "MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992] "MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592] "MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 1121792] "VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 163840] "MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-09-27 999424] "StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-09-30 96984] "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-02 136600] "nwiz"="nwiz.exe" [2005-10-11 c:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] c:\documents and settings\Owner\Start Menu\Programs\Startup\ PowerReg Scheduler V3.exe [2007-12-23 225280] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\PROGRA~1\\RINGZS~1\\STORMC~1\\Stormser.exe"= *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder 2007-02-02 c:\windows\Tasks\ISP signup reminder 1.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 3.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] . ******************************************************** ****************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-03 11:31:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-12-03 11:32:39 ComboFix-quarantined-files.txt 2008-12-03 16:32:07 ComboFix2.txt 2008-12-02 12:21:10 ComboFix3.txt 2008-12-02 11:20:27 ComboFix4.txt 2008-12-02 20:46:39 Pre-Run: 193,591,091,200 bytes free Post-Run: 194,081,054,720 bytes free 175 --- E O F --- 2008-11-13 22 05******************************************************** Avira Scan Log ******************************************************** Avira AntiVir Personal Report file date: Wednesday, December 03, 2008 13:43 Scanning for 1071567 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: YOUR-D0AD85DE8F Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 11/18/2008 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 12/3/2008 16:50:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 14:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 19:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 14:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 16:50:54 ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 11/9/2008 16:50:54 ANTIVIR2.VDF : 7.1.0.160 571392 Bytes 11/30/2008 16:50:54 ANTIVIR3.VDF : 7.1.0.183 162304 Bytes 12/3/2008 16:50:54 Engineversion : 8.2.0.36 AEVDF.DLL : 8.1.0.6 102772 Bytes 10/14/2008 17:05:56 AESCRIPT.DLL : 8.1.1.15 332156 Bytes 12/3/2008 16:50:54 AESCN.DLL : 8.1.1.5 123251 Bytes 12/3/2008 16:50:54 AERDL.DLL : 8.1.1.3 438645 Bytes 12/3/2008 16:50:54 AEPACK.DLL : 8.1.3.4 393591 Bytes 12/3/2008 16:50:54 AEOFFICE.DLL : 8.1.0.30 196986 Bytes 12/3/2008 16:50:54 AEHEUR.DLL : 8.1.0.71 1487222 Bytes 12/3/2008 16:50:54 AEHELP.DLL : 8.1.2.0 119159 Bytes 12/3/2008 16:50:54 AEGEN.DLL : 8.1.1.6 323955 Bytes 12/3/2008 16:50:54 AEEMU.DLL : 8.1.0.9 393588 Bytes 10/14/2008 17:05:56 AECORE.DLL : 8.1.5.2 172405 Bytes 12/3/2008 16:50:54 AEBB.DLL : 8.1.0.3 53618 Bytes 10/14/2008 17:05:56 AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 15:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 16:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 12/3/2008 16:50:54 AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 18:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 15:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 19:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 00:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 19:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 19:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 20:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 20:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Wednesday, December 03, 2008 13:43 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned Scan process 'soundman.exe' - '1' Module(s) have been scanned Scan process 'readericon45G.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PRISMXL.SYS' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 31 processes with 31 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] System error [21]: The device is not ready. Master boot sector HD2 [INFO] No virus was found! [WARNING] System error [21]: The device is not ready. Master boot sector HD3 [INFO] No virus was found! [WARNING] System error [21]: The device is not ready. Master boot sector HD4 [INFO] No virus was found! [WARNING] System error [21]: The device is not ready. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '61' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\Program Files\Ringz Studio\Storm Codec\Stormser.exe [DETECTION] Is the TR/FwBypass.A.14 Trojan [WARNING] The file was ignored! C:\Qoobox\Quarantine\C\Documents and Settings\Owner\~.exe.vir [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [WARNING] The file was ignored! C:\Qoobox\Quarantine\C\Documents and Settings\Owner\My Documents\dad\4363abc\Codecs\AVICodecPackPlus210.exe.vir [DETECTION] Contains recognition pattern of the DR/Webdir.B.4 dropper [WARNING] The file was ignored! C:\Qoobox\Quarantine\C\Documents and Settings\Owner\My Documents\programs\applications\Codecs\AVICodecPackPlus210.exe.vir [DETECTION] Contains recognition pattern of the DR/Webdir.B.4 dropper [WARNING] The file was ignored! C:\Qoobox\Quarantine\C\Documents and Settings\Owner\My Documents\programs\Codecs\AVICodecPackPlus210.exe.vir [DETECTION] Contains recognition pattern of the DR/Webdir.B.4 dropper [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP195\A0044566.dll [DETECTION] Is the TR/BHO.Gen Trojan [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP197\A0044857.dll [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP197\A0044858.exe [DETECTION] Is the TR/Agent.26624.37 Trojan [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP197\A0044860.dll [DETECTION] Is the TR/Vundo.Gen Trojan [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP197\A0044869.dll [DETECTION] Is the TR/Vundo.Gen Trojan [WARNING] The file was ignored! C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP198\A0045011.exe [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [WARNING] The file was ignored! Begin scan in 'D:\' <RECOVERY> End of the scan: Wednesday, December 03, 2008 14:30 Used time: 46:32 Minute(s) The scan has been done completely. 6344 Scanning directories 567006 Files were scanned 11 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 566993 Files not concerned 13993 Archives were scanned 17 Warnings 0 Notes ******************************************************** HijackThis log ******************************************************** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:50:35 PM, on 12/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Digital Media Reader\readericon45G.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [readericon] "C:\Program Files\Digital Media Reader\readericon45G.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: PowerReg Scheduler V3.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O24 - Desktop Component 0: (no name) - http://www.hollisterco.com/hol/image...ringbettys.jpg -- End of file - 5285 bytes |
|
|
|
|
12-03-2008, 01:28 PM
|
#14 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello again
Quote:
First, Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs: Storm Codec ========= Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== You can have Avira delete/quarantine what it found during the scan. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required C:\Combofix.txt Hijackthis Log
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
||
|
|
|
|
12-03-2008, 03:40 PM
|
#15 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
thanks again for your time and effort TheBruce1!!
