|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-01-2009, 10:51 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
MS Antispyware 2009
Just started today on my brothers computer. It has been running slow, but now it is VERY slow.
AVG won't update, "Invalid update control CTF file" DDS (Ver_09-01-07.01) - NTFSx86 Run by Owner at 23:58:15.95 on Sun 02/01/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.991.374 [GMT -5:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) AV: Anti-Virus - SBC Yahoo! Online Protection *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Yahoo!\Antivirus\ISafe.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\wanmpsvc.exe C:\Program Files\Yahoo!\Antivirus\VetMsg.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\Yahoo!\Antivirus\CAVTray.exe C:\Program Files\Yahoo!\Antivirus\CAVRID.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Logitech\iTouch\iTouch.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\HP\KBD\KBD.EXE C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Common Files\AOL\1134418714\ee\aolsoftware.exe C:\DOCUME~1\Owner\LOCALS~1\Temp\~tmpa.exe C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Owner\My Documents\1packs\New Folder\LimeWire\LimeWire.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\AIM6\aolsoftware.exe c:\program files\common files\aol\1134418714\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe c:\program files\common files\aol\1134418714\ee\aolsoftware.exe C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://google.com/ uSearch Page = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com uDefault_Page_URL = hxxp://us6.hpwis.com/ uDefault_Search_URL = hxxp://srch-us6.hpwis.com/ uSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html mDefault_Page_URL = hxxp://att.yahoo.com mDefault_Search_URL = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com mSearch Page = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost;*.local uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com mSearchAssistant = hxxp://srch-us6.hpwis.com/ mCustomizeSearch = hxxp://srch-us6.hpwis.com/ uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: XML Class: {500bca15-57a7-4eaf-8143-8c619470b13d} - c:\windows\system32\msxml71.dll BHO: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: UberButton Class: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll BHO: YahooTaggedBM Class: {65d886a2-7ca7-479b-bb95-14d1efb7946a} - c:\progra~1\yahoo!\common\YIeTagBm.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL BHO: Viewpoint Toolbar BHO: {a7327c09-b521-4edb-8509-7d2660c9ec98} - c:\program files\viewpoint\viewpoint toolbar\3.8.0\ViewBarBHO.dll BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll TB: hp toolkit: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\hp\explorebar\HPTOOLKT.DLL TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll TB: Viewpoint Toolbar: {f8ad5aa5-d966-4667-9daf-2561d68b2012} - c:\program files\common files\viewpoint\toolbar runtime\3.8.0\IEViewBar.dll TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes.dll EB: hp toolkit: {8f4902b6-6c04-4ade-8052-aa58578a21bd} - c:\windows\system32\Shdocvw.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [PlaxoUpdate] c:\program files\plaxo\2.13.1.2\PlaxoHelper.exe -a uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe uRun: [Cognac] c:\docume~1\owner\locals~1\temp\~tmpa.exe uRun: [MS AntiSpyware 2009] "c:\documents and settings\all users\application data\crucialsoft ltd\ms antispyware 2009\msas2009.exe" /autorun mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize mRun: [nwiz] nwiz.exe /install mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\unload\hpqcmon.exe mRun: [StorageGuard] "c:\program files\veritas software\update manager\sgtray.exe" /r mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [YBrowser] c:\progra~1\yahoo!\browser\ybrwicon.exe mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe mRun: [IPInSightLAN 01] "c:\program files\visual networks\visual ip insight\sbc\IPClient.exe" -l mRun: [IPInSightMonitor 01] "c:\program files\visual networks\visual ip insight\sbc\IPMon32.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [YOP] c:\progra~1\yahoo!\yop\yop.exe /autostart mRun: [YPC] c:\progra~1\yahoo!\parent~1\ypc.exe mRun: [CaAvTray] "c:\program files\yahoo!\antivirus\CAVTray.exe" mRun: [CAVRID] "c:\program files\yahoo!\antivirus\CAVRID.exe" mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [zBrowser Launcher] c:\program files\logitech\itouch\iTouch.exe mRun: [Logitech Utility] Logi_MwX.Exe mRun: [IPHSend] c:\program files\common files\aol\iphsend\IPHSend.exe mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [MimBoot] c:\progra~1\musicm~1\musicm~1\mimboot.exe mRun: [RunAppBk] c:\windows\rsp.exe mRun: [tjitq] c:\windows\system32\tjitq.exe mRun: [qaedkot] c:\windows\system32\qaedkot.exe mRun: [azs] c:\windows\system32\azs.exe mRun: [lcwwscbgl] c:\windows\system32\lcwwscbgl.exe mRun: [wbcxlh] c:\windows\system32\wbcxlh.exe mRun: [pavzwxgqmd] c:\windows\system32\pavzwxgqmd.exe mRun: [sbydnyje] c:\windows\system32\sbydnyje.exe mRun: [igprlmpyt] c:\windows\system32\igprlmpyt.exe mRun: [ezukuwyqj] c:\windows\system32\ezukuwyqj.exe mRun: [olyecogl] c:\windows\system32\olyecogl.exe mRun: [pgzfhkayl] c:\windows\system32\pgzfhkayl.exe mRun: [kowl] c:\windows\system32\kowl.exe mRun: [fdv] c:\windows\system32\fdv.exe mRun: [fghwprylsg] c:\windows\system32\fghwprylsg.exe