|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-12-2009, 08:06 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Securityhelpcenter.com (Trojans/worms etc)
Hi Guys,
Yesterday my dad clicked on one of those sites that downloads fake security software to your computer before infecting it with trojans and worms. Through numerous spyware/anti virus scans i have managed to remove (i think) the worst of the trojans but i am unsure as to whether everything is gone. My anti virus (AVG Free) is not picking anything up, neither is spydoctor, however when using internet explorer he constantly gets directed to a block page saying "this site may harm your computer etc" the URL has it under securityhelpcenter.com I have installed firefox and told him to use this instead, the block pages do not appear on firefox, but i have told him it is best not to use the laptop at all at the moment until we are sure it is clean Am i right in assuming as this is happening that something is still left? my dad is not a computer expert so he is now very concerned about the safety of his personal details etc that is held on his laptop. Please find below the information requested: ------------------------------------------------------------------------- DDS (Ver_09-03-16.01) - FAT32x86 Run by Jamie Pemberton at 14:50:04.60 on Sun 04/12/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.258 [GMT 1:00] AV: AVG 7.5.557 *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Acer\Empowering Technology\admServ.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\svchost.exe -k bthsvcs C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Acer\Empowering Technology\admtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\Lexmark 2400 Series\lxcrmon.exe C:\Program Files\Lexmark 2400 Series\ezprint.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\igfxext.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\DOCUME~1\JAMIEP~1\LOCALS~1\Temp\RtkBtMnt.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\lxcrcoms.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jamie Pemberton\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://google.co.uk/ uSearch Page = hxxp://www.google.com mDefault_Page_URL = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Connection Wizard,ShellNext = hxxp://manutd.com/ mSearchAssistant = hxxp://www.google.com/ie BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: &Research: {4afc04a3-b551-4b68-9beb-8677d90150d9} - c:\windows\system32\wincontrol.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_08\bin\ssv.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll BHO: 1 (0x1) - No File BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [LaunchApp] Alaunch mRun: [RTHDCPL] RTHDCPL.EXE mRun: [SkyTel] SkyTel.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ntiMUI] c:\program files\newtech infosystems\nti cd & dvd-maker 7\ntiMUI.exe mRun: [<NO NAME>] mRun: [ADMTray.exe] "c:\acer\empowering technology\admtray.exe" mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [ePower_DMC] c:\acer\empowering technology\epower\ePower_DMC.exe mRun: [Acer ePower Management] c:\acer\empowering technology\epower\Acer ePower Management.exe boot mRun: [LManager] c:\progra~1\launch~1\LManager.exe mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\Monitor.exe mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe mRun: [Workflow] E:\Workflow.exe mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.5.0_08\bin\jusched.exe" mRun: [lxcrmon.exe] "c:\program files\lexmark 2400 series\lxcrmon.exe" mRun: [EzPrint] "c:\program files\lexmark 2400 series\ezprint.exe" mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s mRun: [LXCRCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCRtime.dll,_RunDLLEntry@16 mRun: [PAV] c:\program files\pav\pav.exe mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" mRun: [SNM] c:\program files\spynomore\SNM.exe /startup dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\aol90t~1.lnk - c:\program files\aol 9.0\aoltray.exe IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Open in new background tab - c:\program files\windows live toolbar\components\en-gb\msntabres.dll.mui/229?b3821fff552d4f33a0bf1714cf911810 IE: Open in new foreground tab - c:\program files\windows live toolbar\components\en-gb\msntabres.dll.mui/230?b3821fff552d4f33a0bf1714cf911810 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jamiep~1\applic~1\mozilla\firefox\profiles\iz4d4x4i.default\ FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPJPI150_08.dll FF - plugin: c:\program files\java\jre1.5.0_08\bin\NPOJI610.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll ============= SERVICES / DRIVERS =============== R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2007-1-5 821856] R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2007-1-5 4224] R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2007-1-5 27776] R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-5 10760] R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-4-11 66952] R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-4-11 81288] R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2007-1-5 418816] R2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2007-1-5 49664] R2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2007-1-5 406528] R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2007-1-5 4960] R2 AWService;AdminWorks Agent X6;c:\acer\empowering technology\admServ.exe [2005-10-24 1314816] R2 EpmPsd;Acer EPM Power Scheme Driver;c:\windows\system32\drivers\epm-psd.sys [2007-1-6 4096] R2 EpmShd;Acer EPM System Hardware Driver;c:\windows\system32\drivers\epm-shd.sys [2007-1-6 78208] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 OsaFsLoc;OsaFsLoc;c:\windows\system32\drivers\OsaFsLoc.sys [2005-10-15 12106] R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-6-30 7296] R2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-1-14 4010] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-11 356920] R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-11 1079176] R3 NdisFilt;OSA NdisFilter Protocol;c:\windows\system32\drivers\NdisFilt.sys [2005-9-13 4392] S0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-4-11 40840] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-6 32512] =============== Created Last 30 ================ 2009-04-12 14:23 <DIR> --d----- c:\docume~1\jamiep~1\applic~1\AVG8 2009-04-11 17:47 <DIR> --d----- c:\program files\TeaTimer (Spybot - Search & Destroy) 2009-04-11 17:47 <DIR> --d----- c:\program files\SDHelper (Spybot - Search & Destroy) 2009-04-11 17:47 <DIR> --d----- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2009-04-11 17:47 <DIR> --d----- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2009-04-11 17:32 1,152 a------- c:\windows\system32\windrv.sys 2009-04-11 17:31 <DIR> --d----- c:\docume~1\jamiep~1\applic~1\GetRightToGo 2009-04-11 14:57 81,288 a------- c:\windows\system32\drivers\iksyssec.sys 2009-04-11 14:57 66,952 a------- c:\windows\system32\drivers\iksysflt.sys 2009-04-11 14:57 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys 2009-04-11 14:57 29,576 a------- c:\windows\system32\drivers\kcom.sys 2009-04-11 14:57 <DIR> --d----- c:\program files\Spyware Doctor 2009-04-11 14:57 <DIR> --d----- c:\docume~1\jamiep~1\applic~1\PC Tools 2009-04-11 14:38 346,112 a------- c:\windows\system32\wincontrol.dll 2009-04-11 14:38 <DIR> --d----- c:\program files\common files\Uninstal ==================== Find3M ==================== 2009-02-09 11:13 1,846,784 a------- c:\windows\system32\win32k.sys 2009-02-09 11:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys 2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll 2007-09-16 21:49 18,432 a------- c:\docume~1\jamiep~1\applic~1\internaldb41.dat 2007-09-16 21:49 374 a------- c:\docume~1\jamiep~1\applic~1\internaldb6334.dat 2007-09-16 21:48 556 a------- c:\docume~1\jamiep~1\applic~1\internaldb8467.dat 2008-12-11 21:07 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008121120081212\index.dat ============= FINISH: 14:50:59.17 =============== I hope this is all you need, your help is very much appreciated |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-14-2009, 07:11 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ While Spybot's TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent tools from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.
