|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-20-2009, 03:02 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Multiple Trojans
The business computer at work has been really slow lately. AVG wouldn't update saying, "a .bin file is missing". I manually updated it, downloading it from another computer because FF and IE aren't working. Once updated, Firefox worked but the searches were being hijacked. It also found many trojan viruses just after it updated. Most of them I could "heal" but many I couldn't.
I ran all the scans I was supposed to, and now FF won't work. (I am now posting from a different computer.) DDS (Ver_09-05-14.01) - NTFSx86 Run by Owner at 11:23:27.40 on Sat 06/20/2009 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.134 [GMT -4:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\WINDOWS\system32\svchost.exe -k podmena C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\wanmpsvc.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\USB Storage RW\udsi.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\HP\KBD\KBD.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\AOL\1219342603\ee\AOLSoftware.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\MSMSGS.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\AOL 9.1\waol.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\AOL 9.1\shellmon.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://att.yahoo.com uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://us8.hpwis.com/ uDefault_Search_URL = hxxp://srch-us8.hpwis.com/ uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://att.yahoo.com mDefault_Search_URL = hxxp://www.google.com/ie mSearch Page = hxxp://srch-us8.hpwis.com/ mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://srch-us8.hpwis.com/ uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton antivirus\NavShExt.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: hp toolkit: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\hp\explorebar\HPTOOLKT.DLL TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton antivirus\NavShExt.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: hp toolkit: {8f4902b6-6c04-4ade-8052-aa58578a21bd} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [MSMSGS] "c:\program files\messenger\MSMSGS.EXE" /background uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [KYE_UDSI] "c:\program files\usb storage rw\udsi.exe mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\unload\hpqcmon.exe mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [WT GameChannel] c:\program files\wildtangent\apps\GameChannel.exe mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect mRun: [NAV CfgWiz] c:\progra~1\norton~1\Cfgwiz.exe /R mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [ccRegVfy] "c:\program files\common files\symantec shared\ccRegVfy.exe" mRun: [Reminder] "c:\windows\creator\Remind_XP.exe" mRun: [PS2] c:\windows\system32\ps2.exe mRun: [HostManager] c:\program files\common files\aol\1219342603\ee\AOLSoftware.exe mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [sysldtray] c:\windows\ld09.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\owner\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.4\program\quickstart.exe StartupFolder: c:\docume~1\owner\startm~1\programs\startup\spamsu~1.lnk - c:\program files\intermute\spamsubtract\SpamSubtract.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\137903\program\BackWeb-137903.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll LSP: SpSubLSP.dll DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - c:\program files\yahoo!\common\yucconfig.dll DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxsrvc.dll Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\ozd2toum.default\ FF - prefs.js: browser.startup.homepage - www.chaubreigardens.com FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-27 325896] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-27 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-8-27 108552] R1 podmenadrv;podmenadrv;\??\c:\program files\podmena\podmena.sys --> c:\program files\podmena\podmena.sys [?] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-27 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-27 298776] R2 podmena;podmena;c:\windows\system32\svchost.exe -k podmena [2005-4-27 14336] R2 SAVRTPEL;SAVRTPEL;c:\windows\system32\drivers\Savrtpel.sys [2002-7-26 34992] R3 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2002-11-14 317128] S3 ccPwdSvc;Symantec Password Validation Service;c:\program files\common files\symantec shared\ccPwdSvc.exe [2002-11-15 100032] S3 navapsvc;Norton AntiVirus Auto Protect Service;c:\program files\norton antivirus\Navapsvc.exe [2002-11-15 116336] S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20021202.005\NAVENG.SYS [2003-4-10 66816] S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20021202.005\NAVEX15.SYS [2003-4-10 518464] S3 SAVRT;SAVRT;c:\windows\system32\drivers\savrt.sys [2002-7-26 235184] =============== Created Last 30 ================ 2009-06-20 10:50 2 ----h--- c:\windows\ro122689.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122621.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122592.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122597.dat 2009-06-09 11:50 <DIR> --d----- c:\program files\podmena 2009-06-09 11:50 2 ----h--- c:\windows\ro122458.dat 2009-06-09 11:50 2 ----h--- c:\windows\ro122390.dat 2009-06-09 11:50 2 ----h--- c:\windows\ro122361.dat 2009-06-09 11:50 2 ----h--- c:\windows\ro122366.dat 2009-06-09 11:49 15,360 ----h--- c:\windows\ld09.exe 2009-06-07 11:42 <DIR> --d----- c:\windows\system32\wbem\Repository ==================== Find3M ==================== 2009-05-11 09:22 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-05-11 09:22 325,896 a------- c:\windows\system32\drivers\avgldx86.sys 2009-05-11 09:22 108,552 a------- c:\windows\system32\drivers\avgtdix.sys 2009-04-17 11:27 116,836 ac------ c:\windows\hpoins11.dat 2009-02-01 16:57 49,152 -c------ c:\documents and settings\owner\PNPrint3.exe 2003-04-10 07:19 32 a--sh--- c:\windows\{FC92DEF6-B98A-462F-BDEC-6F8042F11C76}.dat 2003-04-10 07:19 32 a--sh--- c:\windows\system32\{9E165BF4-5E4A-49D1-BA74-00B57060829D}.dat ============= FINISH: 11:24:05.31 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-05-2009, 04:41 AM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Multiple Trojans