mRun: [yaibyjkqk] c:\windows\system32\yaibyjkqk.exe mRun: [taa] c:\windows\system32\taa.exe mRun: [ewcfqm] c:\windows\system32\ewcfqm.exe mRun: [xhja] c:\windows\system32\xhja.exe mRun: [o] c:\windows\system32\o.exe mRun: [ko] c:\windows\system32\ko.exe mRun: [elhub] c:\windows\system32\elhub.exe mRun: [eqqpkaupl] c:\windows\system32\eqqpkaupl.exe mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER mRun: [frdi] c:\windows\system32\frdi.exe mRun: [eaphxwc] c:\windows\system32\eaphxwc.exe mRun: [fuj] c:\windows\system32\fuj.exe mRun: [frkeuluq] c:\windows\system32\frkeuluq.exe mRun: [i] c:\windows\system32\i.exe mRun: [RecoverFromReboot] c:\windows\temp\RecoverFromReboot.exe mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe mRun: [fvjtsspi] c:\windows\system32\fvjtsspi.exe mRun: [jllbk] c:\windows\system32\jllbk.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe dRun: [Cognac] c:\windows\temp\2.tmp.exe uExplorerRun: [W0bojvUEj5] c:\documents and settings\all users\application data\wfypodun\kfyxqrgp.exe mExplorerRun: [W0bojvUEj5] c:\documents and settings\all users\application data\wfypodun\kfyxqrgp.exe StartupFolder: c:\docume~1\owner\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\FINDFAST.EXE StartupFolder: c:\docume~1\owner\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpcent~2.lnk - c:\program files\hp center\137903\shadow\ShadowBar.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpcent~1.lnk - c:\program files\hp center\137903\program\BackWeb-137903.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll LSP: c:\windows\system32\VetRedir.dll Trusted Zone: att.net Trusted Zone: sbcglobal.net Trusted Zone: yahoo.com Trusted Zone: musicmatch.com\online Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: igfxcui - igfxsrvc.dll AppInit_DLLs: avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\nyig7h7u.default\ FF - prefs.js: browser.startup.homepage - hxxp://gulllakecs.org/ FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-6 97928] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-16 26824] R1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\Vet-Filt.sys [2005-9-26 21031] R1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\Vet-Rec.sys [2005-9-26 15478] R1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\VetEFile.sys [2005-9-26 879832] R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\VetFDDNT.sys [2005-9-26 15735] R1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2006-7-31 26787] R3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\VetEBoot.sys [2005-9-26 108360] R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-6 875288] R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-6 231704] R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-6 76040] R4 CAISafe;CAISafe;c:\program files\yahoo!\antivirus\iSafe.exe [2005-9-26 259184] R4 VETMSGNT;VET Message Service;c:\program files\yahoo!\antivirus\VetMsg.exe [2005-9-26 201840] R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-13 24652] S4 comsch;COM+ Event Schedule;"c:\windows\system32\comsch.exe" --> c:\windows\system32\comsch.exe [?] S4 Monk;Monk;c:\recycler\comser.exe [2007-1-12 40960] S4 MSAgtSvc;Microsoft Agent Services;"c:\windows\msagent\agentsrv.exe" --> c:\windows\msagent\agentsrv.exe [?] S4 WinDefend;Windows Defender Service;c:\program files\windows defender\MsMpEng.exe [2006-4-3 14032] =============== Created Last 30 ================ 2009-02-01 14:04 15,000 a------- c:\windows\system32\gsdrgfdrrgnd.dll 2009-02-01 14:04 51,712 a------- c:\windows\system32\drivers\TDSSserv.sys 2009-02-01 14:03 70,656 a------- c:\windows\system32\3AxOGt3t.exe 2009-02-01 14:03 0 a------- c:\windows\system32\3AxOGt3t.exe.a_a 2009-02-01 14:03 129,028 a------- c:\windows\system32\msxml71.dll 2009-02-01 14:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\CrucialSoft Ltd 2009-01-20 06:49 86,824 a----r-- c:\windows\system32\drivers\sscdserd.sys 2009-01-20 06:48 106,792 a----r-- c:\windows\system32\drivers\sscdmdm.sys 2009-01-20 06:48 11,944 a----r-- c:\windows\system32\drivers\sscdmdfl.sys 2009-01-20 06:48 9,256 a----r-- c:\windows\system32\drivers\sscdcmnt.sys 2009-01-20 06:48 9,256 a----r-- c:\windows\system32\drivers\sscdcm.sys 2009-01-20 06:48 9,256 a----r-- c:\windows\system32\drivers\sscdwhnt.sys 2009-01-20 06:48 9,256 a----r-- c:\windows\system32\drivers\sscdwh.sys 2009-01-20 06:48 80,552 a----r-- c:\windows\system32\drivers\sscdbus.sys 2009-01-18 19:22 <DIR> --d----- c:\program files\Samsung 2009-01-12 21:44 <DIR> --d----- c:\program files\Atari 2009-01-06 18:57 <DIR> --d-h--- C:\$AVG8.VAULT$ 2009-01-06 16:27 10,520 a------- c:\windows\system32\avgrsstx.dll 2009-01-06 16:27 97,928 a------- c:\windows\system32\drivers\avgldx86.sys 2009-01-06 16:27 76,040 a------- c:\windows\system32\drivers\avgtdix.sys 2009-01-06 16:27 <DIR> --d----- c:\windows\system32\drivers\Avg 2009-01-06 16:27 <DIR> --d----- c:\docume~1\owner\applic~1\AVGTOOLBAR 2009-01-06 16:27 <DIR> --d----- c:\program files\AVG 2009-01-06 16:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8 ==================== Find3M ==================== 2008-03-27 20:54 130 a------- c:\docume~1\owner\applic~1\wklnhst.dat 2007-07-10 14:58 6,112 a------- c:\docume~1\alluse~1\applic~1\ypinfo.bin ============= FINISH: 0:02:05.96 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-04-2009, 09:33 AM
|
#2 (permalink) | ||
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Hello -