Download ResetTeaTimer
If for some reason during these fixes you receive prompts from Spybot about whether to Allow or Deny any changes, please Allow them all. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
04-16-2009, 11:53 AM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: Securityhelpcenter.com (Trojans/worms etc)
done as requested
ComboFix 09-04-17.01 - Jamie Pemberton 04/16/2009 18:10.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.443 [GMT 1:00] Running from: c:\documents and settings\Jamie Pemberton\Desktop\ComboFix.exe AV: AVG 7.5.557 *On-access scanning enabled* (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Jamie Pemberton\err.log c:\windows\system32\drivers\npf.sys c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\WanPacket.dll c:\windows\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_NPF ((((((((((((((((((((((((( Files Created from 2009-03-16 to 2009-04-16 ))))))))))))))))))))))))))))))) . 2009-04-12 13:23 . 2009-04-12 13:23 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\AVG8 2009-04-11 17:42 . 2009-04-11 17:42 -------- d-----w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\Mozilla 2009-04-11 16:32 . 2009-04-11 16:32 1152 ----a-w c:\windows\system32\windrv.sys 2009-04-11 16:31 . 2009-04-11 16:31 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\GetRightToGo 2009-04-11 13:57 . 2009-04-11 13:58 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP 2009-04-11 13:57 . 2009-04-11 14:03 66952 ----a-w c:\windows\system32\drivers\iksysflt.sys 2009-04-11 13:57 . 2009-04-11 14:03 81288 ----a-w c:\windows\system32\drivers\iksyssec.sys 2009-04-11 13:57 . 2009-04-11 14:03 40840 ----a-w c:\windows\system32\drivers\ikfilesec.sys 2009-04-11 13:57 . 2008-06-02 14:19 29576 ----a-w c:\windows\system32\drivers\kcom.sys 2009-04-11 13:57 . 2009-04-11 13:57 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\PC Tools 2009-04-11 13:38 . 2009-04-11 13:38 346112 ----a-w c:\windows\system32\wincontrol.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-16 16:43 . 2007-01-23 19:43 244 ---ha-w C:\sqmnoopt13.sqm 2009-04-16 16:43 . 2007-01-23 19:43 232 ---ha-w C:\sqmdata13.sqm 2009-04-16 16:42 . 2008-03-19 19:39 1596 ----a-w C:\lxcr.log 2009-04-12 14:24 . 2007-01-21 22:54 244 ---ha-w C:\sqmnoopt12.sqm 2009-04-12 14:24 . 2007-01-21 22:54 232 ---ha-w C:\sqmdata12.sqm 2009-04-12 13:44 . 2007-01-21 20:40 244 ---ha-w C:\sqmnoopt11.sqm 2009-04-12 13:44 . 2007-01-21 20:40 232 ---ha-w C:\sqmdata11.sqm 2009-04-12 13:30 . 2007-01-21 20:30 244 ---ha-w C:\sqmnoopt10.sqm 2009-04-12 13:30 . 2007-01-21 20:30 232 ---ha-w C:\sqmdata10.sqm 2009-04-11 17:52 . 2007-01-20 23:11 244 ---ha-w C:\sqmnoopt09.sqm 2009-04-11 17:52 . 2007-01-20 23:11 232 ---ha-w C:\sqmdata09.sqm 2009-04-11 16:50 . 2007-01-15 22:58 244 ---ha-w C:\sqmnoopt08.sqm 2009-04-11 16:50 . 2007-01-15 22:58 232 ---ha-w C:\sqmdata08.sqm 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy) 2009-04-11 15:03 . 2008-03-09 13:40 10366 ----a-w C:\lxcrscan.log 2009-04-11 13:57 . 2009-04-11 13:57 -------- d-----w c:\program files\Spyware Doctor 2009-04-11 13:38 . 2009-04-11 13:38 -------- d-----w c:\program files\Common Files\Uninstal 2009-04-10 19:27 . 2007-01-15 22:58 244 ---ha-w C:\sqmnoopt07.sqm 2009-04-10 19:27 . 2007-01-15 22:58 232 ---ha-w C:\sqmdata07.sqm 2009-04-09 22:21 . 2007-01-14 22:33 244 ---ha-w C:\sqmnoopt06.sqm 2009-04-09 22:21 . 2007-01-14 22:33 232 ---ha-w C:\sqmdata06.sqm 2009-04-08 22:45 . 2007-01-14 00:00 244 ---ha-w C:\sqmnoopt05.sqm 2009-04-08 22:45 . 2007-01-14 00:00 232 ---ha-w C:\sqmdata05.sqm 2009-04-08 21:38 . 2007-01-12 22:17 244 ---ha-w C:\sqmnoopt04.sqm 2009-04-08 21:38 . 2007-01-12 22:17 232 ---ha-w C:\sqmdata04.sqm 2009-04-07 19:30 . 2007-01-12 21:16 244 ---ha-w C:\sqmnoopt03.sqm 2009-04-07 19:30 . 2007-01-12 21:16 232 ---ha-w C:\sqmdata03.sqm 2009-04-06 22:07 . 2007-01-11 21:24 244 ---ha-w C:\sqmnoopt02.sqm 2009-04-06 22:07 . 2007-01-11 21:24 232 ---ha-w C:\sqmdata02.sqm 2009-04-05 22:00 . 2007-01-07 21:55 244 ---ha-w C:\sqmnoopt01.sqm 2009-04-05 22:00 . 2007-01-07 21:55 232 ---ha-w C:\sqmdata01.sqm 2009-04-03 18:06 . 2007-01-06 23:23 244 ---ha-w C:\sqmnoopt00.sqm 2009-04-03 18:06 . 2007-01-06 23:23 232 ---ha-w C:\sqmdata00.sqm 2009-04-02 22:26 . 2007-03-21 21:13 244 ---ha-w C:\sqmnoopt19.sqm 2009-04-02 22:26 . 2007-03-21 21:13 232 ---ha-w C:\sqmdata19.sqm 2009-04-01 21:56 . 2007-02-17 14:01 244 ---ha-w C:\sqmnoopt18.sqm 2009-04-01 21:56 . 2007-02-17 14:01 232 ---ha-w C:\sqmdata18.sqm 2009-03-31 22:04 . 2007-02-10 14:53 244 ---ha-w C:\sqmnoopt17.sqm 2009-03-31 22:04 . 2007-02-10 14:53 232 ---ha-w C:\sqmdata17.sqm 2009-03-30 21:58 . 2007-02-09 18:52 244 ---ha-w C:\sqmnoopt16.sqm 2009-03-30 21:58 . 2007-02-09 18:52 232 ---ha-w C:\sqmdata16.sqm 2009-03-29 21:31 . 2007-02-03 22:23 244 ---ha-w C:\sqmnoopt15.sqm 2009-03-29 21:31 . 2007-02-03 22:23 232 ---ha-w C:\sqmdata15.sqm 2009-03-29 18:04 . 2007-01-27 23:09 244 ---ha-w C:\sqmnoopt14.sqm 2009-03-29 18:04 . 2007-01-27 23:09 232 ---ha-w C:\sqmdata14.sqm 2009-02-09 10:13 . 2008-10-16 18:07 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 10:13 . 2004-08-10 19:00 1846784 ----a-w c:\windows\system32\win32k.sys 2009-01-16 20:35 . 2006-01-31 18:59 3594752 ----a-w c:\windows\system32\dllcache\mshtml.dll 2008-12-11 21:36 . 2007-01-06 09:15 65624 ----a-w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2007-09-16 20:49 . 2007-02-03 16:32 374 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb6334.dat 2007-09-16 20:49 . 2007-02-03 16:32 18432 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb41.dat 2007-09-16 20:48 . 2007-02-03 16:32 556 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb8467.dat 2007-02-17 14:00 . 2007-01-06 09:13 138 ----a-w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\fusioncache.dat 2006-08-18 21:08 . 2006-08-18 21:08 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat 2008-12-11 20:07 . 2008-12-11 20:07 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121120081212\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4AFC04A3-B551-4B68-9BEB-8677D90150D9}] 2009-04-11 13:38 346112 ----a-w c:\windows\system32\wincontrol.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-21 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056] "ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-10-12 26112] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-12 98304] "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256] "Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632] "AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-25 590848] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_08\bin\jusched.exe" [2006-07-26 49263] "lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720] "EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304] "FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816] "LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-04-11 1168264] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-26 219136] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-21 68856] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2006-5-24 156784] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\AOL 9.0\\waol.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= S2 EpmPsd;Acer EPM Power Scheme Driver;c:\windows\system32\drivers\epm-psd.sys [2006-01-23 4096] S2 EpmShd;Acer EPM System Hardware Driver;c:\windows\system32\drivers\epm-shd.sys [2006-01-23 78208] S2 OsaFsLoc;OsaFsLoc;c:\windows\system32\drivers\OsaFsLoc.sys [2005-10-15 12106] S2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-06-30 7296] S2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-01-14 4010] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920] S3 NdisFilt;OSA NdisFilter Protocol;c:\windows\system32\Drivers\NdisFilt.sys [2005-09-13 4392] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv . - - - - ORPHANS REMOVED - - - - HKLM-Run-Workflow - E:\Workflow.exe HKLM-Run-PAV - c:\program files\PAV\pav.exe HKLM-Run-SNM - c:\program files\SpyNoMore\SNM.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://google.co.uk/ mStart Page = hxxp://www.google.com uInternet Connection Wizard,ShellNext = hxxp://manutd.com/ IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?b3821fff552d4f33a0bf1714cf911810 IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?b3821fff552d4f33a0bf1714cf911810 DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Jamie Pemberton\Application Data\Mozilla\Firefox\Profiles\iz4d4x4i.default\ FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJPI150_08.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPOJI610.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-16 18:17 Windows 5.1.2600 Service Pack 3 FAT NTAPI detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(3120) c:\windows\system32\MSNChatHook.dll c:\windows\system32\sysenv.dll c:\windows\system32\MSVCR71.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\INTEL\WIRELESS\BIN\EVTENG.EXE c:\program files\INTEL\WIRELESS\BIN\S24EVMON.EXE c:\program files\COMMON FILES\AOL\ACS\AOLACSD.EXE c:\program files\GRISOFT\AVG FREE\AVGAMSVR.EXE c:\program files\GRISOFT\AVG FREE\AVGUPSVC.EXE c:\program files\GRISOFT\AVG FREE\AVGEMC.EXE c:\acer\EMPOWERING TECHNOLOGY\ADMSERV.EXE c:\windows\EHOME\EHRECVR.EXE c:\windows\EHOME\EHSCHED.EXE c:\program files\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE c:\program files\INTEL\WIRELESS\BIN\REGSRVC.EXE c:\program files\SPYWARE DOCTOR\PCTSSVC.EXE c:\windows\EHOME\MCRDSVC.EXE c:\windows\SYSTEM32\RUNDLL32.EXE c:\windows\EHOME\EHMSAS.EXE c:\program files\LAUNCH MANAGER\LMANAGER.EXE c:\windows\SYSTEM32\WSCNTFY.EXE c:\program files\GRISOFT\AVG FREE\AVGCC.EXE c:\windows\system32\igfxext.exe c:\windows\SYSTEM32\IGFXSRVC.EXE c:\windows\system32\wbem\unsecapp.exe c:\docume~1\JAMIEP~1\LOCALS~1\Temp\RtkBtMnt.exe c:\windows\system32\dllhost.exe c:\windows\SYSTEM32\LXCRCOMS.EXE . ************************************************************************** . Completion time: 2009-04-16 18:19 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-16 17:19 Pre-Run: 34,577,121,280 bytes free Post-Run: 36,550,541,312 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 256 --- E O F --- 2009-03-14 18:38 Last edited by chemist; 04-16-2009 at 12:28 PM. |
|
|
|
|
04-16-2009, 12:34 PM
|
#5 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hello thecrimson.
