|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-15-2009, 09:53 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 6
OS: XP SP3
|
My Computer is Haunted
My computer is haunted!!! Continues to pop up a balloon stating "you have a security problem" Microsoft antivirus pop ups and other pop ups.
McAfee says I have a Trojan - Generic!Artemis Location: C:\Documents and Settings\Robert Schiller\Local Settings\Temp\~tmpd.exe an update shield with a red "X" in it 3~tmpd Any help would be appreciated, Thank you in advance. DDS (Ver_09-01-07.01) - NTFSx86 Run by Robert Schiller at 19:13:31.20 on Thu 01/15/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.174 [GMT -6:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) FW: McAfee Personal Firewall *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\ert58464.exe C:\WINDOWS\system32\ctfmon.exe c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\~tmpd.exe c:\PROGRA~1\mcafee\msc\mcshell.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe c:\program files\aol\aim toolbar 5.0\AolTbServer.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\~tmpa.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\HHCGM5HM.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Robert Schiller\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.comcast.net/ uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://www.dell4me.com/myway uSearch Bar = hxxp://bfc.myway.com/search/de_srchlft.html uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: N/A: {4d25f926-b9fe-4682-bf72-8ab8210d6d75} - c:\program files\mywaysa\srchasde\1.bin\deSrcAs.dll uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\1.bin\MWSSRCAS.DLL BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\1.bin\MWSSRCAS.DLL BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL BHO: : {4d25f921-b9fe-4682-bf72-8ab8210d6d75} - c:\program files\mywaysa\srchasde\1.bin\deSrcAs.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: HomepageBHO: {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - c:\windows\system32\hp5BBC.tmp TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} - c:\program files\aim toolbar\AIMBar.dll TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL TB: {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - No File TB: {EA0D26BD-9029-431A-86E0-83152D67828A} - No File TB: My &Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File EB: SideStep: {83b28a74-640d-48f4-9f51-e80eed7cc7e0} - c:\windows\downloaded program files\SbCIe02a.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [License Manager] "c:\program files\license_manager\license_manager.exe " /silent uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter uRun: [Cognac] c:\docume~1\robert~1\locals~1\temp\~tmpa.exe uRun: [MSFox] c:\docume~1\robert~1\locals~1\temp\ert58464.exe mRun: [MMTray] "c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe" mRun: [MimBoot] c:\progra~1\musicm~1\musicm~2\mimboot.exe mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe" mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html IE: &Search - http://edits.mywebsearch.com/toolbar...p=ZBxdm213YYUS IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll IE: {3E230861-5C87-11D3-A1C6-00105A1B41B8} - {83B28A74-640D-48F4-9F51-E80EED7CC7E0} - c:\windows\downloaded program files\SbCIe02a.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Trusted Zone: turbotax.com Trusted Zone: musicmatch.com\online Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\robert~1\applic~1\mozilla\firefox\profiles\8mj889ge.default\ FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll ============= SERVICES / DRIVERS =============== R0 wff;wff;c:\windows\system32\drivers\WFF.sys [2005-4-25 17280] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-10 201320] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-6-10 695624] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-6-10 79304] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-6-10 35240] R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-6-10 33832] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-6-10 40488] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2008-6-9 206096] R4 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-6-10 359248] R4 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-6-10 144704] R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-11-5 24652] =============== Created Last 30 ================ 2009-01-15 19:03 69,632 a------- c:\windows\system32\HHCGM5HM.exe 2009-01-15 19:03 0 a------- c:\windows\system32\HHCGM5HM.exe.a_a 2008-12-29 16:45 <DIR> --d----- c:\program files\Norton Security Scan 2008-12-29 05:57 <DIR> --d----- c:\windows\system32\Adobe ==================== Find3M ==================== 2008-12-13 00:40 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll 2008-12-11 04:57 333,952 a------- c:\windows\system32\drivers\srv.sys 2008-12-11 04:57 333,952 -------- c:\windows\system32\dllcache\srv.sys 2008-10-24 05:21 455,296 -------- c:\windows\system32\dllcache\mrxsmb.sys 2008-10-23 06:36 286,720 a------- c:\windows\system32\gdi32.dll 2008-10-23 06:36 286,720 -------- c:\windows\system32\dllcache\gdi32.dll 2007-03-29 19:49 0 a------- c:\docume~1\robert~1\applic~1\Install.dat 2006-12-12 22:32 29,784 a------- c:\program files\popcorn Terms.html 2008-08-27 17:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082720080828\index.dat ============= FINISH: 19:15:04.71 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-17-2009, 09:33 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: My Computer is Haunted
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
01-18-2009, 12:55 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 6
OS: XP SP3
|
Re: My Computer is Haunted