Hello and welcome to TSF
Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please post a fresh DDS.txt Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. |
|
|
|
|
07-08-2009, 05:14 PM
|
#4 (permalink) | |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
Quote:
|
|
|
|
|
|
07-12-2009, 12:02 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
DDS (Ver_09-06-26.01) - NTFSx86
Run by Owner at 13:59:39.43 on Sun 07/12/2009 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.194 [GMT -4:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\wanmpsvc.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\windows\system\hpsysdrv.exe C:\Program Files\USB Storage RW\udsi.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\HP\KBD\KBD.EXE C:\Program Files\Common Files\AOL\1219342603\ee\AOLSoftware.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Messenger\MSMSGS.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\wt\updater\wcmdmgr.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe C:\WINDOWS\system32\rundll32.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\AOL 9.1\waol.exe C:\Program Files\AOL 9.1\shellmon.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://att.yahoo.com/ uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://us8.hpwis.com/ uDefault_Search_URL = hxxp://srch-us8.hpwis.com/ uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://att.yahoo.com mDefault_Search_URL = hxxp://www.google.com/ie mSearch Page = hxxp://srch-us8.hpwis.com/ mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://srch-us8.hpwis.com/ uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: hp toolkit: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\hp\explorebar\HPTOOLKT.DLL TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: hp toolkit: {8f4902b6-6c04-4ade-8052-aa58578a21bd} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [MSMSGS] "c:\program files\messenger\MSMSGS.EXE" /background uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [KYE_UDSI] "c:\program files\usb storage rw\udsi.exe mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\unload\hpqcmon.exe mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [WT GameChannel] c:\program files\wildtangent\apps\GameChannel.exe mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect mRun: [Reminder] "c:\windows\creator\Remind_XP.exe" mRun: [PS2] c:\windows\system32\ps2.exe mRun: [HostManager] c:\program files\common files\aol\1219342603\ee\AOLSoftware.exe mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [wcmdmgr] c:\windows\wt\updater\wcmdmgrl.exe -launch StartupFolder: c:\docume~1\owner\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.4\program\quickstart.exe StartupFolder: c:\docume~1\owner\startm~1\programs\startup\spamsu~1.lnk - c:\program files\intermute\spamsubtract\SpamSubtract.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\137903\program\BackWeb-137903.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll LSP: SpSubLSP.dll DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - c:\program files\yahoo!\common\yucconfig.dll DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxsrvc.dll Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\ozd2toum.default\ FF - prefs.js: browser.startup.homepage - www.chaubreigardens.com FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-27 325896] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-27 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-8-27 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-27 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-27 298776] S1 podmenadrv;podmenadrv;\??\c:\program files\podmena\podmena.sys --> c:\program files\podmena\podmena.sys [?] S2 podmena;podmena;c:\windows\system32\svchost.exe -k podmena [2005-4-27 14336] =============== Created Last 30 ================ 2009-07-12 13:49 120,448 a----r-- c:\windows\system32\drivers\RT2500.sys 2009-07-11 13:51 45,056 a------- c:\windows\system32\wtcpl.cpl 2009-07-11 13:50 <DIR> --d----- c:\windows\wt 2009-06-20 10:50 2 ----h--- c:\windows\ro122689.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122621.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122592.dat 2009-06-20 10:50 2 ----h--- c:\windows\ro122597.dat ==================== Find3M ==================== 2009-05-11 09:22 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll 2009-04-29 00:46 666,624 a------- c:\windows\system32\wininet.dll 2009-04-29 00:46 81,920 -------- c:\windows\system32\ieencode.dll 2009-04-17 11:27 116,836 ac------ c:\windows\hpoins11.dat 2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys 2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll 2009-02-01 16:57 49,152 -c------ c:\documents and settings\owner\PNPrint3.exe ============= FINISH: 14:00:08.93 =============== |
|
|
|
|
07-12-2009, 02:40 PM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Multiple Trojans
Hello again
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. Link 1 Link 2 Link 3   * IMPORTANT !!! Place combofix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes, to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. |
|
|
|
|
07-17-2009, 02:46 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
Sorry it is taking me so long, I go to school in Ohio during the week and work in Michigan on weekend. I can only work on it at work.