Please go to: VirusTotal
|
|
|
|
|
04-16-2009, 01:18 PM
|
#6 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: Securityhelpcenter.com (Trojans/worms etc)
File wincontrol.dll received on 04.16.2009 21:13:43 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 9/40 (22.5%) Loading server information... Your file is queued in position: 1. Estimated start time is between 42 and 60 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.0.0.101 2009.04.16 Trojan.Yektel!IK AhnLab-V3 5.0.0.2 2009.04.16 - AntiVir 7.9.0.143 2009.04.16 TR/Yektel.A.45 Antiy-AVL 2.0.3.1 2009.04.16 - Authentium 5.1.2.4 2009.04.16 - Avast 4.8.1335.0 2009.04.16 - AVG 8.5.0.287 2009.04.16 - BitDefender 7.2 2009.04.16 - CAT-QuickHeal 10.00 2009.04.16 - ClamAV 0.94.1 2009.04.16 - Comodo 1116 2009.04.16 - DrWeb 4.44.0.09170 2009.04.16 - eSafe 7.0.17.0 2009.04.13 - eTrust-Vet 31.6.6455 2009.04.14 - F-Prot 4.4.4.56 2009.04.16 - F-Secure 8.0.14470.0 2009.04.16 - Fortinet 3.117.0.0 2009.04.16 PossibleThreat GData 19 2009.04.16 - Ikarus T3.1.1.49.0 2009.04.16 Trojan.Yektel K7AntiVirus 7.10.704 2009.04.15 - Kaspersky 7.0.0.125 2009.04.16 - McAfee 5586 2009.04.16 - McAfee+Artemis 5586 2009.04.16 Generic!Artemis McAfee-GW-Edition 6.7.6 2009.04.16 Trojan.Yektel.A.45 Microsoft 1.4502 2009.04.16 Trojan:Win32/Yektel.A NOD32 4014 2009.04.16 Win32/Adware.Antivirus2008 Norman 6.00.06 2009.04.16 - nProtect 2009.1.8.0 2009.04.16 - Panda 10.0.0.14 2009.04.16 Adware/Antivirus2008 PCTools 4.4.2.0 2009.04.15 - Prevx1 V2 2009.04.16 - Rising 21.25.34.00 2009.04.16 - Sophos 4.40.0 2009.04.16 - Sunbelt 3.2.1858.2 2009.04.16 - Symantec 1.4.4.12 2009.04.16 - TheHacker 6.3.4.0.309 2009.04.16 - TrendMicro 8.700.0.1004 2009.04.16 - VBA32 3.12.10.2 2009.04.12 - ViRobot 2009.4.16.1696 2009.04.16 - VirusBuster 4.6.5.0 2009.04.16 - Additional information File size: 346112 bytes MD5...: b364226e861be4c5394784eb37716d36 SHA1..: e437ae3174d544190f8e8d4a2c46568862fe5fa6 SHA256: 93e4f51af1024ee23834f64660477f109eade5e3c215ab16e2fd0cc854c35995 SHA512: 6b8de7a9309426d7a6808797f4c81218c7f38eeedc789942dec8cdd787d2209c 7f0c8c986f2c4a72517acef6d430e5402158a773f98336a7af0431020d1153d5 ssdeep: 6144:SFpt+OSnvE3zDBV2GmxdTxYuALb86KE+QM3nXUf2wgIG:jvEn9AVYtZKE+f 3X4L PEiD..: - TrID..: File type identification Win32 Executable Generic (38.4%) Win32 Dynamic Link Library (generic) (34.2%) Clipper DOS Executable (9.1%) Generic Win/DOS Executable (9.0%) DOS Executable Generic (9.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x12e6 timedatestamp.....: 0x45ead11c (Sun Mar 04 14:01:00 2007) machinetype.......: 0x14c (I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x1d98 0x1e00 3.25 0df4a9915950fe6cb267a72c9b3f2a50 RData 0x3000 0x288 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .DAta 0x4000 0x4ff1e 0x50000 6.95 c0f8ea7d68db1b4e87c3a3c51c023d7e .idata 0x54000 0x16e7 0x1800 3.98 8e17504fbbef615433fa72d113c27fa2 .edata 0x56000 0x39d 0x400 0.00 0f343b0931126a20f133d67c2b018a3b .idAta 0x57000 0x4d6ee 0x800 0.00 c99a74c555371a433d121f551d6c6398 ( 10 imports ) > KERNEL32.DLL: CreateThread, ReadFile, OpenFile, GetCommandLineA, CopyFileW, CopyFileExA, GetCPInfo, SetLastError, DeleteFileW, GetComputerNameA, DeleteAtom, GetFileTime, GetStdHandle, ExitThread > ADVAPI32.DLL: RegQueryValueA, RegQueryValueExW, RegDeleteValueA, RegEnumValueA, RegFlushKey, RegEnumKeyExA, RegDeleteKeyA, RegOpenKeyW, RegReplaceKeyA, RegQueryValueW, RegReplaceKeyW, RegLoadKeyW, RegEnumKeyA > COMCTL32.DLL: ImageList_GetImageRect, ImageList_Merge, ImageList_ReplaceIcon, ImageList_DragEnter, ImageList_EndDrag, ImageList_Destroy, ImageList_Replace, ImageList_DragMove, ImageList_GetImageCount, ImageList_LoadImageA, ImageList_AddIcon, ImageList_GetDragImage, ImageList_LoadImage, ImageList_DragShowNolock > KERNEL32.DLL: GetCPInfo, CreateThread, CopyFileA, GetStdHandle, GetComputerNameA, ReadFile, GetCommandLineA, CreateDirectoryA, DeleteFileA, GlobalFree, CopyFileW, ExitThread, ReadConsoleA > COMCTL32.DLL: ImageList_DragEnter, ImageList_GetImageCount, ImageList_EndDrag, ImageList_GetImageInfo, ImageList_Copy, ImageList_GetDragImage, ImageList_LoadImageA, ImageList_DragShowNolock, InitCommonControls, ImageList_Draw, ImageList_AddIcon, ImageList_Read, ImageList_DragMove, ImageList_AddMasked > COMCTL32.DLL: ImageList_Copy, ImageList_GetImageRect, ImageList_DrawEx, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Merge, ImageList_Replace, ImageList_Remove, ImageList_Destroy, ImageList_LoadImageA, ImageList_BeginDrag, ImageList_GetImageInfo, ImageList_DragEnter, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Read, ImageList_Draw, ImageList_DrawIndirect, ImageList_EndDrag > KERNEL32.DLL: GetFileSize, GetConsoleMode, CopyFileExA, OpenFile, CopyFileW, FindFirstFileA, GetFileTime, ReadFile, CreateProcessA, WriteFile, OpenFileMappingA, CopyFileExW, DeleteAtom, ReadConsoleA, GetComputerNameA, GetCPInfo > USER32.DLL: EndDialog, DrawTextA, CloseWindow, CreateIcon, AppendMenuA, DialogBoxParamW, CalcMenuBar, InsertMenuA, IsMenu, GetDC, LoadMenuA, AlignRects, GetFocus, DrawIcon, GetWindowTextLengthA, GetWindowTextA > USER32.DLL: DrawTextA, AppendMenuW, LoadMenuA, CopyIcon, CopyRect, DrawIconEx, AlignRects, BlockInput, InsertMenuA, CalcMenuBar, GetWindowTextA, GetMenu, LoadCursorA, GetDC, GetDlgItem, AppendMenuA > COMCTL32.DLL: ImageList_GetDragImage, ImageList_GetIconSize, ImageList_LoadImageW, ImageList_AddMasked, ImageList_AddIcon, ImageList_GetIcon, ImageList_DragMove, ImageList_Draw, ImageList_LoadImage, ImageList_LoadImageA, ImageList_Create, ImageList_DragLeave, ImageList_Remove, ImageList_Destroy, ImageList_ReplaceIcon, ImageList_GetImageRect, ImageList_Replace, ImageList_EndDrag, ImageList_Copy ( 0 exports ) RDS...: NSRL Reference Data Set |
|
|
|
|
04-16-2009, 01:25 PM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hello thecrimson.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/365945-securityhelpcenter-com-trojans-worms-etc.html#post2084754 Collect:: c:\windows\system32\wincontrol.dll DirLook:: c:\program files\Common Files\Uninstal  Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ |
|
|
|
|
04-16-2009, 01:45 PM
|
#8 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hi chemist,