followed directions as you described ******************************************************* ComboFix log ******************************************************* ComboFix 08-12-01.03 - Owner 2008-12-03 16:48:24.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.178 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFscript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\progra~1\McAfee c:\progra~1\McAfee\SpamKiller\borlndmm.dll c:\progra~1\McAfee\SpamKiller\MSKColors.dat c:\progra~1\McAfee\SpamKiller\MSKDetct.exe c:\progra~1\McAfee\SpamKiller\MSKFilte.inf c:\progra~1\McAfee\SpamKiller\MSKRescs.dll c:\program files\Ringz Studio . ((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 ))))))))))))))))))))))))))))))) . 2008-12-03 11:47 . 2008-12-03 11:47 <DIR> d-------- c:\program files\Avira 2008-12-03 11:47 . 2008-12-03 11:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira 2008-12-03 03:29 . 2008-12-03 03:29 <DIR> d-------- c:\documents and settings\Owner\Application Data\Cool Record Edit Pro 2008-12-02 15:55 . 2008-12-02 15:55 <DIR> d-------- c:\program files\Trend Micro 2008-12-02 07:52 . 2008-12-02 07:52 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-02 07:52 . 2008-12-02 07:52 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-02 07:51 . 2008-12-02 07:51 <DIR> d-------- c:\program files\Java 2008-12-01 20:03 . 2008-12-01 20:13 250 --a------ c:\windows\gmer.ini 2008-11-23 04:30 . 2008-11-23 04:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\channels 2008-11-20 17:28 . 2008-11-20 17:28 <DIR> d-------- c:\program files\UnRar for Windows 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\program files\Free Sound Recorder 2008-11-20 14:36 . 2008-11-20 14:36 <DIR> d-------- c:\documents and settings\Owner\Application Data\Free Sound Recorder 2008-11-20 14:36 . 2005-05-17 12:37 1,986,560 --a------ c:\windows\system32\NCTAudioFile2.dll 2008-11-20 14:36 . 2005-05-18 11:52 1,212,416 --a------ c:\windows\system32\NCTAudioInformation2.dll 2008-11-20 14:36 . 2005-04-15 12:08 880,640 --a------ c:\windows\system32\NCTAudioEditor2.dll 2008-11-20 14:36 . 2004-11-04 13:31 835,584 --a------ c:\windows\system32\NCTAudioCDGrabber2.dll 2008-11-20 14:36 . 2005-04-04 17:21 602,112 --a------ c:\windows\system32\NCTAudioTransform2.dll 2008-11-20 14:36 . 2005-03-28 15:54 479,232 --a------ c:\windows\system32\NCTAudioVisualization2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioRecord2.dll 2008-11-20 14:36 . 2005-04-25 13:01 458,752 --a------ c:\windows\system32\NCTAudioPlayer2.dll 2008-11-20 14:36 . 2005-03-28 15:52 417,792 --a------ c:\windows\system32\NCTTextToAudio2.dll 2008-11-20 14:36 . 2005-02-24 11:51 348,160 --a------ c:\windows\system32\NCTWMAFile2.dll 2008-11-20 14:36 . 2006-03-23 12:56 113,486 --a------ c:\windows\system32\NCTWMAProfiles.prx 2008-11-15 15:21 . 2008-11-16 18:51 <DIR> d-------- c:\program files\Lexmark X1100 Series 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-15 15:21 . 2001-08-17 22:36 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-15 15:21 . 2003-08-18 06:56 69,632 --a------ c:\windows\system32\lxbkscin.dll 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-15 15:21 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-03 16:37 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com 2008-12-02 12:40 --------- d-----w c:\program files\Smiley Arcade 2008-12-02 07:32 --------- d-----w c:\program files\FTP Commander 2008-12-02 01:12 --------- d-----w c:\program files\Puppy Luv 2008-12-02 01:12 --------- d-----w c:\program files\CyberLink 2008-12-02 01:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-05 11:56 --------- d-----w c:\program files\DivX 2008-11-03 17:34 362 ----a-w c:\windows\Fonts\BOISTERC.PFM 2008-11-03 17:34 1,482 ----a-w c:\windows\Fonts\BOISTERB.PFM 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-04-21 13:00 0 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2008-08-29 16:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-12-02_15.45.00.35 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-09 18:15:51 45,376 ----a-w c:\windows\system32\drivers\avgntdd.sys + 2008-01-21 23:11:28 22,336 ----a-w c:\windows\system32\drivers\avgntmgr.sys + 2008-12-03 16:50:54 75,072 ----a-w c:\windows\system32\drivers\avipbb.sys + 2007-03-01 15:34:22 28,352 ----a-w c:\windows\system32\drivers\ssmdrv.sys - 2008-02-22 05:23:35 135,168 ----a-w c:\windows\system32\java.exe + 2008-12-02 12:52:00 144,792 ----a-w c:\windows\system32\java.exe - 2008-02-22 05:23:39 135,168 ----a-w c:\windows\system32\javaw.exe + 2008-12-02 12:52:00 144,792 ----a-w c:\windows\system32\javaw.exe - 2008-02-22 06:33:32 139,264 ----a-w