ComboFix 09-07-14.08 - Owner 07/16/2009 23:32.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.177 [GMT -4:00] Running from: c:\documents and settings\Owner\Desktop\business computer\virus removal\Combo-Fix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\Owner\LOCALS~1\Temp\IadHide4.dll c:\documents and settings\Owner\Local Settings\Temp\IadHide4.dll c:\program files\podmena c:\windows\ro122361.dat c:\windows\ro122366.dat c:\windows\ro122390.dat c:\windows\ro122458.dat c:\windows\ro122592.dat c:\windows\ro122597.dat c:\windows\ro122621.dat c:\windows\ro122689.dat c:\windows\system32\iAlmcoin.dll D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PODMENA -------\Legacy_PODMENADRV -------\Service_podmena -------\Service_podmenadrv ((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 ))))))))))))))))))))))))))))))) . 2009-07-14 21:10 . 2009-07-16 14:50 -------- d-----w- c:\documents and settings\Owner\Application Data\HPAppData 2009-07-14 21:10 . 2009-07-14 21:10 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo! 2009-07-14 21:10 . 2009-07-14 21:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-07-14 17:55 . 2009-07-14 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG 2009-07-14 17:44 . 2009-07-14 17:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard 2009-07-14 17:44 . 2007-10-20 22:25 118272 ----a-w- c:\windows\system32\hpz3l5mu.dll 2009-07-14 17:43 . 2007-10-30 09:25 372736 ----a-r- c:\windows\system32\hppldcoi.dll 2009-07-14 17:43 . 2007-10-30 09:25 309760 ----a-r- c:\windows\system32\difxapi.dll 2009-07-14 17:43 . 2007-10-21 16:45 729088 ----a-r- c:\windows\system32\hpowiax7.dll 2009-07-14 17:43 . 2007-10-21 16:45 581632 ----a-r- c:\windows\system32\hpotscl6.dll 2009-07-14 17:43 . 2007-10-21 16:45 303104 ----a-r- c:\windows\system32\hpovst15.dll 2009-07-14 16:56 . 2009-07-14 18:04 157440 ----a-w- c:\windows\hpoins28.dat 2009-07-14 16:56 . 2007-12-13 00:01 932 ------w- c:\windows\hpomdl28.dat 2009-07-12 17:49 . 2004-04-22 05:09 120448 ----a-r- c:\windows\system32\drivers\RT2500.sys 2009-07-11 17:50 . 2009-07-17 03:41 -------- d-----w- c:\windows\wt 2009-06-28 20:57 . 2009-06-28 20:57 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13\lzma.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-17 03:41 . 2008-09-03 17:43 -------- d-----w- c:\documents and settings\Owner\Application Data\OpenOffice.org2 2009-07-16 18:34 . 2008-09-03 17:44 1 ----a-w- c:\documents and settings\Owner\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2009-07-14 17:41 . 2009-03-09 15:26 -------- d-----w- c:\program files\Yahoo! 2009-07-13 12:31 . 2008-08-27 17:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-13 12:31 . 2008-08-27 17:21 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-13 12:31 . 2008-08-27 17:21 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-12 14:28 . 2008-08-21 17:32 -------- d-----w- c:\program files\America Online 8.0 2009-07-09 02:24 . 2003-04-10 11:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-07-09 02:24 . 2003-04-10 11:18 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-09 02:23 . 2003-04-10 11:18 -------- d-----w- c:\program files\Symantec 2009-07-09 02:20 . 2008-08-21 22:12 48952 -c--a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-28 20:58 . 2008-09-03 17:31 -------- d-----w- c:\program files\Java 2009-06-25 22:56 . 2008-08-27 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-06-16 14:36 . 2005-04-28 02:12 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2005-04-28 01:05 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-03 19:09 . 2005-08-30 13:14 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-11 13:22 . 2008-08-27 17:21 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-07 15:32 . 2005-04-28 02:12 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:46 . 2006-06-23 15:33 666624 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:46 . 2004-08-04 07:56 81920 ------w- c:\windows\system32\ieencode.dll 2009-07-16 21:40 . 2008-08-21 18:25 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-08 39408] "AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2008-06-03 50528] "NVIEW"="nview.dll" - c:\windows\system32\nview.dll [2003-03-03 831557] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-12 114688] "KYE_UDSI"="c:\program files\USB Storage RW\udsi.exe" [2003-02-22 212992] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-22 69632] "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-18 69632] "KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440] "StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-04-10 151597] "WT GameChannel"="c:\program files\WildTangent\Apps\GameChannel.exe" [2002-12-04 184800] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-03 4595712] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-03-18 331776] "PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920] "HostManager"="c:\program files\Common Files\AOL\1219342603\ee\AOLSoftware.exe" [2008-06-24 41824] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-13 1948440] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "wcmdmgr"="c:\windows\wt\updater\wcmdmgrl.exe" [2002-09-27 20480] "hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-03-03 323584] "AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344] c:\documents and settings\Owner\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216] spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSubtract.exe [2003-4-10 552960] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe [2003-4-10 16384] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina] 