Message told me file was uploaded ok. attached is the log as requested ComboFix 09-04-17.01 - Jamie Pemberton 04/16/2009 20:38.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.436 [GMT 1:00] Running from: c:\documents and settings\Jamie Pemberton\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Jamie Pemberton\Desktop\CFScript.txt AV: AVG 7.5.557 *On-access scanning disabled* (Updated) FW: ZoneAlarm Firewall *disabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\_000007_.tmp.dll c:\windows\system32\_000023_.tmp.dll c:\windows\system32\_000024_.tmp.dll c:\windows\system32\_000025_.tmp.dll c:\windows\system32\_000026_.tmp.dll c:\windows\system32\wincontrol.dll . ((((((((((((((((((((((((( Files Created from 2009-03-17 to 2009-04-17 ))))))))))))))))))))))))))))))) . 2009-04-16 18:15 . 2009-04-16 18:15 150 ----a-w c:\windows\system32\spupdsvc.inf 2009-04-16 18:14 . 2009-04-16 18:14 -------- d-----w c:\windows\LastGood 2009-04-16 18:06 . 2009-02-15 23:10 1221512 ----a-w c:\windows\system32\zpeng25.dll 2009-04-16 18:06 . 2009-04-16 18:06 -------- d-----w c:\windows\system32\ZoneLabs 2009-04-16 18:06 . 2009-04-16 18:11 350192 ----a-w c:\windows\system32\vsconfig.xml 2009-04-12 13:23 . 2009-04-12 13:23 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\AVG8 2009-04-11 17:42 . 2009-04-11 17:42 -------- d-----w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\Mozilla 2009-04-11 16:32 . 2009-04-11 16:32 1152 ----a-w c:\windows\system32\windrv.sys 2009-04-11 16:31 . 2009-04-11 16:31 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\GetRightToGo 2009-04-11 13:57 . 2009-04-11 13:58 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP 2009-04-11 13:57 . 2009-04-11 14:03 66952 ----a-w c:\windows\system32\drivers\iksysflt.sys 2009-04-11 13:57 . 2009-04-11 14:03 81288 ----a-w c:\windows\system32\drivers\iksyssec.sys 2009-04-11 13:57 . 2009-04-11 14:03 40840 ----a-w c:\windows\system32\drivers\ikfilesec.sys 2009-04-11 13:57 . 2008-06-02 14:19 29576 ----a-w c:\windows\system32\drivers\kcom.sys 2009-04-11 13:57 . 2009-04-11 13:57 -------- d-----w c:\documents and settings\Jamie Pemberton\Application Data\PC Tools 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-16 18:09 . 2007-01-27 23:09 244 ---ha-w C:\sqmnoopt14.sqm 2009-04-16 18:09 . 2007-01-27 23:09 232 ---ha-w C:\sqmdata14.sqm 2009-04-16 18:07 . 2009-04-16 18:07 -------- d-----w c:\program files\AskBarDis 2009-04-16 18:07 . 2007-01-05 19:10 4212 ---ha-w c:\windows\system32\zllictbl.dat 2009-04-16 18:06 . 2009-04-16 18:06 -------- d-----w c:\program files\Zone Labs 2009-04-16 16:43 . 2007-01-23 19:43 244 ---ha-w C:\sqmnoopt13.sqm 2009-04-16 16:43 . 2007-01-23 19:43 232 ---ha-w C:\sqmdata13.sqm 2009-04-16 16:42 . 2008-03-19 19:39 1596 ----a-w C:\lxcr.log 2009-04-12 14:24 . 2007-01-21 22:54 244 ---ha-w C:\sqmnoopt12.sqm 2009-04-12 14:24 . 2007-01-21 22:54 232 ---ha-w C:\sqmdata12.sqm 2009-04-12 13:44 . 2007-01-21 20:40 244 ---ha-w C:\sqmnoopt11.sqm 2009-04-12 13:44 . 2007-01-21 20:40 232 ---ha-w C:\sqmdata11.sqm 2009-04-12 13:30 . 2007-01-21 20:30 244 ---ha-w C:\sqmnoopt10.sqm 2009-04-12 13:30 . 2007-01-21 20:30 232 ---ha-w C:\sqmdata10.sqm 2009-04-11 17:52 . 2007-01-20 23:11 244 ---ha-w C:\sqmnoopt09.sqm 2009-04-11 17:52 . 2007-01-20 23:11 232 ---ha-w C:\sqmdata09.sqm 2009-04-11 16:50 . 2007-01-15 22:58 244 ---ha-w C:\sqmnoopt08.sqm 2009-04-11 16:50 . 2007-01-15 22:58 232 ---ha-w C:\sqmdata08.sqm 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2009-04-11 16:47 . 2009-04-11 16:47 -------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy) 2009-04-11 15:03 . 2008-03-09 13:40 10366 ----a-w C:\lxcrscan.log 2009-04-11 13:57 . 2009-04-11 13:57 -------- d-----w c:\program files\Spyware Doctor 2009-04-11 13:38 . 2009-04-11 13:38 -------- d-----w c:\program files\Common Files\Uninstal 2009-04-10 19:27 . 2007-01-15 22:58 244 ---ha-w C:\sqmnoopt07.sqm 2009-04-10 19:27 . 2007-01-15 22:58 232 ---ha-w C:\sqmdata07.sqm 2009-04-09 22:21 . 2007-01-14 22:33 244 ---ha-w C:\sqmnoopt06.sqm 2009-04-09 22:21 . 2007-01-14 22:33 232 ---ha-w C:\sqmdata06.sqm 2009-04-08 22:45 . 2007-01-14 00:00 244 ---ha-w C:\sqmnoopt05.sqm 2009-04-08 22:45 . 2007-01-14 00:00 232 ---ha-w C:\sqmdata05.sqm 2009-04-08 21:38 . 2007-01-12 22:17 244 ---ha-w C:\sqmnoopt04.sqm 2009-04-08 21:38 . 2007-01-12 22:17 232 ---ha-w C:\sqmdata04.sqm 2009-04-07 19:30 . 2007-01-12 21:16 244 ---ha-w C:\sqmnoopt03.sqm 2009-04-07 19:30 . 2007-01-12 21:16 232 ---ha-w C:\sqmdata03.sqm 2009-04-06 22:07 . 2007-01-11 21:24 244 ---ha-w C:\sqmnoopt02.sqm 2009-04-06 22:07 . 2007-01-11 21:24 232 ---ha-w C:\sqmdata02.sqm 2009-04-05 22:00 . 2007-01-07 21:55 244 ---ha-w C:\sqmnoopt01.sqm 2009-04-05 22:00 . 2007-01-07 21:55 232 ---ha-w C:\sqmdata01.sqm 2009-04-03 18:06 . 2007-01-06 23:23 244 ---ha-w C:\sqmnoopt00.sqm 2009-04-03 18:06 . 2007-01-06 23:23 232 ---ha-w C:\sqmdata00.sqm 2009-04-02 22:26 . 2007-03-21 21:13 244 ---ha-w C:\sqmnoopt19.sqm 2009-04-02 22:26 . 2007-03-21 21:13 232 ---ha-w C:\sqmdata19.sqm 2009-04-01 21:56 . 2007-02-17 14:01 244 ---ha-w C:\sqmnoopt18.sqm 2009-04-01 21:56 . 2007-02-17 14:01 232 ---ha-w C:\sqmdata18.sqm 2009-03-31 22:04 . 2007-02-10 14:53 244 ---ha-w C:\sqmnoopt17.sqm 2009-03-31 22:04 . 2007-02-10 14:53 232 ---ha-w C:\sqmdata17.sqm 2009-03-30 21:58 . 2007-02-09 18:52 244 ---ha-w C:\sqmnoopt16.sqm 2009-03-30 21:58 . 2007-02-09 18:52 232 ---ha-w C:\sqmdata16.sqm 2009-03-29 21:31 . 2007-02-03 22:23 244 ---ha-w C:\sqmnoopt15.sqm 2009-03-29 21:31 . 2007-02-03 22:23 232 ---ha-w C:\sqmdata15.sqm 2009-03-27 06:58 . 2009-04-16 16:48 1203922 ----a-w c:\windows\AppPatch\SET6.tmp 2009-03-06 14:22 . 2009-04-16 16:48 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-03-06 14:22 . 2004-08-10 19:00 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2009-03-03 00:18 826368 ----a-w c:\windows\system32\SET57.tmp 2009-03-03 00:18 . 2006-01-09 10:02 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-02-28 04:54 . 2004-08-10 19:00 636072 ----a-w c:\windows\system32\dllcache\iexplore.exe 2009-02-20 10:20 . 2007-06-27 08:27 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2004-08-10 19:00 70656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2004-08-10 19:00 161792 ----a-w c:\windows\system32\dllcache\ieakui.dll 2009-02-09 12:10 . 2009-04-16 16:48 729088 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-02-09 12:10 . 2004-08-10 19:00 729088 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2009-04-16 16:48 473600 ------w c:\windows\system32\dllcache\fastprox.dll 2009-02-09 12:10 . 2009-04-16 16:48 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-02-09 12:10 . 2009-04-16 16:48 401408 ----a-w c:\windows\system32\SET30.tmp 2009-02-09 12:10 . 2009-04-16 16:48 401408 ------w c:\windows\system32\dllcache\rpcss.dll 2009-02-09 12:10 . 2009-04-16 16:48 714752 ------w c:\windows\system32\dllcache\ntdll.dll 2009-02-09 12:10 . 2009-04-16 16:48 617472 ------w c:\windows\system32\dllcache\advapi32.dll 2009-02-09 12:10 . 