ComboFix 09-01-17.03 - Robert Schiller 2009-01-18 1:40:38.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.394 [GMT -6:00] Running from: c:\documents and settings\Robert Schiller\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Chris\Favorites\Online Security Test.url c:\documents and settings\Kim\Application Data\drvcleaner.exe c:\documents and settings\Robert Schiller\Application Data\install.dat c:\documents and settings\Robert Schiller\Application Data\ultra c:\documents and settings\Robert Schiller\Application Data\ultra\ultra.inf c:\documents and settings\Robert Schiller\Application Data\ultra\uninstall.bat c:\program files\Common Files\WinSoftware c:\program files\Common Files\WinSoftware\wff.exe c:\program files\FunWebProducts c:\program files\FunWebProducts\Shared\Cache\CheckersAIMBtn.html c:\program files\FunWebProducts\Shared\Cache\ChessAIMBtn.html c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html c:\program files\FunWebProducts\Shared\Cache\EnableDisableAIMBtn.html c:\program files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html c:\program files\FunWebProducts\Shared\Cache\MailStampBtn.html c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html c:\program files\FunWebProducts\Shared\Cache\MySignatureInsertBtn.html c:\program files\FunWebProducts\Shared\Cache\MySignaturePreviewBtn.html c:\program files\FunWebProducts\Shared\Cache\MyStationeryBtn.html c:\program files\FunWebProducts\Shared\Cache\NoSettingAIMBtn.html c:\program files\FunWebProducts\Shared\Cache\ReversiAIMBtn.html c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html c:\program files\License_Manager c:\program files\License_Manager\license_manager.exe c:\program files\MyWebSearch c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL c:\program files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL c:\program files\MyWebSearch\bar\Cache\0005455D c:\program files\MyWebSearch\bar\Cache\000F748B c:\program files\MyWebSearch\bar\Cache\00138B7A c:\program files\MyWebSearch\bar\Cache\0023307B.bin c:\program files\MyWebSearch\bar\Cache\002330D9.bin c:\program files\MyWebSearch\bar\Cache\00233137.bin c:\program files\MyWebSearch\bar\Cache\00359028 c:\program files\MyWebSearch\bar\Cache\005EE17D c:\program files\MyWebSearch\bar\Cache\006649BA c:\program files\MyWebSearch\bar\Cache\010770EB c:\program files\MyWebSearch\bar\Cache\02082D87.bin c:\program files\MyWebSearch\bar\Cache\02082E23.bin c:\program files\MyWebSearch\bar\Cache\02082EA0.bin c:\program files\MyWebSearch\bar\Cache\02082F2C.bin c:\program files\MyWebSearch\bar\Cache\02083026.bin c:\program files\MyWebSearch\bar\Cache\02086CD2.bin c:\program files\MyWebSearch\bar\Cache\02086D6E.bin c:\program files\MyWebSearch\bar\Cache\02086DDB.bin c:\program files\MyWebSearch\bar\Cache\02086E58.bin c:\program files\MyWebSearch\bar\Cache\02086ED5.bin c:\program files\MyWebSearch\bar\Cache\023D56B8 c:\program files\MyWebSearch\bar\Cache\0263C160 c:\program files\MyWebSearch\bar\Cache\026CAC74 c:\program files\MyWebSearch\bar\Cache\0652C824 c:\program files\MyWebSearch\bar\Cache\files.ini c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S c:\program files\MyWebSearch\bar\Game\CHESS.F3S c:\program files\MyWebSearch\bar\Game\REVERSI.F3S c:\program files\MyWebSearch\bar\History\search2 c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm c:\program files\MyWebSearch\bar\Settings\s_pid.dat c:\program files\MyWebSearch\bar\Settings\setting2.htm c:\program files\MyWebSearch\bar\Settings\settings.dat c:\program files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL c:\program files\popcorn Terms.html c:\program files\security toolbar c:\program files\security toolbar\Uninstall.bat c:\program files\webhancer c:\program files\webhancer\Programs\license.txt c:\program files\webhancer\Programs\readme.txt c:\program files\webhancer\Programs\sporder.dll c:\program files\webhancer\Programs\wbhshare.dll c:\program files\webhancer\Programs\whAgent.ini c:\program files\webhancer\Programs\whSurvey.ini c:\program files\whInstall c:\program files\whInstall\license.txt c:\program files\whInstall\readme.txt c:\program files\whInstall\whAgent.ini c:\program files\zango c:\program files\zango\zango_gdf.dat c:\program files\zango\zango_hpk.dat c:\program files\zango\zango_kyf.dat c:\program files\zango\zangoau.dat c:\windows\Downloaded Program Files\setup.inf c:\windows\IE4 Error Log.txt c:\windows\inf\ultra.inf c:\windows\system32\f3PSSavr.scr c:\windows\system32\HHCGM5HM.exe.a_a . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PACKET ((((((((((((((((((((((((( Files Created from 2008-12-18 to 2009-01-18 ))))))))))))))))))))))))))))))) . 2009-01-15 19:16 . 2009-01-15 19:17 250 --a------ c:\windows\gmer.ini 2009-01-15 19:03 . 2009-01-18 01:24 69,632 --a------ c:\windows\SYSTEM32\HHCGM5HM.exe 2008-12-29 16:45 . 2009-01-16 18:00 <DIR> d-------- c:\program files\Norton Security Scan 2008-12-29 05:57 . 2008-12-29 05:57 <DIR> d-------- c:\windows\SYSTEM32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-18 07:16 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2009-01-17 00:02 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-16 01:06 --------- d-----w c:\program files\hkSFV 2009-01-15 01:51 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2009-01-14 23:43 --------- d-----w c:\program files\PokerStars.NET 2008-12-31 03:22 --------- d-----w c:\program files\Viewpoint 2008-12-31 03:22 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2008-12-21 15:04 --------- d-----w c:\program files\Google 2008-12-18 03:08 --------- d-----w c:\program files\McAfee 2008-12-16 03:15 --------- d-----w c:\program files\MSECache 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-08 02:40 --------- d-----w c:\documents and settings\Robert Schiller\Application Data\Leadertech 2008-11-28 15:45 --------- d-----w c:\documents and settings\Kim\Application Data\Apple Computer 2008-11-28 05:24 --------- d-----w c:\documents and settings\Chris\Application Data\Apple Computer 2008-08-27 23:31 32,768 --sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008082720080828\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-26 