2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-07-13 12:31 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8085:TCP"= 8085:TCP:podmena R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/27/2008 1:21 PM 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/27/2008 1:21 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/27/2008 1:21 PM 906520] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/27/2008 1:21 PM 298776] --- Other Services/Drivers In Memory --- *NewlyCreated* - ATWPKT2 *Deregistered* - ATWPKT2 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2009-07-14 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://att.yahoo.com/ uSearch Page = hxxp://www.google.com uDefault_Search_URL = hxxp://srch-us8.hpwis.com/ uSearch Bar = hxxp://www.google.com/ie mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://srch-us8.hpwis.com/ uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s LSP: SpSubLSP.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ozd2toum.default\ FF - prefs.js: browser.startup.homepage - www.chaubreigardens.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-16 23:42 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(784) c:\program files\Softex\OmniPass\opxpgina.dll - - - - - - - > 'lsass.exe'(840) c:\windows\system32\SpSubLSP.dll - - - - - - - > 'explorer.exe'(3492) c:\windows\system32\nView.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\AOL\acs\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\program files\Softex\OmniPass\omniServ.exe c:\windows\wanmpsvc.exe c:\program files\Softex\OmniPass\OPXPApp.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe c:\windows\wt\updater\wcmdmgr.exe c:\windows\system32\rundll32.exe c:\program files\AOL 9.1\waol.exe c:\program files\OpenOffice.org 2.4\program\soffice.exe c:\program files\OpenOffice.org 2.4\program\soffice.bin c:\program files\AOL 9.1\shellmon.exe c:\windows\system32\wscntfy.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe . ************************************************************************** . Completion time: 2009-07-17 23:47 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-17 03:47 Pre-Run: 56,819,798,016 bytes free Post-Run: 58,427,117,568 bytes free 232 --- E O F --- 2009-07-16 00:55 |
|
|
|
|
07-17-2009, 03:07 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Multiple Trojans
Hello again
Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. ========= You log indicate the presence of Norton antivirus 2003, please download and run the Norton Removal Tool ========= Click > Start > Control Panel > Add or Remove Programs and uninstall the following programs : Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here WildTangent GameChannel<---(Optional)Wild Tangent is a video game software company specializing in online games. It has even made a partnership with AOL to include itself as part of the AOL Instant Messenger for their AIM games section. The WildTangent Web Driver is their technology that allows you to play 3D games over the Internet. Although its not technically considered spyware it does have built in components to update itself and gather information about the computer system including * Operating System Version * CPU Type and Speed * Memory Amount * Video Card type and Driver Version * Sound Card type and Driver Version * DirectX Version * Location that the Web Driver was installed from ============ Open notepad and copy/paste the text in the quotebox below into it: Code:
DirLook:: c:\windows\wt Folder:: c:\Program Files\LimeWire Registry:: [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\LimeWire\\LimeWire.exe"=- [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8085:TCP"=- DDS:: uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local FF - prefs.js: browser.startup.homepage - www.chaubreigardens.com  Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
========= Download ATF-Cleaner by Atribune to your desktop. Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ========= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
This animation will guide you through the process:  To optimize scanning time and produce a more sensible report for review:
========= Logs Required C:\Combofix.txt Kaspersky Scan Report An update on how your system is running. |
|
|
|
|
07-19-2009, 02:41 PM
|
#11 (permalink) | ||
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
When I try to run Kaspersky, a window pops up with this message...
Quote:
Quote:
Last edited by chadsmeltzer; 07-19-2009 at 02:42 PM. |
||
|
|
|
|
07-19-2009, 04:09 PM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Multiple Trojans
Hi
Clear your Java cache and try again. http://fxtrade.oanda.com/support/tro...ar_cache.shtml If problem persists, try this scanner instead. ESET Online Scanner Go here to run an online scannner from ESET.
Last edited by TheBruce1; 07-19-2009 at 04:11 PM. |
|
|
|
|
07-24-2009, 04:27 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
The computer seems to be running better. One thing I forgot to mention before was that it computer occasionally freezes up. If you hit Ctrl Alt Del the screen will flash black and then Task Manager opens the computer will return to normal. It will sometimes do this once or twice a minute, then not do it again for hours. It has done this for a while, at least a few months. Sometimes it will freeze for a couple seconds and flash black on its own, fixing the problem. When it freezes up, you can still move the mouse, and whatever you click while its frozen will open after the screen flashes black. Other then that, I don't notice anything odd.