2004-08-10 19:00 714752 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2004-08-10 19:00 617472 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:13 . 2008-10-16 18:07 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 10:13 . 2004-08-10 19:00 1846784 ----a-w c:\windows\system32\win32k.sys 2009-02-07 18:02 . 2008-10-16 18:07 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-06 11:11 . 2009-04-16 16:48 110592 ------w c:\windows\system32\dllcache\services.exe 2009-02-06 11:11 . 2004-08-10 19:00 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 11:08 . 2008-10-16 18:07 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:06 . 2008-10-16 18:07 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 11:06 . 2005-09-28 16:02 2145280 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 10:39 . 2004-08-10 19:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 10:39 . 2004-08-10 19:00 35328 ----a-w c:\windows\system32\dllcache\sc.exe 2009-02-06 10:32 . 2008-10-16 18:07 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-06 10:32 . 2005-09-28 15:35 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-06 10:10 . 2009-04-16 16:48 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ----a-w c:\windows\system32\SETC3.tmp 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll 2008-12-11 21:36 . 2007-01-06 09:15 65624 ----a-w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2007-09-16 20:49 . 2007-02-03 16:32 374 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb6334.dat 2007-09-16 20:49 . 2007-02-03 16:32 18432 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb41.dat 2007-09-16 20:48 . 2007-02-03 16:32 556 ----a-w c:\documents and settings\Jamie Pemberton\Application Data\internaldb8467.dat 2007-02-17 14:00 . 2007-01-06 09:13 138 ----a-w c:\documents and settings\Jamie Pemberton\Local Settings\Application Data\fusioncache.dat 2006-08-18 21:08 . 2006-08-18 21:08 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat 2008-12-11 20:07 . 2008-12-11 20:07 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121120081212\index.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\program files\Common Files\Uninstal ---- ((((((((((((((((((((((((((((( SnapShot@2009-04-16_17.17.23 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-16 18:06 . 2009-02-15 23:10 97672 c:\windows\system32\ZoneLabs\zlquarantine.dll + 2009-04-16 18:06 . 2008-11-17 01:24 51688 c:\windows\system32\ZoneLabs\srescan.sys + 2009-04-16 18:06 . 2009-02-15 23:10 94088 c:\windows\system32\ZoneLabs\lib\zvpn.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 20360 c:\windows\system32\ZoneLabs\lib\zsys.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 59272 c:\windows\system32\ZoneLabs\lib\zpdp.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 14216 c:\windows\system32\ZoneLabs\lib\zmenu.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 24968 c:\windows\system32\ZoneLabs\lib\zic.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 84872 c:\windows\system32\ZoneLabs\lib\ZAlert.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 34696 c:\windows\system32\ZoneLabs\lib\UpdateUI.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 17800 c:\windows\system32\ZoneLabs\lib\oem_1466.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 10120 c:\windows\system32\ZoneLabs\lib\oem_1454.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 10632 c:\windows\system32\ZoneLabs\lib\oem_1445.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 13704 c:\windows\system32\ZoneLabs\lib\oem_1440.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 11656 c:\windows\system32\ZoneLabs\lib\oem_1413.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 11144 c:\windows\system32\ZoneLabs\lib\oem_1010.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 29576 c:\windows\system32\ZoneLabs\lib\NavBar.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 12168 c:\windows\system32\ZoneLabs\lib\MainLoop.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 35720 c:\windows\system32\ZoneLabs\lib\Alert.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 38280 c:\windows\system32\ZoneLabs\featuremap.dll + 2009-04-16 18:06 . 2009-02-15 23:10 98184 c:\windows\system32\ZoneLabs\fbl.dll + 2009-04-16 18:07 . 2009-02-15 23:10 74632 c:\windows\system32\ZoneLabs\camupd.dll + 2009-04-16 18:06 . 2009-02-15 23:10 69000 c:\windows\system32\zlcomm.dll + 2009-04-16 18:06 . 2009-02-15 23:10 35208 c:\windows\system32\vswmi.dll + 2009-04-16 18:06 . 2009-02-15 23:10 58248 c:\windows\system32\vsregexp.dll - 2005-10-13 11:22 . 2007-07-27 08:41 26488 c:\windows\system32\spupdsvc.exe + 2005-10-13 11:22 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe - 2007-05-27 15:29 . 2007-11-30 10:18 17272 c:\windows\system32\spmsg.dll + 2007-05-27 15:29 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll - 2006-01-09 10:02 . 2008-12-20 22:15 44544 c:\windows\system32\pngfilt.dll + 2006-01-09 10:02 . 2009-02-20 18:09 44544 c:\windows\system32\pngfilt.dll - 2006-10-12 13:25 . 2009-04-11 13:59 53838 c:\windows\system32\perfc009.dat + 2006-10-12 13:25 . 2009-04-16 18:15 53838 c:\windows\system32\perfc009.dat + 2004-08-10 19:00 . 2008-06-12 14:23 91648 c:\windows\system32\mtxoci.dll - 2004-08-10 19:00 . 2008-04-14 00:12 91648 c:\windows\system32\mtxoci.dll - 2004-08-10 19:00 . 2008-04-14 00:12 58880 c:\windows\system32\msdtclog.dll + 2004-08-10 19:00 . 2008-06-12 14:23 58880 c:\windows\system32\msdtclog.dll - 2006-11-07 02:26 . 2008-12-19 08:10 13824 c:\windows\system32\ieudinit.exe + 2006-11-07 02:26 . 2009-02-20 10:20 13824 c:\windows\system32\ieudinit.exe - 2004-08-10 19:00 . 2008-12-20 22:15 44544 c:\windows\system32\iernonce.dll + 2004-08-10 19:00 . 2009-02-20 18:09 44544 c:\windows\system32\iernonce.dll + 2004-08-10 19:00 . 2009-02-20 18:09 78336 c:\windows\system32\ieencode.dll + 2004-08-10 19:00 . 2009-02-20 10:20 70656 c:\windows\system32\ie4uinit.exe - 2004-08-10 19:00 . 2008-12-19 08:10 70656 c:\windows\system32\ie4uinit.exe + 2006-01-09 10:02 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\pngfilt.dll - 2006-01-09 10:02 . 2008-12-20 22:15 44544 c:\windows\system32\dllcache\pngfilt.dll + 2008-06-12 14:23 . 2008-06-12 14:23 91648 c:\windows\system32\dllcache\mtxoci.dll + 2008-06-12 14:23 . 2008-06-12 14:23 66560 c:\windows\system32\dllcache\mtxclu.dll - 2007-06-27 14:34 . 2008-12-20 22:15 52224 c:\windows\system32\dllcache\msfeedsbs.dll + 2007-06-27 14:34 . 2009-02-20 18:09 52224 c:\windows\system32\dllcache\msfeedsbs.dll + 2008-06-12 14:23 . 2008-06-12 14:23 58880 c:\windows\system32\dllcache\msdtclog.dll - 2004-08-10 19:00 . 