68856] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592] "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 11776] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 18:12 15360 c:\windows\SYSTEM32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] --a------ 2003-09-17 10:43 57344 c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a------ 2004-11-16 00:05 127035 c:\windows\SYSTEM32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2004-08-23 18:19 57344 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2005-10-14 13:46 77824 c:\windows\SYSTEM32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2005-10-14 13:49 94208 c:\windows\SYSTEM32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM] --a------ 2003-09-03 20:12 221184 c:\program files\Intel\Modem Event Monitor\IntelMEM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] --a------ 2006-01-19 11:06 110592 c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 18:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --------- 2004-04-11 20:15 290816 c:\program files\Dell\Media Experience\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2004-11-24 21:12 26112 c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2004-09-28 20:26 32881 c:\program files\Java\j2re1.4.2_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] --a------ 2005-08-22 13:36 100056 c:\progra~1\SYMNET~1\SNDMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2004-01-07 01:01 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] --------- 2000-05-11 01:00 90112 c:\windows\Updreg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper] --a------ 2004-06-10 11:51 60928 c:\windows\SYSTEM32\P17.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= R0 wff;wff;c:\windows\SYSTEM32\DRIVERS\WFF.sys [2005-04-25 17280] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2008-06-09 206096] R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-11-05 24652] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de6d17b5-27e3-11db-adbc-00038a000015}] \Shell\AutoRun\command - G:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder 2009-01-16 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-01-16 c:\windows\Tasks\At1.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At10.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At11.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At12.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At13.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At14.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At15.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At16.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At17.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At18.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At19.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At2.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At20.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At21.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At22.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At23.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-17 c:\windows\Tasks\At24.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At25.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At26.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At27.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At28.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At29.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At3.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At30.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At31.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At32.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At33.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At34.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At35.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At36.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At37.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At38.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At39.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At4.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At40.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At41.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At42.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At43.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At44.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At45.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At46.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At47.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-18 c:\windows\Tasks\At48.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At5.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At6.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At7.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At8.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-16 c:\windows\Tasks\At9.job - c:\windows\system32\HHCGM5HM.exe [2009-01-18 01:24] 2009-01-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2009-01-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2009-01-17 c:\windows\Tasks\Norton Security Scan for Chris.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18] 2009-01-17 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-12-14 12:24] 2005-03-19 c:\windows\Tasks\XoftSpy.job - c:\program files\XoftSpy\XoftSpy.exe [] . - - - - ORPHANS REMOVED - - - - HKCU-Run-License Manager - c:\program files\License_Manager\license_manager.exe MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe MSConfigStartUp-DellSupport - c:\program files\Dell Support\DSAgnt.exe MSConfigStartUp-mmtask - c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html IE: &Search - http://edits.mywebsearch.com/toolbar...p=ZBxdm213YYUS IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html IE: {{d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe Trusted Zone: *.turbotax.com Trusted Zone: online.musicmatch.com c:\windows\Downloaded Program Files\SbCIe02a.dll - O16 -: {640B39C1-D713-464F-92C3-75BD972B95EE} hxxp://www.sidestep.com/get/k42037/sb02a.cab c:\windows\Downloaded Program Files\SbCIe02a.inf FF - ProfilePath - c:\documents and settings\Robert Schiller\Application Data\Mozilla\Firefox\Profiles\8mj889ge.default\ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-18 01:49:20 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\SYSTEM32\CTSVCCDA.EXE c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MPF\MpfSrv.exe c:\windows\SYSTEM32\HPZipm12.exe c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\SYSTEM32\MsPMSPSv.exe c:\program files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe c:\program files\MUSICMATCH\Musicmatch Jukebox\mim.