backdoor help

julzy · 07-12-2005, 03:18 AM

hi guys and girls
i've got probs with my pc and i'm hoping you can help. mcafee picked up two backdoor trojans a while back and couldn't clean them. don't ask me what they were as i wasn't wise enough to take note although GH or GW QHOST was one and the other was darksky, although i'm not %100 sure. since then i haven't been able to click on links as all that happens is an empty window comes up. sometimes i can c&p the link into it. also my pc won't do a windows update, the download box comes up but that's it. when i click cancel, explorer crashes. mcafee is corrupted so i've wiped it off, i've only got avg at the moment which i know is crap but it will have to do for now. i ran hijack this and i'm hoping someone will pick out something that's not right in it, i'm running win98. thanks for reading this thread.
Logfile of HijackThis v1.99.1
Scan saved at 10:10:42 PM, on 7/12/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

sUBs · 07-12-2005, 06:35 AM

Your log appears clean.

Please do an online scan at Kaspersky. Take note the names and locations of any file it detects but fails to clean.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Then post the results of the scan here.

julzy · 07-12-2005, 06:21 PM

it won't bring the link up to run the scan. i right clicked on it to copy and paste the link but it wouldn't do that either (copy option was unavailable). any other suggestions?

skate_punk_21 · 07-12-2005, 07:31 PM

Lets try a different Approach shall we

Please empty any Quarantine folder in your antivirus programs and purge all recovery items in the Spybot program (if you use it) before running this tool.
Download the Mwav Virus Checker (Use Link 3)

1.Boot Into Safe Mode
Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

2. Double click the Mwav.exe file. This is a stand alone tool and NOT just a virus checker......so it won't install anything.
3. Put a check next to the below items before scanning:

Memory
Startup Folders
Drive - All Local Drives
Folder - then click "browse" to change the directory to C: (default is C:\Windows)
Registry
System Folders
Services
Include Sub-Directory
Scan All Files

4. Select all local drives, scan all files, and press SCAN. When it is completed, anything found will be displayed in the lower pane.
5. In the Virus Log Information Pane......
Left click and highlight all the information in the Lower pane --- Use &CTRL C &on your keyboard to copy everything found in the lower pane and save it to a notepad file
*Note* If prompted that a virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning. We are not going to use this to remove anything...but to ID the bad files.

Once you copy that to a Notepad file...highlight the text and copy it here.

julzy · 07-12-2005, 07:38 PM

thanks i'll just give it a try now.

sUBs · 07-12-2005, 08:43 PM

Quote:

Originally Posted by julzy

it won't bring the link up to run the scan. i right clicked on it to copy and paste the link but it wouldn't do that either (copy option was unavailable). any other suggestions?

Just wondering..did you fill in the form required by Kaspersky?

julzy · 07-13-2005, 12:04 AM

yeah i did, it tried to bring up the link but it only brings up the outside window