This machine is pretty heavily infected. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum. --------------------------------------------------------------------------------------------- As stated in our pre-posting sticky topic... NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help Quote:
Quote:
If you choose to uninstall SBC/Yahoo, it should be a procedure similar to this: Select AT&T Yahoo! Applications in Add or Remove Programs Press Change/Remove button Check box for AT&T Online Protection Click uninstall button Any antivirus program must be removed via add/remove program. For any program that doesn't have an add/remove entry, you will have to do this: re-install the program -> reboot -> uninstallYou may want to choose to uninstall AVG8, either one is fine, but one must go before we proceed. ----------------------------------------------------------------------- Then and only then.... Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. If you need help, check here or ask. Please include the C:\ComboFix.txt in your next reply for further review.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
||
|
|
|
|
02-04-2009, 02:09 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: MS Antispyware 2009
ComboFix 09-02-04.01 - Owner 2009-02-04 15:41:57.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.991.344 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\CrucialSoft Ltd c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\20090204111651234.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090201140343703.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090201140930234.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090201172833718.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090201234657484.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090204110250875.log c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe c:\recycler\comser.exe c:\windows\system32\3AxOGt3t.exe.a_a c:\windows\system32\drivers\tdssserv.sys c:\windows\system32\msxml71.dll . ((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 ))))))))))))))))))))))))))))))) . 2009-02-04 11:36 . 2009-02-04 11:33 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-02 00:00 . 2009-02-02 00:00 250 --a------ c:\windows\gmer.ini 2009-02-01 15:00 . 2009-02-01 15:06 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\AVGTOOLBAR 2009-02-01 14:03 . 2009-02-01 14:03 70,656 --a------ c:\windows\system32\3AxOGt3t.exe 2009-01-20 06:49 . 2007-07-03 19:59 86,824 -ra------ c:\windows\system32\drivers\sscdserd.sys 2009-01-20 06:48 . 2007-07-03 19:58 106,792 -ra------ c:\windows\system32\drivers\sscdmdm.sys 2009-01-20 06:48 . 2007-07-03 19:54 80,552 -ra------ c:\windows\system32\drivers\sscdbus.sys 2009-01-20 06:48 . 2007-07-03 19:57 11,944 -ra------ c:\windows\system32\drivers\sscdmdfl.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwhnt.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwh.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcmnt.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcm.sys 2009-01-18 19:22 . 2009-01-18 19:22 <DIR> d-------- c:\program files\Samsung 2009-01-12 21:47 . 2009-01-12 21:47 <DIR> d-------- c:\documents and settings\Owner\Application Data\Leadertech 2009-01-12 21:44 . 2009-01-12 21:44 <DIR> d-------- c:\program files\Atari 2009-01-06 18:57 . 2009-01-19 13:14 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-01-06 16:27 . 2009-02-04 11:46 <DIR> d-------- c:\windows\system32\drivers\Avg 2009-01-06 16:27 . 2009-01-06 16:27 <DIR> d-------- c:\program files\AVG 2009-01-06 16:27 . 2009-01-16 14:12 <DIR> d-------- c:\documents and settings\Owner\Application Data\AVGTOOLBAR 2009-01-06 16:27 . 2009-01-06 19:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2009-01-06 16:27 . 2009-01-06 16:27 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2009-01-06 16:27 . 2009-01-06 16:27 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2009-01-06 16:27 . 2009-01-06 16:27 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-04 20:25 --------- d-----w c:\program files\Yahoo! 2009-02-04 20:24 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2009-02-04 16:32 --------- d-----w c:\program files\Java 2009-01-19 00:23 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-07 01:47 --------- d-----w c:\program files\GameSpy Arcade 2009-01-06 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft 2008-12-29 22:31 --------- d-----w c:\program files\iTunes 2008-12-29 22:31 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-29 22:29 --------- d-----w c:\program files\iPod 2008-12-29 22:29 --------- d-----w c:\program files\Common Files\Apple 2008-12-29 22:00 --------- d-----w c:\program files\QuickTime 2008-12-20 00:33 --------- d-----w c:\program files\LimeWire 2008-12-04 20:35 --------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-03-28 01:54 130 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2007-07-10 19:58 6,112 ----a-w c:\documents and settings\All Users\Application Data\ypinfo.