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe c:\progra~1\McAfee\MSC\mcuimgr.exe . ************************************************************************** . Completion time: 2009-01-18 1:52:55 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-18 07:52:52 Pre-Run: 110,024,560,640 bytes free Post-Run: 117,088,399,360 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 429 --- E O F --- 2009-01-14 23:55:48 |
|
|
|
|
01-18-2009, 02:28 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: My Computer is Haunted
Hello Chipper 1022.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist: LiveUpdate 2.6 (Symantec Corporation) ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if they still exist: Viewpoint Manager Viewpoint Media Player The above are considered foistware instead of malware since they are installed without users approval, but don't spy or do anything "bad". Please read here and here If you decide to uninstall them, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ Go Start > Run and copy/paste the following single-line command into the Run box and click OK: cmd /c del /a/f/q "C:\WINDOWS\Tasks\At*.job" A DOS window will open and close again, this is normal. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/335285-my-computer-haunted.html#post1918791 Collect:: c:\windows\SYSTEM32\HHCGM5HM.exe File:: c:\windows\Tasks\Norton Security Scan for Chris.job c:\windows\Tasks\Symantec NetDetect.job c:\windows\Tasks\XoftSpy.job Folder:: c:\program files\Common Files\Symantec Shared Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000000 IE: &Search - http://edits.mywebsearch.com/toolbar...p=ZBxdm213YYUS  Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
------------------------------------------------------ |
|
|
|
|
01-18-2009, 07:38 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 6
OS: XP SP3
|
Re: My Computer is Haunted
When I tried to delete C:\Program Files\Viewpoint, an error message appeared stating "Cannot delete AxMetaStream.dll: Access is denied Make sure the disk is not full or write-protected and that the file is not currently in use"
I was also unable to find an Application Data folder under Documents and Settings/All Users I already removed both Viewpoint programs from the remove programs menu. Here is the combofix log: ComboFix 09-01-17.03 - Robert Schiller 2009-01-18 8:26:49.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.610 [GMT -6:00] Running from: c:\documents and settings\Robert Schiller\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Robert Schiller\Desktop\CFScript.txt AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point FILE :: c:\windows\Tasks\Norton Security Scan for Chris.job c:\windows\Tasks\Symantec NetDetect.job c:\windows\Tasks\XoftSpy.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Common Files\Symantec Shared c:\program files\Common Files\Symantec Shared\AntiSpam\SpamDefs\ENGLISH.MBK c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll c:\program files\Common Files\Symantec Shared\Default.rul c:\program files\Common Files\Symantec Shared\DefUpdateCheck.dll c:\program files\Common Files\Symantec Shared\Firewall.BAK c:\program files\Common Files\Symantec Shared\Firewall.rul c:\program files\Common Files\Symantec Shared\IDS\DefUtDcd.dll c:\program files\Common Files\Symantec Shared\IDS\IDSaux.dll c:\program files\Common Files\Symantec Shared\IDS\IdsInst.exe c:\program files\Common Files\Symantec Shared\IDS\IDSSettg.BAK c:\program files\Common Files\Symantec Shared\IDS\IDSSettg.dat c:\program files\Common Files\Symantec Shared\IDS\Patch25.dll c:\program files\Common Files\Symantec Shared\IDS\SymIDSLU.dll c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\ccL70U.dll c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\instopts.dat c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\NSSSetup.exe c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\Setup.msi c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\SymHTML.dll c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\SymTheme.dll c:\program files\Common Files\Symantec Shared\Persist.BAK c:\program files\Common Files\Symantec Shared\Persist.Dat c:\program files\Common Files\Symantec Shared\SEVINST.EXE c:\program files\Common Files\Symantec Shared\SNDALRT.log c:\program files\Common Files\Symantec Shared\SNDCON.log c:\program files\Common Files\Symantec Shared\SNDDBG.log c:\program files\Common Files\Symantec Shared\SNDFW.log c:\program files\Common Files\Symantec Shared\SNDIDS.log c:\program files\Common Files\Symantec Shared\SNDInst.exe c:\program files\Common Files\Symantec Shared\SNDSrvc.exe c:\program files\Common Files\Symantec Shared\SNDSYS.log c:\program files\Common Files\Symantec Shared\SNDunin.dll c:\program files\Common Files\Symantec Shared\SPManifests\CIDS.GRD c:\program files\Common Files\Symantec Shared\SPManifests\CIDS.SIG c:\program files\Common Files\Symantec Shared\SPManifests\CIDS.SPM c:\program files\Common Files\Symantec Shared\SPManifests\Snd.grd c:\program files\Common Files\Symantec Shared\SPManifests\Snd.sig c:\program files\Common Files\Symantec Shared\SPManifests\Snd.spm c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.GRD c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SIG c:\program files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SPM c:\program files\Common Files\Symantec Shared\SymcData\idsdefs\lulock.