2008-12-20 22:15 27648 c:\windows\system32\dllcache\jsproxy.dll + 2004-08-10 19:00 . 2009-02-20 18:09 27648 c:\windows\system32\dllcache\jsproxy.dll + 2004-08-10 19:00 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\iernonce.dll - 2004-08-10 19:00 . 2008-12-20 22:15 44544 c:\windows\system32\dllcache\iernonce.dll + 2009-02-20 18:09 . 2009-02-20 18:09 78336 c:\windows\system32\dllcache\ieencode.dll - 2007-08-20 10:04 . 2008-12-20 22:15 63488 c:\windows\system32\dllcache\icardie.dll + 2007-08-20 10:04 . 2009-02-20 18:09 63488 c:\windows\system32\dllcache\icardie.dll + 2009-04-16 18:17 . 2008-12-20 22:15 44544 c:\windows\ie7updates\KB963027-IE7\pngfilt.dll + 2009-04-16 18:17 . 2008-12-20 22:15 52224 c:\windows\ie7updates\KB963027-IE7\msfeedsbs.dll + 2009-04-16 18:17 . 2008-12-20 22:15 27648 c:\windows\ie7updates\KB963027-IE7\jsproxy.dll + 2009-04-16 18:17 . 2008-12-19 08:10 13824 c:\windows\ie7updates\KB963027-IE7\ieudinit.exe + 2009-04-16 18:17 . 2008-12-20 22:15 44544 c:\windows\ie7updates\KB963027-IE7\iernonce.dll + 2009-04-16 18:17 . 2008-04-14 00:11 81920 c:\windows\ie7updates\KB963027-IE7\ieencode.dll + 2009-04-16 18:17 . 2008-12-19 08:10 70656 c:\windows\ie7updates\KB963027-IE7\ie4uinit.exe + 2009-04-16 18:17 . 2008-12-20 22:15 63488 c:\windows\ie7updates\KB963027-IE7\icardie.dll + 2009-04-16 18:06 . 2009-02-15 23:10 9608 c:\windows\system32\ZoneLabs\lib\oem_1460.zip.dll + 2009-04-16 16:48 . 2008-05-03 11:55 2560 c:\windows\system32\xpsp4res.dll + 2008-07-29 07:05 . 2008-07-29 07:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll + 2008-07-29 07:05 . 2008-07-29 07:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll + 2008-07-29 02:54 . 2008-07-29 02:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll + 2008-07-29 04:23 . 2008-07-29 04:23 626688 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcr90.dll + 2008-07-29 04:23 . 2008-07-29 04:23 856576 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcp90.dll + 2008-07-29 02:51 . 2008-07-29 02:51 245760 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcm90.dll + 2009-04-16 18:06 . 2009-02-15 23:10 108424 c:\windows\system32\ZoneLabs\zlupdate.dll + 2009-04-16 18:06 . 2009-02-15 23:10 302472 c:\windows\system32\ZoneLabs\zlsre.dll + 2009-04-16 18:06 . 2009-02-15 23:10 178568 c:\windows\system32\ZoneLabs\zlparser.dll + 2009-04-16 18:06 . 2009-02-15 23:10 172936 c:\windows\system32\ZoneLabs\vsvault.dll + 2009-04-16 18:03 . 2009-02-15 23:10 108424 c:\windows\system32\ZoneLabs\vsdb.dll + 2009-04-16 18:06 . 2009-02-15 23:10 176520 c:\windows\system32\ZoneLabs\updclient.exe + 2009-04-16 18:06 . 2007-10-11 15:51 832984 c:\windows\system32\ZoneLabs\updating.dll + 2009-04-16 18:06 . 2009-02-15 23:10 431496 c:\windows\system32\ZoneLabs\ssleay32.dll + 2009-04-16 18:06 . 2009-02-15 23:10 134536 c:\windows\system32\ZoneLabs\scheduler.dll + 2009-04-16 18:06 . 2008-11-17 01:23 796128 c:\windows\system32\ZoneLabs\qrsrecl.dll + 2009-04-16 18:06 . 2008-11-17 01:23 722400 c:\windows\system32\ZoneLabs\qrbase.dll + 2009-04-16 18:06 . 2009-02-15 23:10 118664 c:\windows\system32\ZoneLabs\lib\zui.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 151944 c:\windows\system32\ZoneLabs\lib\ztv.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 188808 c:\windows\system32\ZoneLabs\lib\Overview.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 344968 c:\windows\system32\ZoneLabs\lib\LicenseUI.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 136584 c:\windows\system32\ZoneLabs\lib\DashBoard.zip.dll + 2009-04-16 18:06 . 2009-02-15 23:10 344456 c:\windows\system32\ZoneLabs\lib\ConfigWizard.zip.dll + 2009-04-16 18:03 . 2009-02-04 17:27 548128 c:\windows\system32\ZoneLabs\icslta.dll + 2009-04-16 18:06 . 2009-02-15 23:10 159112 c:\windows\system32\ZoneLabs\httpblocker.dll + 2009-04-16 18:07 . 2008-03-17 15:52 813568 c:\windows\system32\ZoneLabs\dbghelp.dll + 2009-04-16 18:06 . 2009-02-15 23:10 103816 c:\windows\system32\zlcommdb.dll + 2009-04-16 18:06 . 2009-02-15 23:10 109960 c:\windows\system32\vsxml.dll + 2009-04-16 18:03 . 2009-02-15 23:10 482184 c:\windows\system32\vsutil.dll + 2009-04-16 18:06 . 2009-02-15 23:10 309128 c:\windows\system32\vspubapi.dll + 2009-04-16 18:06 . 2009-02-15 23:10 107912 c:\windows\system32\vsmonapi.dll + 2009-04-16 18:03 . 2009-02-15 23:10 229256 c:\windows\system32\vsinit.dll + 2009-04-16 18:06 . 2009-02-15 23:10 353672 c:\windows\system32\vsdatant.sys + 2009-04-16 18:03 . 2009-02-15 23:10 110472 c:\windows\system32\vsdata.dll - 2006-10-12 13:25 . 2009-04-11 13:59 382260 c:\windows\system32\perfh009.dat + 2006-10-12 13:25 . 2009-04-16 18:15 382260 c:\windows\system32\perfh009.dat + 2004-08-10 19:00 . 2009-02-20 18:09 102912 c:\windows\system32\occache.dll - 2004-08-10 19:00 . 2008-12-20 22:15 102912 c:\windows\system32\occache.dll + 2006-01-09 10:02 . 2009-02-20 18:09 671232 c:\windows\system32\mstime.dll - 2006-01-09 10:02 . 2008-12-20 22:15 671232 c:\windows\system32\mstime.dll + 2006-01-09 10:02 . 2009-02-20 18:09 193024 c:\windows\system32\msrating.dll - 2006-01-09 10:02 . 2008-12-20 22:15 193024 c:\windows\system32\msrating.dll + 2006-01-09 10:02 . 2009-02-20 18:09 477696 c:\windows\system32\mshtmled.dll - 2006-01-09 10:02 . 2008-12-20 22:15 477696 c:\windows\system32\mshtmled.dll - 2004-08-10 19:00 . 2008-04-14 00:12 161792 c:\windows\system32\msdtcuiu.dll + 2004-08-10 19:00 . 2008-06-12 14:23 161792 c:\windows\system32\msdtcuiu.dll - 2004-08-10 19:00 . 2008-04-14 00:12 956928 c:\windows\system32\msdtctm.dll + 2004-08-10 19:00 . 2008-06-12 14:23 956928 c:\windows\system32\msdtctm.dll + 2004-08-10 19:00 . 2008-06-12 14:23 428032 c:\windows\system32\msdtcprx.dll - 2004-08-10 19:00 . 2008-04-14 00:11 989696 c:\windows\system32\kernel32.dll + 2004-08-10 19:00 . 2009-03-21 14:06 989696 c:\windows\system32\kernel32.dll + 2004-08-10 19:00 . 2009-02-20 18:09 385024 c:\windows\system32\iedkcs32.dll - 2004-08-10 19:00 . 2008-12-19 04:23 161792 c:\windows\system32\ieakui.dll + 2004-08-10 19:00 . 2009-02-20 05:14 161792 c:\windows\system32\ieakui.dll - 2004-08-10 19:00 . 2008-12-20 22:15 230400 c:\windows\system32\ieaksie.dll + 2004-08-10 19:00 . 2009-02-20 18:09 230400 c:\windows\system32\ieaksie.dll + 2004-08-10 19:00 . 2009-02-20 18:09 153088 c:\windows\system32\ieakeng.dll - 2004-08-10 19:00 . 2008-12-20 22:15 153088 c:\windows\system32\ieakeng.dll + 2006-01-09 10:01 . 2009-02-20 18:09 133120 c:\windows\system32\extmgr.dll - 2006-01-09 10:01 . 2008-12-20 22:15 133120 c:\windows\system32\extmgr.dll + 2006-01-09 10:01 . 