ComboFix 09-07-14.08 - Owner 07/17/2009 19:31.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.216 [GMT -4:00] Running from: c:\documents and settings\Owner\Desktop\business computer\virus removal\Combo-Fix.exe Command switches used :: c:\documents and settings\Owner\Desktop\business computer\virus removal\cfscript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\Owner\LOCALS~1\Temp\IadHide4.dll c:\documents and settings\Owner\Local Settings\Temp\IadHide4.dll c:\program files\LimeWire c:\program files\LimeWire\lib\aopalliance.jar c:\program files\LimeWire\lib\clink.jar c:\program files\LimeWire\lib\commons-codec-1.3.jar c:\program files\LimeWire\lib\commons-logging.jar c:\program files\LimeWire\lib\commons-net.jar c:\program files\LimeWire\lib\daap.jar c:\program files\LimeWire\lib\dnsjava.jar c:\program files\LimeWire\lib\forms.jar c:\program files\LimeWire\lib\foxtrot.jar c:\program files\LimeWire\lib\gettext-commons.jar c:\program files\LimeWire\lib\guice-1.0.jar c:\program files\LimeWire\lib\hsqldb.jar c:\program files\LimeWire\lib\httpclient-4.0-alpha5-20080522.192134-5.jar c:\program files\LimeWire\lib\httpcore-4.0-beta2-20080510.140437-10.jar c:\program files\LimeWire\lib\httpcore-nio-4.0-beta2-20080510.140437-10.jar c:\program files\LimeWire\lib\icu4j.jar c:\program files\LimeWire\lib\jaudiotagger.jar c:\program files\LimeWire\lib\jcraft.jar c:\program files\LimeWire\lib\jdic.dll c:\program files\LimeWire\lib\jdic.jar c:\program files\LimeWire\lib\jdic_stub.jar c:\program files\LimeWire\lib\jflac.jar c:\program files\LimeWire\lib\jl.jar c:\program files\LimeWire\lib\jmdns.jar c:\program files\LimeWire\lib\jogg.jar c:\program files\LimeWire\lib\jorbis.jar c:\program files\LimeWire\lib\LimeWire.jar c:\program files\LimeWire\lib\log4j.jar c:\program files\LimeWire\lib\looks.jar c:\program files\LimeWire\lib\messages.jar c:\program files\LimeWire\lib\mp3spi.jar c:\program files\LimeWire\lib\onion-common.jar c:\program files\LimeWire\lib\onion-fec.jar c:\program files\LimeWire\lib\ProgressTabs.jar c:\program files\LimeWire\lib\swt.jar c:\program files\LimeWire\lib\SystemUtilities.dll c:\program files\LimeWire\lib\themes.jar c:\program files\LimeWire\lib\tray.dll c:\program files\LimeWire\lib\tritonus.jar c:\program files\LimeWire\lib\vorbisspi.jar c:\program files\LimeWire\LimeWire.exe . ((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 ))))))))))))))))))))))))))))))) . 2009-07-17 23:18 . 2009-07-17 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-07-17 14:23 . 2009-07-17 14:23 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\HP 2009-07-14 21:10 . 2009-07-17 23:26 -------- d-----w- c:\documents and settings\Owner\Application Data\HPAppData 2009-07-14 21:10 . 2009-07-14 21:10 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo! 2009-07-14 21:10 . 2009-07-14 21:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-07-14 17:55 . 2009-07-14 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG 2009-07-14 17:44 . 2009-07-14 17:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard 2009-07-14 17:44 . 2007-10-20 22:25 118272 ----a-w- c:\windows\system32\hpz3l5mu.dll 2009-07-14 17:43 . 2007-10-30 09:25 372736 ----a-r- c:\windows\system32\hppldcoi.dll 2009-07-14 17:43 . 2007-10-30 09:25 309760 ----a-r- c:\windows\system32\difxapi.dll 2009-07-14 17:43 . 2007-10-21 16:45 729088 ----a-r- c:\windows\system32\hpowiax7.dll 2009-07-14 17:43 . 2007-10-21 16:45 581632 ----a-r- c:\windows\system32\hpotscl6.dll 2009-07-14 17:43 . 2007-10-21 16:45 303104 ----a-r- c:\windows\system32\hpovst15.dll 2009-07-14 16:56 . 2009-07-14 18:04 157440 ----a-w- c:\windows\hpoins28.dat 2009-07-14 16:56 . 2007-12-13 00:01 932 ------w- c:\windows\hpomdl28.dat 2009-07-12 17:49 . 2004-04-22 05:09 120448 ----a-r- c:\windows\system32\drivers\RT2500.sys 2009-07-11 17:50 . 2009-07-17 23:40 -------- d-----w- c:\windows\wt 2009-06-28 20:57 . 2009-06-28 20:57 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13\lzma.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-17 23:40 . 2008-09-03 17:43 -------- d-----w- c:\documents and settings\Owner\Application Data\OpenOffice.org2 2009-07-17 23:20 . 2008-08-21 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-07-17 12:47 . 2008-09-03 17:44 1 ----a-w- c:\documents and settings\Owner\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2009-07-14 17:41 . 2009-03-09 15:26 -------- d-----w- c:\program files\Yahoo! 2009-07-13 12:31 . 2008-08-27 17:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-13 12:31 . 2008-08-27 17:21 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-13 12:31 . 2008-08-27 17:21 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-12 14:28 . 2008-08-21 17:32 -------- d-----w- c:\program files\America Online 8.0 2009-07-09 02:20 . 2008-08-21 22:12 48952 -c--a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-28 20:58 . 