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\CATALOG.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\CCERASER.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ECMSVR32.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\EECTRL.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ERASER.GRD c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ERASER.SIG c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ERASER.SPM c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ERASER.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ESRDEF.BIN c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\HH c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\hub.scr c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\NAVENG.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\NAVENG32.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\NAVEX15.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\NAVEX32A.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\NCSACERT.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\SCRAUTH.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\SYMAVENG.CAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\SYMAVENG.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\SYMERASE.CAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\SYMERASE.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TCDEFS.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TCSCAN7.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TCSCAN8.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TCSCAN9.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TECHNOTE.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TINF.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TINFIDX.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TINFL.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TSCAN1.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\TSCAN1HD.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\V.GRD c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\V.SIG c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN1.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN2.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN3.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN4.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN5.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN6.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN7.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN8.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCAN9.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\VIRSCANT.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\vscanmsx.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\WHATSNEW.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090107.002\ZDONE.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\CATALOG.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\CCERASER.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ECMSVR32.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\EECTRL.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ERASER.GRD c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ERASER.SIG c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ERASER.SPM c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ERASER.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ESRDEF.BIN c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\HH c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\hub.scr c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\NAVENG.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\NAVENG32.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\NAVEX15.SYS c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\NAVEX32A.DLL c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\NCSACERT.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\SCRAUTH.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\SYMAVENG.CAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\SYMAVENG.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\SYMERASE.CAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\SYMERASE.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TCDEFS.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TCSCAN7.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TCSCAN8.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TCSCAN9.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TECHNOTE.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TINF.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TINFIDX.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TINFL.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TSCAN1.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\TSCAN1HD.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\V.GRD c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\V.SIG c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN.INF c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN1.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN2.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN3.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN4.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN5.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN6.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN7.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN8.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCAN9.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\VIRSCANT.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\vscanmsx.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\WHATSNEW.TXT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20090116.004\ZDONE.DAT c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\catalog.