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-10-26 4662776] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-17 67128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="NvQTwk" [X] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-18 69632] "StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 155648] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2002-07-16 106549] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-12-19 212992] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2002-05-15 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-05-15 114688] "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706] "IPInSightLAN 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928] "IPInSightMonitor 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] "zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-12-01 892928] "IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-11-07 8192] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2007-07-01 26112] "AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2004-10-20 34904] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-06 1261336] "nwiz"="nwiz.exe" [2002-05-03 c:\windows\system32\nwiz.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 c:\windows\LOGI_MWX.EXE] c:\documents and settings\Owner\Start Menu\Programs\Startup\ Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-11-16 111376] Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1996-11-16 51984] c:\documents and settings\All Users\Start Menu\Programs\Startup\ hp center UI.lnk - c:\program files\hp center\137903\Shadow\ShadowBar.exe [2002-07-24 69632] hp center.lnk - c:\program files\hp center\137903\Program\BackWeb-137903.exe [2002-07-24 16384] HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-17 67128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"= "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"= "c:\\StubInstaller.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "c:\\WINDOWS\\system32\\dxdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aim6.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AOL\\RC\\regClient.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Owner\\My Documents\\1packs\\New Folder\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-06 97928] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-06 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-06 76040] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-12-13 24652] S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-06 875288] S2 comsch;COM+ Event Schedule;"c:\windows\system32\comsch.exe" --> c:\windows\system32\comsch.exe [?] S2 Monk;Monk;c:\recycler\comser.exe --> c:\recycler\comser.exe [?] S2 MSAgtSvc;Microsoft Agent Services;"c:\windows\msagent\agentsrv.exe" --> c:\windows\msagent\agentsrv.exe [?] S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [2006-04-03 14032] --- Other Services/Drivers In Memory --- *NewlyCreated* - JAVAQUICKSTARTERSERVICE *Deregistered* - IPVNMon . Contents of the 'Scheduled Tasks' folder 2009-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-02 c:\windows\Tasks\At1.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At10.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At11.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-04 c:\windows\Tasks\At12.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-04 c:\windows\Tasks\At13.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-04 c:\windows\Tasks\At14.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-04 c:\windows\Tasks\At15.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-04 c:\windows\Tasks\At16.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At17.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At18.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At19.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At2.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At20.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At21.job - ?:\ [] 2009-02-02 c:\windows\Tasks\At21.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At22.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At23.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-02 c:\windows\Tasks\At24.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At3.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At4.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At5.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At6.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At7.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At8.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\At9.job - c:\windows\system32\3AxOGt3t.exe [2009-02-01 14:03] 2009-02-01 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] 2002-07-27 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-11-19 20:20] . - - - - ORPHANS REMOVED - - - - HKCU-Run-PlaxoUpdate - c:\program files\Plaxo\2.13.1.2\PlaxoHelper.exe HKLM-Run-RunAppBk - c:\windows\rsp.exe HKLM-Run-tjitq - c:\windows\system32\tjitq.exe HKLM-Run-qaedkot - c:\windows\system32\qaedkot.exe HKLM-Run-azs - c:\windows\system32\azs.exe HKLM-Run-lcwwscbgl - c:\windows\system32\lcwwscbgl.exe HKLM-Run-wbcxlh - c:\windows\system32\wbcxlh.exe HKLM-Run-pavzwxgqmd - c:\windows\system32\pavzwxgqmd.exe HKLM-Run-sbydnyje - c:\windows\system32\sbydnyje.exe HKLM-Run-igprlmpyt - c:\windows\system32\igprlmpyt.exe HKLM-Run-ezukuwyqj - c:\windows\system32\ezukuwyqj.exe HKLM-Run-olyecogl - c:\windows\system32\olyecogl.exe HKLM-Run-pgzfhkayl - c:\windows\system32\pgzfhkayl.exe HKLM-Run-kowl - c:\windows\system32\kowl.exe HKLM-Run-fdv - c:\windows\system32\fdv.exe HKLM-Run-fghwprylsg - c:\windows\system32\fghwprylsg.exe HKLM-Run-yaibyjkqk - c:\windows\system32\yaibyjkqk.exe HKLM-Run-taa - c:\windows\system32\taa.exe HKLM-Run-ewcfqm - c:\windows\system32\ewcfqm.exe HKLM-Run-xhja - c:\windows\system32\xhja.exe HKLM-Run-o - c:\windows\system32\o.exe HKLM-Run-ko - c:\windows\system32\ko.exe HKLM-Run-elhub - c:\windows\system32\elhub.exe HKLM-Run-eqqpkaupl - c:\windows\system32\eqqpkaupl.exe HKLM-Run-frdi - c:\windows\system32\frdi.exe HKLM-Run-eaphxwc - c:\windows\system32\eaphxwc.exe HKLM-Run-fuj - c:\windows\system32\fuj.exe HKLM-Run-frkeuluq - c:\windows\system32\frkeuluq.exe HKLM-Run-i - c:\windows\system32\i.exe HKLM-Run-fvjtsspi - c:\windows\system32\fvjtsspi.exe HKLM-Run-jllbk - c:\windows\system32\jllbk.exe HKU-Default-Run-Cognac - c:\windows\TEMP\2D2.tmp.exe HKLM-Explorer_Run-W0bojvUEj5 - c:\documents and settings\All Users\Application Data\wfypodun\kfyxqrgp.exe HKCU-Explorer_Run-W0bojvUEj5 - c:\documents and settings\All Users\Application Data\wfypodun\kfyxqrgp.