2008-09-03 17:31 -------- d-----w- c:\program files\Java 2009-06-25 22:56 . 2008-08-27 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-06-16 14:36 . 2005-04-28 02:12 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2005-04-28 01:05 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-03 19:09 . 2005-08-30 13:14 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-11 13:22 . 2008-08-27 17:21 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-07 15:32 . 2005-04-28 02:12 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:46 . 2006-06-23 15:33 666624 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:46 . 2004-08-04 07:56 81920 ------w- c:\windows\system32\ieencode.dll 2009-07-16 21:40 . 2008-08-21 18:25 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\windows\wt ---- 2009-07-12 14:24 . 2009-07-17 23:26 82280 ----a-w- c:\windows\wt\updater\wtlog.txt 2009-07-12 14:24 . 2009-07-15 00:01 98325 ----a-w- c:\windows\wt\updater\wtlog2.txt 2009-07-11 17:51 . 2009-07-11 17:52 35 ----a-w- c:\windows\wt\webdriver\export.dat 2009-07-11 17:51 . 2009-07-17 23:29 835 ----a-w- c:\windows\wt\wtupdates\wtupdater\appinfo.dat 2009-07-11 17:51 . 2009-07-11 17:51 2088 ----a-w- c:\windows\wt\updater\data.wts 2009-07-11 17:51 . 2002-05-07 23:39 55 ----a-w- c:\windows\wt\info.txt 2009-07-11 17:51 . 2002-05-07 23:39 24 ----a-w- c:\windows\wt\updater\stopwcmdr.bat 2009-07-11 17:51 . 2002-05-07 23:39 4072 ----a-w- c:\windows\wt\updater\_privacy.txt 2009-07-11 17:51 . 2002-05-07 23:39 30 ----a-w- c:\windows\wt\updater\updatenow.bat 2009-07-11 17:51 . 2002-09-27 18:47 32768 ----a-w- c:\windows\wt\updater\wtisa.dll 2009-07-11 17:51 . 2003-02-06 07:16 40960 ----a-w- c:\windows\wt\wtgutils\wtgutils.dll 2009-07-11 17:51 . 2003-02-06 07:16 6030 ----a-w- c:\windows\wt\wtgutils\wtgutils.jar 2009-07-11 17:51 . 2002-11-25 23:39 49152 ----a-w- c:\windows\wt\webdriver\wtdmmpv.dll 2009-07-11 17:51 . 2002-11-25 20:43 32768 ----a-w- c:\windows\wt\webdriver\wtdmmp.dll 2009-07-11 17:51 . 2002-10-30 17:37 3497 ----a-w- c:\windows\wt\webdriver\wtdmmpi.jar 2009-07-11 17:51 . 2003-02-04 21:19 18 ----a-w- c:\windows\wt\data.wts 2009-07-11 17:51 . 2003-02-04 21:19 59 ----a-w- c:\windows\wt\webdriver.dll 2009-07-11 17:51 . 2003-02-04 21:19 59 ----a-w- c:\windows\wt\wt3d.dll 2009-07-11 17:51 . 2003-01-15 20:29 98304 ----a-w- c:\windows\wt\webdriver\sound.dll 2009-07-11 17:51 . 2002-06-06 14:17 87 ----a-w- c:\windows\wt\webdriver\wtwmplug.ini 2009-07-11 17:51 . 2003-01-15 20:26 53248 ----a-w- c:\windows\wt\wtvh.dll 2009-07-11 17:51 . 2003-01-15 20:26 53248 ----a-w- c:\windows\wt\webdriver\wtwmplug.ax 2009-07-11 17:51 . 2003-01-15 19:58 18306 ----a-w- c:\windows\wt\webdriver\wtmulti.jar 2009-07-11 17:51 . 2003-01-15 19:57 73728 ----a-w- c:\windows\wt\webdriver\wtmulti.dll 2009-07-11 17:51 . 2003-01-15 20:39 57344 ----a-w- c:\windows\wt\webdriver\wthostctl.dll 2009-07-11 17:51 . 2003-01-15 20:39 61440 ----a-w- c:\windows\wt\webdriver\wthost.exe 2009-07-11 17:51 . 2003-01-15 20:38 129319 ----a-w- c:\windows\wt\webdriver\wildtangent.jar 2009-07-11 17:50 . 2009-07-11 17:50 251 ----a-w- c:\windows\wt\wt3d.ini 2009-07-11 17:50 . 2003-01-15 20:37 712704 ----a-w- c:\windows\wt\webdriver\webdriver.dll 2009-07-11 17:50 . 2003-01-15 20:28 708608 ----a-w- c:\windows\wt\webdriver\wdengine.dll 2009-07-11 17:50 . 2003-01-15 20:38 159744 ----a-w- c:\windows\wt\webdriver\rdriver.dll 2009-07-11 17:50 . 2003-01-15 19:47 3528 ----a-w- c:\windows\wt\webdriver\wdcaps.ded 2009-07-11 17:50 . 2003-01-15 20:30 147456 ----a-w- c:\windows\wt\webdriver\objectbundle.dll 2009-07-11 17:50 . 2003-01-15 20:30 61440 ----a-w- c:\windows\wt\webdriver\dx7drv.dll 2009-07-11 17:50 . 2003-01-15 20:31 40960 ----a-w- c:\windows\wt\webdriver\dx5drv.dll 2009-07-11 17:50 . 2003-01-15 20:32 98304 ----a-w- c:\windows\wt\webdriver\actorobject.dll 2009-07-11 17:50 . 2002-09-27 18:47 20480 ----a-w- c:\windows\wt\updater\wcmdmgrl.exe 2009-07-11 17:50 . 2002-09-27 18:47 143360 ----a-w- c:\windows\wt\updater\wcmdmgr.exe 2009-07-11 17:50 . 2009-07-17 23:28 2529 ----a-w- c:\windows\wt\updater\wt.ini 2003-02-04 21:19 . 2003-02-04 21:19 18 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\legacy\data.wts 2003-02-04 21:19 . 2003-02-04 21:19 59 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\legacy\webdriver.dll 2003-02-04 21:19 . 2003-02-04 21:19 59 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\legacy\wt3d.dll 2003-02-04 21:19 . 2003-02-04 21:19 3806 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\update_info\data.wts 2003-02-04 21:19 . 2003-02-04 21:19 691 ----a-w- c:\windows\wt\wtupdates\wtdmmp\update_info\data.wts 2003-01-15 20:39 . 2003-01-15 20:39 57344 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wthostctl.dll 2003-01-15 20:39 . 