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\cceraser.dll c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ecmsvr32.dll c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\eeCtrl.sys c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.grd c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sig c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.spm c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sys c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\esrdef.bin c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\hh c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng.sys c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng32.dll c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex15.sys c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex32a.dll c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ncsacert.txt c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\scrauth.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.cat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.inf c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.cat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.inf c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcdefs.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan7.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan8.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan9.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\technote.txt c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinf.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfidx.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfl.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1hd.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.grd c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.sig c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan.inf c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan1.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan2.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan3.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan4.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan5.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan6.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan7.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan8.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan9.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\whatsnew.txt c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\zdone.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\definfo.dat c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\usage.dat c:\program files\Common Files\Symantec Shared\Validate.dat c:\program files\Common Files\Symantec Shared\VirusDefs\lulock.dat c:\windows\SYSTEM32\HHCGM5HM.exe c:\windows\Tasks\Norton Security Scan for Chris.job c:\windows\Tasks\XoftSpy.job . ((((((((((((((((((((((((( Files Created from 2008-12-18 to 2009-01-18 ))))))))))))))))))))))))))))))) . 2009-01-15 19:16 . 2009-01-15 19:17 250 --a------ c:\windows\gmer.ini 2008-12-29 16:45 . 2009-01-16 18:00 <DIR> d-------- c:\program files\Norton Security Scan 2008-12-29 05:57 . 2008-12-29 05:57 <DIR> d-------- c:\windows\SYSTEM32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-18 14:19 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-18 14:18 --------- d-----w c:\program files\Symantec 2009-01-18 07:16 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2009-01-16 01:06 --------- d-----w c:\program files\hkSFV 2009-01-15 01:51 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2009-01-14 23:43 --------- d-----w c:\program files\PokerStars.NET 2008-12-31 03:22 --------- d-----w c:\program files\Viewpoint 2008-12-21 15:04 --------- d-----w c:\program files\Google 2008-12-18 03:08 --------- d-----w c:\program files\McAfee 2008-12-16 03:15 --------- d-----w c:\program files\MSECache 2008-12-13 06:40 3,593,216 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 10:57 333,952 ------w c:\windows\SYSTEM32\DLLCACHE\srv.sys 2008-12-08 02:40 --------- d-----w c:\documents and settings\Robert Schiller\Application Data\Leadertech 2008-11-28 15:45 --------- d-----w c:\documents and settings\Kim\Application Data\Apple Computer 2008-11-28 05:24 --------- d-----w c:\documents and settings\Chris\Application Data\Apple Computer 2008-10-24 11:21 455,296 ------w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\SYSTEM32\gdi32.dll 2008-10-23 12:36 286,720 ------w c:\windows\SYSTEM32\DLLCACHE\gdi32.dll 2008-08-27 23:31 32,768 --sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008082720080828\index.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-18_ 1.52.09.14 ))))))))))))))))))))))))))))))))))))))))) . - 2009-01-18 07:16:05 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat + 2009-01-18 14:11:10 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat - 2009-01-18 07:16:05 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat + 2009-01-18 14:11:10 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat - 2009-01-18 07:16:05 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2009-01-18 14:11:10 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-26 68856] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592] "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 11776] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 18:12 15360 c:\windows\SYSTEM32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] --a------ 2003-09-17 10:43 57344 c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a------ 2004-11-16 00:05 127035 c:\windows\SYSTEM32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2004-08-23 18:19 57344 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2005-10-14 13:46 77824 c:\windows\SYSTEM32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2005-10-14 13:49 94208 c:\windows\SYSTEM32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM] --a------ 2003-09-03 20:12 221184 c:\program files\Intel\Modem Event Monitor\IntelMEM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] --a------ 2006-01-19 11:06 110592 c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 18:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --------- 2004-04-11 20:15 290816 c:\program files\Dell\Media Experience\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2004-11-24 21:12 26112 c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2004-09-28 20:26 32881 c:\program files\Java\j2re1.4.2_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] --a------ 2005-08-22 13:36 100056 c:\progra~1\SYMNET~1\SNDMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2004-01-07 01:01 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] --------- 2000-05-11 01:00 90112 c:\windows\Updreg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper] --a------ 2004-06-10 11:51 60928 c:\windows\SYSTEM32\P17.