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com/ uDefault_Search_URL = hxxp://srch-us6.hpwis.com/ mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost;*.local uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML Trusted Zone: att.net Trusted Zone: sbcglobal.net Trusted Zone: yahoo.com Trusted Zone: musicmatch.com\online Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/controls/ysftcntr/ysftcntr_current.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\nyig7h7u.default\ FF - prefs.js: browser.startup.homepage - hxxp://gulllakecs.org/ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-04 15:57:37 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1952) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(496) c:\windows\system32\avgrsstx.dll c:\windows\System32\VetRedir.dll c:\windows\System32\ISafeIf.dll . Completion time: 2009-02-04 16:05:23 ComboFix-quarantined-files.txt 2009-02-04 21:03:43 Pre-Run: 38,816,632,832 bytes free Post-Run: 40,157,736,960 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 317 |
|
|
|
|
02-04-2009, 02:33 PM
|
#4 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
02-04-2009, 03:08 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: MS Antispyware 2009
ComboFix 09-02-04.01 - Owner 2009-02-04 16:42:46.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.991.563 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\wfypodun c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_COMSCH -------\Legacy_MONK -------\Service_comsch -------\Service_Monk ((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 ))))))))))))))))))))))))))))))) . 2009-02-04 11:36 . 2009-02-04 11:33 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-02 00:00 . 2009-02-02 00:00 250 --a------ c:\windows\gmer.ini 2009-02-01 15:00 . 2009-02-01 15:06 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\AVGTOOLBAR 2009-01-20 06:49 . 2007-07-03 19:59 86,824 -ra------ c:\windows\system32\drivers\sscdserd.sys 2009-01-20 06:48 . 2007-07-03 19:58 106,792 -ra------ c:\windows\system32\drivers\sscdmdm.sys 2009-01-20 06:48 . 2007-07-03 19:54 80,552 -ra------ c:\windows\system32\drivers\sscdbus.sys 2009-01-20 06:48 . 2007-07-03 19:57 11,944 -ra------ c:\windows\system32\drivers\sscdmdfl.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwhnt.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwh.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcmnt.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcm.sys 2009-01-18 19:22 . 2009-01-18 19:22 <DIR> d-------- c:\program files\Samsung 2009-01-12 21:47 . 2009-01-12 21:47 <DIR> d-------- c:\documents and settings\Owner\Application Data\Leadertech 2009-01-12 21:44 . 2009-01-12 21:44 <DIR> d-------- c:\program files\Atari 2009-01-06 18:57 . 2009-02-04 16:35 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-01-06 16:27 . 2009-02-04 16:12 <DIR> d-------- c:\windows\system32\drivers\Avg 2009-01-06 16:27 . 2009-01-06 16:27 <DIR> d-------- c:\program files\AVG 2009-01-06 16:27 . 2009-01-16 14:12 <DIR> d-------- c:\documents and settings\Owner\Application Data\AVGTOOLBAR 2009-01-06 16:27 . 2009-02-04 16:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2009-01-06 16:27 . 2009-02-04 16:18 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys 2009-01-06 16:27 . 2009-02-04 16:17 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys 2009-01-06 16:27 . 2009-02-04 16:18 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-04 21:38 --------- d-----w c:\program files\The Print Shop 21 2009-02-04 21:31 --------- d-----w c:\program files\Java 2009-02-04 20:25 --------- d-----w c:\program files\Yahoo! 2009-02-04 20:24 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2009-01-19 00:23 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-07 01:47 --------- d-----w c:\program files\GameSpy Arcade 2009-01-06 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft 2008-12-29 22:31 --------- d-----w c:\program files\iTunes 2008-12-29 22:31 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-29 22:29 --------- d-----w c:\program files\iPod 2008-12-29 22:29 --------- d-----w c:\program files\Common Files\Apple 2008-12-29 22:00 --------- d-----w c:\program files\QuickTime 2008-12-20 00:33 --------- d-----w c:\program files\LimeWire 2008-12-04 20:35 --------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-03-28 01:54 130 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2007-07-10 19:58 6,112 ----a-w c:\documents and settings\All Users\Application Data\ypinfo.bin . ((((((((((((((((((((((((((((( snapshot@2009-02-04_16.00.39.76 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE - 2009-01-06 