2009-02-20 18:09 214528 c:\windows\system32\dxtrans.dll - 2006-01-09 10:01 . 2008-12-20 22:15 214528 c:\windows\system32\dxtrans.dll - 2004-08-10 19:00 . 2008-12-20 22:15 347136 c:\windows\system32\dxtmsft.dll + 2004-08-10 19:00 . 2009-02-20 18:09 347136 c:\windows\system32\dxtmsft.dll + 2009-04-16 16:48 . 2008-04-21 12:08 215552 c:\windows\system32\dllcache\wordpad.exe + 2008-12-16 12:30 . 2008-12-16 12:30 354304 c:\windows\system32\dllcache\winhttp.dll - 2004-08-10 19:00 . 2008-12-20 22:15 233472 c:\windows\system32\dllcache\webcheck.dll + 2004-08-10 19:00 . 2009-02-20 18:09 233472 c:\windows\system32\dllcache\webcheck.dll + 2004-08-10 12:00 . 2009-02-20 18:09 105984 c:\windows\system32\dllcache\url.dll - 2004-08-10 12:00 . 2008-12-20 22:15 105984 c:\windows\system32\dllcache\url.dll - 2004-08-10 19:00 . 2008-12-20 22:15 102912 c:\windows\system32\dllcache\occache.dll + 2004-08-10 19:00 . 2009-02-20 18:09 102912 c:\windows\system32\dllcache\occache.dll - 2006-01-09 10:02 . 2008-12-20 22:15 671232 c:\windows\system32\dllcache\mstime.dll + 2006-01-09 10:02 . 2009-02-20 18:09 671232 c:\windows\system32\dllcache\mstime.dll + 2006-01-09 10:02 . 2009-02-20 18:09 193024 c:\windows\system32\dllcache\msrating.dll - 2006-01-09 10:02 . 2008-12-20 22:15 193024 c:\windows\system32\dllcache\msrating.dll - 2006-01-09 10:02 . 2008-12-20 22:15 477696 c:\windows\system32\dllcache\mshtmled.dll + 2006-01-09 10:02 . 2009-02-20 18:09 477696 c:\windows\system32\dllcache\mshtmled.dll + 2007-06-27 14:34 . 2009-02-20 18:09 459264 c:\windows\system32\dllcache\msfeeds.dll - 2007-06-27 14:34 . 2008-12-20 22:15 459264 c:\windows\system32\dllcache\msfeeds.dll + 2008-06-12 14:23 . 2008-06-12 14:23 161792 c:\windows\system32\dllcache\msdtcuiu.dll + 2008-06-12 14:23 . 2008-06-12 14:23 956928 c:\windows\system32\dllcache\msdtctm.dll + 2008-06-12 14:23 . 2008-06-12 14:23 428032 c:\windows\system32\dllcache\msdtcprx.dll + 2007-06-27 14:34 . 2009-02-20 18:09 268288 c:\windows\system32\dllcache\iertutil.dll + 2004-08-10 19:00 . 2009-02-20 18:09 385024 c:\windows\system32\dllcache\iedkcs32.dll + 2007-06-27 14:34 . 2009-02-20 18:09 383488 c:\windows\system32\dllcache\ieapfltr.dll - 2007-06-27 14:34 . 2008-12-20 22:15 383488 c:\windows\system32\dllcache\ieapfltr.dll + 2004-08-10 19:00 . 2009-02-20 18:09 230400 c:\windows\system32\dllcache\ieaksie.dll - 2004-08-10 19:00 . 2008-12-20 22:15 230400 c:\windows\system32\dllcache\ieaksie.dll - 2004-08-10 19:00 . 2008-12-20 22:15 153088 c:\windows\system32\dllcache\ieakeng.dll + 2004-08-10 19:00 . 2009-02-20 18:09 153088 c:\windows\system32\dllcache\ieakeng.dll + 2006-01-09 10:01 . 2009-02-20 18:09 133120 c:\windows\system32\dllcache\extmgr.dll - 2006-01-09 10:01 . 2008-12-20 22:15 133120 c:\windows\system32\dllcache\extmgr.dll - 2006-01-09 10:01 . 2008-12-20 22:15 214528 c:\windows\system32\dllcache\dxtrans.dll + 2006-01-09 10:01 . 2009-02-20 18:09 214528 c:\windows\system32\dllcache\dxtrans.dll + 2004-08-10 19:00 . 2009-02-20 18:09 347136 c:\windows\system32\dllcache\dxtmsft.dll - 2004-08-10 19:00 . 2008-12-20 22:15 347136 c:\windows\system32\dllcache\dxtmsft.dll - 2004-08-10 12:00 . 2008-12-20 22:15 124928 c:\windows\system32\dllcache\advpack.dll + 2004-08-10 12:00 . 2009-02-20 18:09 124928 c:\windows\system32\dllcache\advpack.dll + 2009-04-16 18:17 . 2008-12-20 22:15 826368 c:\windows\ie7updates\KB963027-IE7\wininet.dll + 2009-04-16 18:17 . 2008-12-20 22:15 233472 c:\windows\ie7updates\KB963027-IE7\webcheck.dll + 2009-04-16 18:17 . 2008-12-20 22:15 105984 c:\windows\ie7updates\KB963027-IE7\url.dll + 2009-04-16 18:17 . 2008-07-09 07:38 382840 c:\windows\ie7updates\KB963027-IE7\spuninst\updspapi.dll + 2009-04-16 18:17 . 2008-07-08 13:02 231288 c:\windows\ie7updates\KB963027-IE7\spuninst\spuninst.exe + 2009-04-16 18:17 . 2008-12-20 22:15 102912 c:\windows\ie7updates\KB963027-IE7\occache.dll + 2009-04-16 18:17 . 2008-12-20 22:15 671232 c:\windows\ie7updates\KB963027-IE7\mstime.dll + 2009-04-16 18:17 . 2008-12-20 22:15 193024 c:\windows\ie7updates\KB963027-IE7\msrating.dll + 2009-04-16 18:17 . 2008-12-20 22:15 477696 c:\windows\ie7updates\KB963027-IE7\mshtmled.dll + 2009-04-16 18:17 . 2008-12-20 22:15 459264 c:\windows\ie7updates\KB963027-IE7\msfeeds.dll + 2009-04-16 18:17 . 2008-12-19 04:25 634024 c:\windows\ie7updates\KB963027-IE7\iexplore.exe + 2009-04-16 18:17 . 2008-12-20 22:15 267776 c:\windows\ie7updates\KB963027-IE7\iertutil.dll + 2009-04-16 18:17 . 2008-12-20 22:15 384512 c:\windows\ie7updates\KB963027-IE7\iedkcs32.dll + 2009-04-16 18:17 . 2008-12-20 22:15 383488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dll + 2009-04-16 18:17 . 2008-12-19 04:23 161792 c:\windows\ie7updates\KB963027-IE7\ieakui.dll + 2009-04-16 18:17 . 2008-12-20 22:15 230400 c:\windows\ie7updates\KB963027-IE7\ieaksie.dll + 2009-04-16 18:17 . 2008-12-20 22:15 153088 c:\windows\ie7updates\KB963027-IE7\ieakeng.dll + 2009-04-16 18:17 . 2008-12-20 22:15 133120 c:\windows\ie7updates\KB963027-IE7\extmgr.dll + 2009-04-16 18:17 . 2008-12-20 22:15 214528 c:\windows\ie7updates\KB963027-IE7\dxtrans.dll + 2009-04-16 18:17 . 2008-12-20 22:15 347136 c:\windows\ie7updates\KB963027-IE7\dxtmsft.dll + 2009-04-16 18:17 . 2008-12-20 22:15 124928 c:\windows\ie7updates\KB963027-IE7\advpack.dll + 2009-04-16 18:06 . 2009-02-15 23:10 1648520 c:\windows\system32\ZoneLabs\vsruledb.dll + 2009-04-16 18:06 . 2009-02-15 23:10 2402184 c:\windows\system32\ZoneLabs\vsmon.exe + 2009-04-16 18:06 . 2008-11-17 01:23 1512928 c:\windows\system32\ZoneLabs\srescan.dll + 2009-04-16 18:06 . 2009-02-15 23:10 1536392 c:\windows\system32\ZoneLabs\lib\zpy.zip.dll + 2006-01-09 10:02 . 2009-02-20 18:09 1160192 c:\windows\system32\dllcache\urlmon.dll - 2006-01-09 10:02 . 2008-12-20 22:15 1160192 c:\windows\system32\dllcache\urlmon.dll + 2008-05-07 05:12 . 2008-12-20 22:14 1288192 c:\windows\system32\dllcache\quartz.dll - 2008-05-07 05:12 . 2008-05-07 05:12 1288192 c:\windows\system32\dllcache\quartz.dll + 2006-01-31 18:59 . 2009-02-20 18:09 3595264 c:\windows\system32\dllcache\mshtml.dll + 2007-06-27 14:34 . 2009-02-20 18:09 6066176 c:\windows\system32\dllcache\ieframe.dll - 2007-04-17 09:32 . 2007-04-17 09:32 2455488 c:\windows\system32\dllcache\ieapfltr.dat + 2007-04-17 09:32 . 2008-07-09 14:25 2455488 c:\windows\system32\dllcache\ieapfltr.dat + 2009-04-16 18:17 . 2008-12-20 22:15 1160192 c:\windows\ie7updates\KB963027-IE7\urlmon.dll + 2009-04-16 18:17 . 2009-01-16 20:35 3594752 c:\windows\ie7updates\KB963027-IE7\mshtml.dll + 2009-04-16 18:17 . 2008-12-20 22:15 6066688 c:\windows\ie7updates\KB963027-IE7\ieframe.dll + 2009-04-16 18:17 . 