c:\windows\system32\javaws.exe + 2008-12-02 12:52:00 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-12-03 16:39:18 16,384 ----atw c:\windows\temp\Perflib_Perfdata_5a4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-11 86016] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656] "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-02 136600] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "nwiz"="nwiz.exe" [2005-10-11 c:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] c:\documents and settings\Owner\Start Menu\Programs\Startup\ PowerReg Scheduler V3.exe [2007-12-23 225280] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\DNA\\btdna.exe"= *Newly Created Service* - ANTIVIRSCHEDULER *Newly Created Service* - ANTIVIRSERVICE *Newly Created Service* - AVGIO *Newly Created Service* - AVGNTFLT *Newly Created Service* - AVIPBB . Contents of the 'Scheduled Tasks' folder 2007-02-02 c:\windows\Tasks\ISP signup reminder 1.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] 2007-02-02 c:\windows\Tasks\ISP signup reminder 3.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-04 14:00] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-03 16:54:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-12-03 16:55:43 ComboFix-quarantined-files.txt 2008-12-03 21:55:08 ComboFix2.txt 2008-12-03 16:32:41 ComboFix3.txt 2008-12-02 12:21:10 ComboFix4.txt 2008-12-02 11:20:27 ComboFix5.txt 2008-12-03 21:47:47 Pre-Run: 194,565,877,760 bytes free Post-Run: 194,607,308,800 bytes free 171 --- E O F --- 2008-11-13 22 05******************************************************* HijackThis log ******************************************************* Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:36:46 PM, on 12/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Digital Media Reader\readericon45G.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [readericon] "C:\Program Files\Digital Media Reader\readericon45G.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: PowerReg Scheduler V3.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O24 - Desktop Component 0: (no name) - http://www.hollisterco.com/hol/image...ringbettys.jpg -- End of file - 4958 bytes |
|
|
|
|
12-03-2008, 04:09 PM
|
#16 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Hello again
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) If you know what this entry is then you can leave it, otherwise have hijackthis fix it O24 - Desktop Component 0: (no name) - http://www.hollisterco.com/hol/image...ringbettys.jpg Please remember to close all other windows, including browsers then click Fix checked. ======== Delete this folder in blue. c:\documents and settings\All Users\Application Data\McAfee.com ========= You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:. ========= If there are no further issues, continue below. ========= Delete DDS from your desktop, also uninstall Hijackthis via add/remove. You can keep ATF-Cleaner if you wish. Click Start>Run and type or copy/paste the following command then hit enter to uninstall gmer. %systemroot%\gmer_uninstall.cmd ========= Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ========== Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place.
------------------------------------------------------------------ The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player. It can also alert you if you have not installed the latest patches from Microsoft. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
12-03-2008, 04:48 PM
|
#17 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
McAfee had the firewall as a part of the program. I will get a different one.
Thank you very much TheBruce1. I greatly appreciate the time and effort you and the guys here at TSF put in!!! basskiller |
|
|
|
|
12-03-2008, 11:51 PM
|
#18 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 11
OS: XP
|
Re: Adware infection help needed
All the way through this process , no pop ups. Just a few minutes ago I get the adware2009 pop up .. when you click on it anywhere, it takes you to a site (proscanneronline.com or something like that) that wants to scan your computer. I've seen this before and know not to click anywhere on it. I just shut down my computer.
the strange part about this.. I've only been to my sites and one other.. |
|
|
|
|
12-04-2008, 08:00 AM
|
#20 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: Adware infection help needed
Lets take a look.
 Download DDS and save it to your desktop from here or here or here. Disable any script blocker, and then double click dds.scr to run the tool.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
| Thread Tools | |
|
|