21:27:46 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys + 2009-02-04 21:18:14 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys - 2008-03-26 15:08:00 961,120 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-02-04 21:48:39 230,392 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-02-04 21:49:04 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5f4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-10-26 4662776] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-17 67128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="NvQTwk" [X] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-18 69632] "StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 155648] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2002-07-16 106549] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-12-19 212992] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2002-05-15 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-05-15 114688] "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706] "IPInSightLAN 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928] "IPInSightMonitor 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] "zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-12-01 892928] "IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-11-07 8192] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2007-07-01 26112] "AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2004-10-20 34904] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-04 1601304] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600] "nwiz"="nwiz.exe" [2002-05-03 c:\windows\system32\nwiz.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 c:\windows\LOGI_MWX.EXE] c:\documents and settings\Owner\Start Menu\Programs\Startup\ Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-11-16 111376] Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1996-11-16 51984] c:\documents and settings\All Users\Start Menu\Programs\Startup\ hp center UI.lnk - c:\program files\hp center\137903\Shadow\ShadowBar.exe [2002-07-24 69632] hp center.lnk - c:\program files\hp center\137903\Program\BackWeb-137903.exe [2002-07-24 16384] HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-17 67128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-02-04 16:18 10520 c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"= "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"= "c:\\StubInstaller.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "c:\\WINDOWS\\system32\\dxdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aim6.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AOL\\RC\\regClient.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Owner\\My Documents\\1packs\\New Folder\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-06 325128] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-06 107272] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-06 903960] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-06 298264] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-12-13 24652] S2 MSAgtSvc;Microsoft Agent Services;"c:\windows\msagent\agentsrv.exe" --> c:\windows\msagent\agentsrv.exe [?] S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [2006-04-03 14032] --- Other Services/Drivers In Memory --- *Deregistered* - IPVNMon . Contents of the 'Scheduled Tasks' folder 2009-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-01 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] 2002-07-27 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-11-19 20:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com/ uDefault_Search_URL = hxxp://srch-us6.hpwis.com/ mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost;*.local uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML Trusted Zone: att.net Trusted Zone: sbcglobal.net Trusted Zone: yahoo.com Trusted Zone: musicmatch.com\online Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/controls/ysftcntr/ysftcntr_current.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\nyig7h7u.default\ FF - prefs.js: browser.startup.homepage - hxxp://gulllakecs.org/ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-04 17:00:01 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\AOL\ACS\AOLacsd.exe c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\HPZipm12.exe c:\windows\wanmpsvc.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe c:\windows\system32\wscntfy.exe c:\progra~1\Yahoo!\browser\ycommon.exe c:\progra~1\MUSICM~1\MUSICM~1\MMDiag.exe c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe c:\program files\Common Files\AOL\1134418714\ee\aolsoftware.exe c:\program files\iPod\bin\iPodService.exe c:\program files\AIM6\aolsoftware.exe c:\program files\Common Files\AOL\1134418714\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe c:\program files\Common Files\AOL\1134418714\ee\aolsoftware.exe . ************************************************************************** . Completion time: 2009-02-04 17  47 - machine was rebootedComboFix-quarantined-files.txt 2009-02-04 22 09ComboFix2.txt 2009-02-04 21:05:28 Pre-Run: 41,650,921,472 bytes free Post-Run: 41,556,226,048 bytes free 271 |
|
|
|
|
02-04-2009, 03:16 PM
|
#6 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Hmmm, things are looking much better, but that doesn't seem to have removed everything I wanted it to. Let's try this once more, then we'll move on to other methods, and finish up if it doesn't work.