2003-01-15 20:39 61440 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wthost.exe 2003-01-15 20:39 . 2003-01-15 20:39 36864 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\npwthost.dll 2003-01-15 20:39 . 2003-01-15 20:39 337 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\nsiwthostplugin.xpt 2003-01-15 20:39 . 2003-01-15 20:39 2083 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wthost.jar 2003-01-15 20:38 . 2003-01-15 20:38 159744 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\rdriver.dll 2003-01-15 20:38 . 2003-01-15 20:38 129319 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wildtangent.jar 2003-01-15 20:37 . 2003-01-15 20:37 712704 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\webdriver.dll 2003-01-15 20:32 . 2003-01-15 20:32 98304 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\actorobject.dll 2003-01-15 20:31 . 2003-01-15 20:31 40960 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\dx5drv.dll 2003-01-15 20:30 . 2003-01-15 20:30 61440 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\dx7drv.dll 2003-01-15 20:30 . 2003-01-15 20:30 147456 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\objectbundle.dll 2003-01-15 20:29 . 2003-01-15 20:29 98304 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\sound.dll 2003-01-15 20:28 . 2003-01-15 20:28 708608 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wdengine.dll 2003-01-15 20:26 . 2003-01-15 20:26 53248 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wtvh.dll 2003-01-15 20:26 . 2003-01-15 20:26 53248 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wtwmplug.ax 2003-01-15 19:58 . 2003-01-15 19:58 18306 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wtmulti.jar 2003-01-15 19:57 . 2003-01-15 19:57 73728 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wtmulti.dll 2003-01-15 19:47 . 2003-01-15 19:47 3528 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wdcaps.ded 2002-11-25 23:39 . 2002-11-25 23:39 49152 ----a-w- c:\windows\wt\wtupdates\wtdmmp\files\3.0.0.004\wtdmmpv.dll 2002-11-25 20:43 . 2002-11-25 20:43 32768 ----a-w- c:\windows\wt\wtupdates\wtdmmp\files\3.0.0.004\wtdmmp.dll 2002-10-30 17:37 . 2002-10-30 17:37 3497 ----a-w- c:\windows\wt\wtupdates\wtdmmp\files\3.0.0.004\wtdmmpi.jar 2002-09-27 18:47 . 2002-09-27 18:47 32768 ----a-w- c:\windows\wt\backup\1.6.0.037\wtisa.dll 2002-09-27 18:47 . 2002-09-27 18:47 20480 ----a-w- c:\windows\wt\backup\1.6.0.037\wcmdmgrl.exe 2002-09-27 18:47 . 2002-09-27 18:47 143360 ----a-w- c:\windows\wt\backup\1.6.0.037\wcmdmgr.exe 2002-09-27 18:47 . 2002-09-27 18:47 45056 ----a-w- c:\windows\wt\backup\1.6.0.037\wtcpl.cpl 2002-07-08 18:48 . 2002-07-08 18:48 32768 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\npwtplug.dll 2002-06-06 14:17 . 2002-06-06 14:17 87 ----a-w- c:\windows\wt\wtupdates\wtwebdriver\files\3.2.0.007\wtwmplug.ini 2002-05-07 23:39 . 2002-05-07 23:39 24 ----a-w- c:\windows\wt\backup\1.6.0.037\stopwcmdr.bat 2002-05-07 23:39 . 2002-05-07 23:39 30 ----a-w- c:\windows\wt\backup\1.6.0.037\updatenow.bat 2002-05-07 23:39 . 2002-05-07 23:39 55 ----a-w- c:\windows\wt\backup\1.6.0.037\info.txt 2002-05-07 23:39 . 2002-05-07 23:39 4072 ----a-w- c:\windows\wt\backup\1.6.0.037\_privacy.txt 2002-04-10 20:08 . 2002-04-10 20:08 40960 ----a-w- c:\windows\wt\WDInUsePlugin.dll ((((((((((((((((((((((((((((( SnapShot@2009-07-17_03.42.30 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-17 23:39 . 2009-07-17 23:39 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat - 2009-07-17 03:40 . 2009-07-17 03:40 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-08 39408] "AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2008-06-03 50528] "NVIEW"="nview.dll" - c:\windows\system32\nview.dll [2003-03-03 831557] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-12 114688] "KYE_UDSI"="c:\program files\USB Storage RW\udsi.exe" [2003-02-22 212992] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-06-22 69632] "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-18 69632] "KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440] "StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-04-10 151597] "WT GameChannel"="c:\program files\WildTangent\Apps\GameChannel.exe" [2002-12-04 184800] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992] "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-03 4595712] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-03-18 331776] "PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920] "HostManager"="c:\program files\Common Files\AOL\1219342603\ee\AOLSoftware.exe" [2008-06-24 41824] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-13 1948440] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "wcmdmgr"="c:\windows\wt\updater\wcmdmgrl.exe" [2002-09-27 20480] "hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-03-03 323584] "AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344] c:\documents