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= R0 wff;wff;c:\windows\SYSTEM32\DRIVERS\WFF.sys [2005-04-25 17280] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2008-06-09 206096] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de6d17b5-27e3-11db-adbc-00038a000015}] \Shell\AutoRun\command - G:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder 2009-01-16 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-01-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2009-01-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html IE: &Search - http://edits.mywebsearch.com/toolbar...p=ZBxdm213YYUS IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html IE: {{d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe Trusted Zone: *.turbotax.com Trusted Zone: online.musicmatch.com c:\windows\Downloaded Program Files\SbCIe02a.dll - O16 -: {640B39C1-D713-464F-92C3-75BD972B95EE} hxxp://www.sidestep.com/get/k42037/sb02a.cab c:\windows\Downloaded Program Files\SbCIe02a.inf FF - ProfilePath - c:\documents and settings\Robert Schiller\Application Data\Mozilla\Firefox\Profiles\8mj889ge.default\ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-18 08:30:00 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(716) c:\windows\system32\igfxdev.dll . Completion time: 2009-01-18 8:31:29 ComboFix-quarantined-files.txt 2009-01-18 14:31:26 ComboFix2.txt 2009-01-18 07:52:56 Pre-Run: 117,245,485,056 bytes free Post-Run: 117,245,177,856 bytes free 380 --- E O F --- 2009-01-14 23:55:48 |
|
|
|
|
01-18-2009, 11:08 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: My Computer is Haunted
Hello again, Chipper 1022. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "c:\documents and settings\All Users\Application Data\Viewpoint" "c:\program files\Symantec" "c:\program files\Viewpoint" ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this:  Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
01-18-2009, 08:18 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 6
OS: XP SP3
|
Re: My Computer is Haunted
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT Sunday, January 18, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, January 19, 2009 00:09:57 Records in database: 1644426 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 107736 Threat name: 20 Infected objects: 33 Suspicious objects: 0 Duration of the scan: 01:42:47 File name / Threat name / Threats count C:\Documents and Settings\Robert Schiller\Application Data\Sun\Java\Deployment\cache\6.0\41\529ea6e9-1dd05e7c Infected: Trojan-Downloader.Java.OpenStream.ab 1 C:\Program Files\AWS\AIMWxBugSetup60b6.04.0.9.EXE Infected: not-a-virus:AdWare.Win32.MyWay.j 1 C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.Win32.MyWay.v 1 C:\Qoobox\Quarantine\C\Documents and Settings\Kim\Application Data\drvcleaner.exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.m 1 C:\Qoobox\Quarantine\C\Program Files\License_Manager\license_manager.exe.vir Infected: not-a-virus:AdWare.Win32.WeirWeb.e 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.al 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.af 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.an 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.cy 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.a 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.an 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.al 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.f 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ax 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.an 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ad 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.an 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.q 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.i 1 C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ai 1 C:\Qoobox\Quarantine\C\Program Files\webHancer\Programs\wbhshare.dll.vir Infected: not-a-virus:AdWare.Win32.WebHancer.214 1 C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\f3PSSavr.scr.vir Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1 C:\WINDOWS\SYSTEM32\entry.dll Infected: Trojan.Win32.Agent.qg 1 The selected area was scanned. The pop ups have stopped but I have avioded doing much until it is completely cleaned. Thank you for your help clearing these viruses and guiding me through the process. |
|
|
|
|
01-18-2009, 09:17 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: My Computer is Haunted
Hello again, Chipper 1022.
Most of the finds by Kaspersky are in ComboFix's quarantine folder, which we will delete later. Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Robert Schiller\Application Data\Sun\Java\Deployment\cache\6.0\41\529ea6e9-1dd05e7c" "C:\Program Files\AWS\AIMWxBugSetup60b6.04.0.9.EXE" "C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll" "C:\WINDOWS\SYSTEM32\entry.dll" ) do ( del /a/f/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this: Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ |
|
|
|
|
01-19-2009, 05:50 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: My Computer is Haunted
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