I should think the machine is behaving much better now. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
02-04-2009, 03:31 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: MS Antispyware 2009
ComboFix 09-02-04.01 - Owner 2009-02-04 17:26:43.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.991.575 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 ))))))))))))))))))))))))))))))) . 2009-02-04 11:36 . 2009-02-04 11:33 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-02 00:00 . 2009-02-02 00:00 250 --a------ c:\windows\gmer.ini 2009-02-01 15:00 . 2009-02-01 15:06 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\AVGTOOLBAR 2009-01-20 06:49 . 2007-07-03 19:59 86,824 -ra------ c:\windows\system32\drivers\sscdserd.sys 2009-01-20 06:48 . 2007-07-03 19:58 106,792 -ra------ c:\windows\system32\drivers\sscdmdm.sys 2009-01-20 06:48 . 2007-07-03 19:54 80,552 -ra------ c:\windows\system32\drivers\sscdbus.sys 2009-01-20 06:48 . 2007-07-03 19:57 11,944 -ra------ c:\windows\system32\drivers\sscdmdfl.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwhnt.sys 2009-01-20 06:48 . 2007-07-03 20:00 9,256 -ra------ c:\windows\system32\drivers\sscdwh.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcmnt.sys 2009-01-20 06:48 . 2007-07-03 19:56 9,256 -ra------ c:\windows\system32\drivers\sscdcm.sys 2009-01-18 19:22 . 2009-01-18 19:22 <DIR> d-------- c:\program files\Samsung 2009-01-12 21:47 . 2009-01-12 21:47 <DIR> d-------- c:\documents and settings\Owner\Application Data\Leadertech 2009-01-12 21:44 . 2009-01-12 21:44 <DIR> d-------- c:\program files\Atari 2009-01-06 18:57 . 2009-02-04 16:35 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-01-06 16:27 . 2009-02-04 16:12 <DIR> d-------- c:\windows\system32\drivers\Avg 2009-01-06 16:27 . 2009-01-06 16:27 <DIR> d-------- c:\program files\AVG 2009-01-06 16:27 . 2009-01-16 14:12 <DIR> d-------- c:\documents and settings\Owner\Application Data\AVGTOOLBAR 2009-01-06 16:27 . 2009-02-04 16:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2009-01-06 16:27 . 2009-02-04 16:18 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys 2009-01-06 16:27 . 2009-02-04 16:17 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys 2009-01-06 16:27 . 2009-02-04 16:18 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-04 21:38 --------- d-----w c:\program files\The Print Shop 21 2009-02-04 21:31 --------- d-----w c:\program files\Java 2009-02-04 20:25 --------- d-----w c:\program files\Yahoo! 2009-02-04 20:24 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2009-01-19 00:23 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-07 01:47 --------- d-----w c:\program files\GameSpy Arcade 2009-01-06 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft 2008-12-29 22:31 --------- d-----w c:\program files\iTunes 2008-12-29 22:31 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-29 22:29 --------- d-----w c:\program files\iPod 2008-12-29 22:29 --------- d-----w c:\program files\Common Files\Apple 2008-12-29 22:00 --------- d-----w c:\program files\QuickTime 2008-12-20 00:33 --------- d-----w c:\program files\LimeWire 2008-12-04 20:35 --------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-12-04 20:35 --------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-03-28 01:54 130 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat 2007-07-10 19:58 6,112 ----a-w c:\documents and settings\All Users\Application Data\ypinfo.bin . ((((((((((((((((((((((((((((( snapshot@2009-02-04_16.00.39.76 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE - 2009-01-06 21:27:46 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys + 2009-02-04 21:18:14 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys - 2008-03-26 15:08:00 961,120 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-02-04 21:48:39 230,392 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-02-04 21:49:04 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5f4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-10-26 4662776] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-17 67128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="NvQTwk" [X] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-18 69632] "StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 155648] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2002-07-16 106549] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-12-19 212992] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2002-05-15 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-05-15 114688] "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706] "IPInSightLAN 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 380928] "IPInSightMonitor 01"="c:\program files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 122880] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] "zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-12-01 892928] "IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-11-07 8192] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2007-07-01 26112] "AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2004-10-20 34904] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-04 1601304] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600] "nwiz"="nwiz.exe" [2002-05-03 c:\windows\system32\nwiz.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 c:\windows\LOGI_MWX.EXE] c:\documents and settings\Owner\Start Menu\Programs\Startup\ Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-11-16 111376] Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1996-11-16 51984] c:\documents and settings\All Users\Start Menu\Programs\Startup\ hp center UI.lnk - c:\program files\hp center\137903\Shadow\ShadowBar.exe [2002-07-24 69632] hp center.lnk - c:\program files\hp center\137903\Program\BackWeb-137903.exe [2002-07-24 16384] HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-17 67128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-02-04 16:18 10520 c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"= "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"= "c:\\StubInstaller.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "c:\\WINDOWS\\system32\\dxdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1134418714\\ee\\aim6.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AOL\\RC\\regClient.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Owner\\My Documents\\1packs\\New Folder\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-06 325128] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-06 107272] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-06 903960] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-06 298264] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-12-13 24652] S2 MSAgtSvc;Microsoft Agent Services;"c:\windows\msagent\agentsrv.exe" --> c:\windows\msagent\agentsrv.exe [?] S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [2006-04-03 14032] --- Other Services/Drivers In Memory --- *Deregistered* - IPVNMon . Contents of the 'Scheduled Tasks' folder 2009-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-01 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] 2002-07-27 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2001-11-19 20:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.com/ uDefault_Search_URL = hxxp://srch-us6.hpwis.com/ mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost;*.local uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML Trusted Zone: att.net Trusted Zone: sbcglobal.net Trusted Zone: yahoo.com Trusted Zone: musicmatch.com\online Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/controls/ysftcntr/ysftcntr_current.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\nyig7h7u.default\ FF - prefs.js: browser.startup.homepage - hxxp://gulllakecs.org/ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-04 17:27:00 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2009-02-04 17:29:31 ComboFix-quarantined-files.txt 2009-02-04 22:28:27 ComboFix2.txt 2009-02-04 22 52ComboFix3.txt 2009-02-04 21:05:28 Pre-Run: 41,530,548,224 bytes free Post-Run: 41,514,627,072 bytes free 214 |