and settings\Owner\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216] spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSubtract.exe [2003-4-10 552960] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe [2003-4-10 16384] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina] 2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-07-13 12:31 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/27/2008 1:21 PM 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/27/2008 1:21 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/27/2008 1:21 PM 906520] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/27/2008 1:21 PM 298776] --- Other Services/Drivers In Memory --- *NewlyCreated* - ATWPKT2 *Deregistered* - ATWPKT2 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder 2009-07-14 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://att.yahoo.com/ uSearch Page = hxxp://www.google.com uDefault_Search_URL = hxxp://srch-us8.hpwis.com/ uSearch Bar = hxxp://www.google.com/ie mStart Page = hxxp://att.yahoo.com mSearch Bar = hxxp://srch-us8.hpwis.com/ uSearchURL,(Default) = hxxp://www.google.com/search?q=%s LSP: SpSubLSP.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ozd2toum.default\ FF - prefs.js: browser.startup.homepage - www.chaubreigardens.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-17 19:41 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(784) c:\program files\Softex\OmniPass\opxpgina.dll c:\windows\system32\COMRes.dll - - - - - - - > 'lsass.exe'(840) c:\windows\system32\SpSubLSP.dll - - - - - - - > 'explorer.exe'(3108) c:\windows\system32\nView.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\AOL\acs\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\program files\Softex\OmniPass\omniServ.exe c:\windows\wanmpsvc.exe c:\program files\Softex\OmniPass\OPXPApp.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\wt\updater\wcmdmgr.exe c:\program files\AOL 9.1\waol.exe c:\windows\system32\rundll32.exe c:\program files\OpenOffice.org 2.4\program\soffice.exe c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe c:\program files\OpenOffice.org 2.4\program\soffice.bin c:\program files\AOL 9.1\shellmon.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\wscntfy.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe . ************************************************************************** . Completion time: 2009-07-17 19:47 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-17 23:47 ComboFix2.txt 2009-07-17 03:47 Pre-Run: 58,275,409,920 bytes free Post-Run: 58,409,631,744 bytes free 340 --- E O F --- 2009-07-16 00:55 ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=6 # IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105) # OnlineScanner.ocx=1.0.0.5886 # api_version=3.0.2 # EOSSerial=803ee1c59da0064bba8b55258a5b4975 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-07-24 10:18:49 # local_time=2009-07-24 06:18:49 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1026 37 83 100 5541797968750 # scanned=105435 # found=6 # cleaned=0 # scan_time=5902 C:\Program Files\BackWeb\BackWeb Client\6.2.3.66\Program\runner.exe probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I C:\Program Files\WildTangent\Apps\GameChannel\Games\28BA89E7-2F60-4BE7-BAA2-7949EB3FE527\WebDriverSilentInstall.exe Win32/Adware.WildTangent application 00000000000000000000000000000000 I C:\WINDOWS\wt\backup\1.6.0.037\wcmdmgrl.exe Win32/Adware.WildTangent application 00000000000000000000000000000000 I C:\WINDOWS\wt\updater\wcmdmgrl.exe Win32/Adware.WildTangent application 00000000000000000000000000000000 I ${Memory} probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I Last edited by chadsmeltzer; 07-24-2009 at 04:30 PM. |
|
|
|
|
07-25-2009, 01:25 PM
|
#15 (permalink) | |
|
Registered User
Join Date: Jan 2009
Posts: 35
OS: XP
|
Re: Multiple Trojans
Quote:
|
|
|
|
|
|
07-26-2009, 03:37 AM
|
#16 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Multiple Trojans
Hello again
Quote:
======= Delete this folder in blue: c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13 ======== Quote:
======== You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: ========= Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ========= Clear IE6 cookies *Open IE and click Tools *Click on Internet Options *Click on General Tab *Click on Delte Temp Files & Cookies buttons. Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. For Internet Explorer users: WOT for IE -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place.
------------------------------------------------------------------ The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more. It can also alert you if you have not installed the latest patches from Microsoft. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
||
|
|
|
| Thread Tools | |
|
|