2007-04-17 09:32 2455488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dat + 2009-04-16 18:06 . 2008-12-15 00:11 10465257 c:\windows\system32\ZoneLabs\zlasdbup.dat + 2009-04-16 18:06 . 2008-12-15 00:11 10465257 c:\windows\system32\ZoneLabs\spyware.dat + 2007-01-12 20:48 . 2009-04-06 14:57 24921544 c:\windows\system32\MRT.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-10-16 17:22 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-21 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056] "ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-10-12 26112] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-12 98304] "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256] "Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632] "AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-25 590848] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_08\bin\jusched.exe" [2006-07-26 49263] "lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720] "EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304] "FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816] "LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-04-11 1168264] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-26 219136] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-21 68856] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2006-5-24 156784] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\AOL 9.0\\waol.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= R2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2008-07-09 26488] R3 NdisFilt;OSA NdisFilter Protocol;c:\windows\system32\Drivers\NdisFilt.sys [2005-09-13 4392] S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-16 464264] S2 EpmPsd;Acer EPM Power Scheme Driver;c:\windows\system32\drivers\epm-psd.sys [2006-01-23 4096] S2 EpmShd;Acer EPM System Hardware Driver;c:\windows\system32\drivers\epm-shd.sys [2006-01-23 78208] S2 OsaFsLoc;OsaFsLoc;c:\windows\system32\drivers\OsaFsLoc.sys [2005-10-15 12106] S2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-06-30 7296] S2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-01-14 4010] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920] --- Other Services/Drivers In Memory --- *NewlyCreated* - INT15.SYS *NewlyCreated* - VSMON *Deregistered* - mchInjDrv . - - - - ORPHANS REMOVED - - - - BHO-{4AFC04A3-B551-4B68-9BEB-8677D90150D9} - c:\windows\system32\wincontrol.dll . ------- Supplementary Scan ------- . uStart Page = hxxp://google.co.uk/ mStart Page = hxxp://www.google.com uInternet Connection Wizard,ShellNext = hxxp://manutd.com/ IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?b3821fff552d4f33a0bf1714cf911810 IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?b3821fff552d4f33a0bf1714cf911810 DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Jamie Pemberton\Application Data\Mozilla\Firefox\Profiles\iz4d4x4i.default\ FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPJPI150_08.dll FF - plugin: c:\program files\Java\jre1.5.0_08\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-16 20:41 Windows 5.1.2600 Service Pack 3 FAT NTAPI detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2009-04-16 20:42 ComboFix-quarantined-files.txt 2009-04-16 19:42 ComboFix2.txt 2009-04-16 17:19 Pre-Run: 36,072,488,960 bytes free Post-Run: 36,085,071,872 bytes free 470 --- E O F --- 2009-04-16 18:18 Last edited by chemist; 04-16-2009 at 02:08 PM. |
|
|
|
|
04-16-2009, 02:14 PM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hello again, thecrimson. Thanks for submitting the file. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I noticed you have Ask Toolbar installed. Please read this and decide if you want to keep it >> http://www.benedelman.org/spyware/ask-toolbars/ You can uninstall it via Add or Remove Programs in your Control Panel. If you decide to uninstall it, please delete the following Folder if it still exists: C:\Program Files\AskBarDis ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: cmd /c rd /s /q "c:\program files\Common Files\Uninstal" A DOS window will open and close again, this is normal. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
04-16-2009, 05:42 PM
|
#11 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Hello again, thecrimson. System Volume Information is where Windows keeps system restore points. Those will get deleted when we uninstall ComboFix.
You have several infected mp3 files. Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-2559368-Rare Recording.wma" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-1932750-Wicked Remix (love).wma" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-3545425-iglu hartley.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-1932750-Wicked Remix (girl).wma" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-5745425-iglu hartley.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-4183160-03 Track 3.wma" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-2368521-iglu hartley 192kb.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-3545425-sound and vision bowie.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-3545425-hey ma james.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\Incomplete\Preview-T-3545425-monstermash.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\My Music\Top of Charts - 2004 (become).wma" "C:\Documents and Settings\Jamie Pemberton\My Documents\My Music\iglu hartley.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\My Music\sound and vision bowie.mp3" "C:\Documents and Settings\Jamie Pemberton\My Documents\install_utorrent.exe" ) do ( del /a/f/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this:  Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ Quote:
------------------------------------------------------ |
|
|
|
|
|
04-18-2009, 07:22 AM
|
#12 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: Securityhelpcenter.com (Trojans/worms etc)
OK chemist, i ran the fix.bat and it just said "deleted successfully" and the file vanished from the desktop after i pressed a key.
I will let my dad have the laptop back today and let you know if anything happens in the meantime as soon as you come back to me with the final instructions i will go through them thanks |
|
|
|
|
04-18-2009, 08:25 AM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,600
OS: XP SP3
|
Re: Securityhelpcenter.com (Trojans/worms etc)
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable AVG before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. Please re-enable TeaTimer:
You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