|
|
|
|
02-04-2009, 05:51 PM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Please download HijackThis to your desktop
Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-04-2009, 08:50 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: MS Antispyware 2009
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:04 PM, on 2/4/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\wanmpsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\HP\KBD\KBD.EXE C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\QuickTime\QTTask.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\AOL\1134418714\ee\aolsoftware.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM6\aolsoftware.exe c:\program files\common files\aol\1134418714\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe C:\WINDOWS\explorer.exe c:\program files\common files\aol\1134418714\ee\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\PROGRA~1\Yahoo!\Common\YIeTagBm.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: *.att.net O15 - Trusted Zone: http://*.att.net O15 - Trusted Zone: *.sbcglobal.net O15 - Trusted Zone: http://*.sbcglobal.net O16 - DPF: Yahoo! Checkers - http://download2.games.yahoo.com/gam...ts/y/kt4_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yaho...tr_current.cab O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/down.../OTOYAX29b.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Microsoft Agent Services (MSAgtSvc) - Unknown owner - C:\WINDOWS\msagent\agentsrv.exe (file missing) O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 13613 bytes |
|
|
|
|
02-04-2009, 09:01 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: Viewpoint Manager (Remove Only) Viewpoint Media Player Viewpoint Toolbar<<<these are considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546 Additional info: http://vil.nai.com/vil/content/v_137262.htm --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Place a check next to the following entries if they exist (make sure you do not miss any) and click Fix Checked R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com It may be helpful to know that when you put an item in your Trusted Zone, it has pretty much full access to your computer... Are you sure you trust this site to that degree?? If you're not sure, and/or you do not need these in your trusted zone to facilitate access, or you did not knowingly permit this access yourself, then please fix the following O15 entries: O15 - Trusted Zone: *.att.net O15 - Trusted Zone: http://*.att.net O15 - Trusted Zone: *.sbcglobal.net O15 - Trusted Zone: http://*.sbcglobal.net Close HijackThis now. --------------------------------------------------------------------------------------------- Delete this folder:(if it still exists) c:\program files\Viewpoint --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
--------------------------------------------------------------------------------------------- Go here to run an online scannner from ESET.
Also post a new HijackThis log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-05-2009, 04:57 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: MS Antispyware 2009
Eset online scanner
# version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3830 (20090205) # vers_arch_module=1.032 (20050726) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=179da97a81b1f849be1619bf19649fee # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2009-02-05 05:48:26 # local_time=2009-02-05 12:48:26 (-0500, Eastern Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 2 # scanned=390150 # found=4 # scan_time=3860 C:\Documents and Settings\Owner\Shared\(1) come rain or shine ray charles 34.wma WMA/TrojanDownloader.Wimad.D trojan B8E32BD1BF74E1F0913C1910C745F18D C:\Documents and Settings\Owner\Shared\04 Track 4.wma Win32/Adware.180Solutions application 47A34B9BA22BC4C40683C6CD2CEE1924 C:\Qoobox\Quarantine\C\WINDOWS\system32\msxml71.dll.vir Win32/TrojanDownloader.FakeAlert.YL trojan 2B4B5D9F4B53FF9869ED9600479CAABD C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSserv.sys.vir Win32/Olmarik.FO trojan 660E66C4E1D5279912BAFE8229EF6D16 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:56:35 PM, on 2/5/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\HP\KBD\KBD.EXE C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe C:\Program Files\Common Files\AOL\1134418714\ee\aolsoftware.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\iPod\bin\iPodService.exe c:\program files\common files\aol\1134418714\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe C:\Program Files\AIM6\aolsoftware.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\PROGRA~1\Yahoo!\Common\YIeTagBm.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: Yahoo! Checkers - http://download2.games.yahoo.com/gam...ts/y/kt4_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yaho...tr_current.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/down.../OTOYAX29b.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Microsoft Agent Services (MSAgtSvc) - Unknown owner - C:\WINDOWS\msagent\agentsrv.exe (file missing) O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 12278 bytes |
|
|
|
|
02-05-2009, 05:03 PM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
Go to Start>Run then copy and paste, or type the following, then press Enter:
sc stop MSAgtSvc Go to Start>Run then copy and paste, or type the following, then press Enter: sc delete MSAgtSvc --------------------------------------------------------------------------------------------- Using Windows Explorer, or Windows Search, locate and delete the following files: "C:\Documents and Settings\Owner\Shared\(1) come rain or shine ray charles 34.wma" "C:\Documents and Settings\Owner\Shared\04 Track 4.wma" --------------------------------------------------------------------------------------------- How is the machine behaving?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-05-2009, 06:18 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
AVG8 can have a slowing affect on some machines. I use either Avira or Avast for free AntiVirus, they seem, for me, to be less resource hungry.
See if anything in this topic helps with a slow machine: Is your PC running slow...? The other items Eset found are in ComboFix quarantine, and will be addressed by uninstalling ComboFix as instructed below Other than that....from a malware perspective, we should be done here. Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
02-05-2009, 06:32 PM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,572
OS: 2000 Pro; XP Pro; XP Home
|
Re: MS Antispyware 2009
You're welcome.
Surf Safely, and Think Prevention! Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