julzy · 07-13-2005, 12:07 AM

ok i did it, unfortunately it crashed the first time round, but it picked up 6 viruses. heres the info you asked for:
Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKCR\McScIndx.McSecurityIndex.1" refers to invalid object "{9ECF572B-8638-4FEB-BBAC-D6A9631B4D98}". Action Taken: No Action Taken.
Entry "HKCR\McScIndx.McSecurityIndex" refers to invalid object "{9ECF572B-8638-4FEB-BBAC-D6A9631B4D98}". Action Taken: No Action Taken.
Entry "HKCR\McSubMgr.McSubMgr.1" refers to invalid object "{9BE8D7B2-329C-442A-A4AC-ABA9D7572602}". Action Taken: No Action Taken.
Entry "HKCR\McSubMgr.McSubMgr" refers to invalid object "{9BE8D7B2-329C-442A-A4AC-ABA9D7572602}". Action Taken: No Action Taken.
Entry "HKCR\McAfee.com.MCVSScan.1" refers to invalid object "{B793DE5F-29C9-440c-A9E2-4644145DDD3D}". Action Taken: No Action Taken.
Entry "HKCR\McAfee.com.MCVSQTColl.1" refers to invalid object "{7DC23152-6B5E-4A65-B42E-AE5AC4199577}". Action Taken: No Action Taken.
Entry "HKCR\EDisk2.MgEdisk.1" refers to invalid object "{340A0150-9DC7-11D3-9A01-005004677EF4}". Action Taken: No Action Taken.
Entry "HKCR\EDisk2.MgEdisk" refers to invalid object "{340A0150-9DC7-11D3-9A01-005004677EF4}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSProperties.1" refers to invalid object "{510C5313-D85C-4307-95FB-AC87A2D3743F}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSProperties" refers to invalid object "{510C5313-D85C-4307-95FB-AC87A2D3743F}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSPropNotify.1" refers to invalid object "{55F94612-19DD-4C2E-9E1F-E26624933DAD}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSPropNotify" refers to invalid object "{55F94612-19DD-4C2E-9E1F-E26624933DAD}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSUpdate.1" refers to invalid object "{6950611A-E2CF-421f-88C3-61C27A3832C5}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.MCVSUpdate" refers to invalid object "{6950611A-E2CF-421f-88C3-61C27A3832C5}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.VSOInfoObject.1" refers to invalid object "{1BCD38AE-A539-40D6-B448-04F20D47433F}". Action Taken: No Action Taken.
Entry "HKCR\Vsoupd.VSOInfoObject" refers to invalid object "{1BCD38AE-A539-40D6-B448-04F20D47433F}". Action Taken: No Action Taken.
Entry "HKCR\Mccomctl.McDrives.1" refers to invalid object "{28E74E8D-7B99-4486-AE32-11B67F93B54B}". Action Taken: No Action Taken.
Entry "HKCR\Mccomctl.McDrives" refers to invalid object "{28E74E8D-7B99-4486-AE32-11B67F93B54B}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListView.1" refers to invalid object "{B02F4EEB-78D3-414D-8814-7E88F4828C28}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListView" refers to invalid object "{B02F4EEB-78D3-414D-8814-7E88F4828C28}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItem.1" refers to invalid object "{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItem" refers to invalid object "{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItems.1" refers to invalid object "{3ED232B4-0346-4A74-A883-B85B69ADA6A4}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItems" refers to invalid object "{3ED232B4-0346-4A74-A883-B85B69ADA6A4}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ColumnHeader.1" refers to invalid object "{C657669A-754D-4E13-BB96-B7269F2078F0}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ColumnHeader" refers to invalid object "{C657669A-754D-4E13-BB96-B7269F2078F0}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ColumnHeaders.1" refers to invalid object "{BF4C25B5-CD0A-4770-B2F5-750A4407957F}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ColumnHeaders" refers to invalid object "{BF4C25B5-CD0A-4770-B2F5-750A4407957F}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItemsEnum.1" refers to invalid object "{78D0C657-22F0-4E19-A34A-757B14A30344}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.ListItemsEnum" refers to invalid object "{78D0C657-22F0-4E19-A34A-757B14A30344}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.CheckedItems.1" refers to invalid object "{0025F2F6-5458-478E-997C-76BBB056B3D6}". Action Taken: No Action Taken.
Entry "HKCR\McComCtlLib.CheckedItems" refers to invalid object "{0025F2F6-5458-478E-997C-76BBB056B3D6}". Action Taken: No Action Taken.
Entry "HKCR\McVsShl.VSCContextMenu.1" refers to invalid object "{CFC7205E-2792-4378-9591-3879CC6C9022}". Action Taken: No Action Taken.
Entry "HKCR\McVsShl.VSCContextMenu" refers to invalid object "{CFC7205E-2792-4378-9591-3879CC6C9022}". Action Taken: No Action Taken.
Entry "HKCR\McVsShl.VSCDeskBand.1" refers to invalid object "{BA52B914-B692-46c4-B683-905236F6F655}". Action Taken: No Action Taken.
Entry "HKCR\McVsShl.VSCDeskBand" refers to invalid object "{BA52B914-B692-46c4-B683-905236F6F655}". Action Taken: No Action Taken.
Entry "HKCR\McAfee.Agent.PingObj" refers to invalid object "{A30C94ED-ED1D-4cd9-931B-032481FED884}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbSkin.1" refers to invalid object "{3D5D83B0-47DC-4862-93D6-3E827A14AED1}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbSkin" refers to invalid object "{3D5D83B0-47DC-4862-93D6-3E827A14AED1}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbButtonX.1" refers to invalid object "{B448FAA5-DC36-4C3D-9436-67021CDECA82}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbButtonX" refers to invalid object "{B448FAA5-DC36-4C3D-9436-67021CDECA82}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbImage.1" refers to invalid object "{E4528244-55B0-4FBC-B27E-26851B634D02}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbImage" refers to invalid object "{E4528244-55B0-4FBC-B27E-26851B634D02}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbImgX.1" refers to invalid object "{E7EEC168-A4C4-42C6-8601-B02816959B24}". Action Taken: No Action Taken.
Entry "HKCR\YbSkin.YbImgX" refers to invalid object "{E7EEC168-A4C4-42C6-8601-B02816959B24}". Action Taken: No Action Taken.
Entry "HKCR\YbSkinSelect.SkinSelector.1" refers to invalid object "{2018C303-E3F2-4455-AA1A-773F84F10902}". Action Taken: No Action Taken.
Entry "HKCR\YbSkinSelect.SkinSelector" refers to invalid object "{2018C303-E3F2-4455-AA1A-773F84F10902}". Action Taken: No Action Taken.
Entry "HKCR\YAlertCenter.YAlert.1" refers to invalid object "{97D85205-80CF-4b71-90A5-D220DA4FEE58}". Action Taken: No Action Taken.
Entry "HKCR\YAlertCenter.YAlert" refers to invalid object "{97D85205-80CF-4b71-90A5-D220DA4FEE58}". Action Taken: No Action Taken.
Entry "HKCR\KewlButtonz.KewlButtons" refers to invalid object "{D4BBE4C0-BD72-4A33-817C-2E7E16DE20BC}". Action Taken: No Action Taken.
Entry "HKCR\DOWNLOADMANAGER.IEDownloadManager" refers to invalid object "{FEC76531-D69B-448D-840F-AD7865DD9F7B}". Action Taken: No Action Taken.
Entry "HKCR\InetCtls.Inet" refers to invalid object "{48E59293-9880-11CF-9754-00AA00C00908}". Action Taken: No Action Taken.
Entry "HKCR\InetCtls.Inet.1" refers to invalid object "{48E59293-9880-11CF-9754-00AA00C00908}". Action Taken: No Action Taken.
Entry "HKCR\Yahoo.MessengerCompanionControl.3" refers to invalid object "{977046B0-A87F-11d5-8FEA-FFFFFF000000}". Action Taken: No Action Taken.
File C:\WINDOWS\COMMAND\EBD\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.
File C:\RECYCLED\DC45\Installs\ymsgr7us.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.File C:\Program Files\Online Services\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\ICQ\UNWISE32.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

julzy · 07-13-2005, 12:07 AM

bloody hell i hope you get all that and don't fall asleep reading it lol

sUBs · 07-13-2005, 12:14 AM

It's 3pm where I am. Not gonna fall asleep that easy.

Mwav didnt find anything noteworthy. Just orphaned reg entries & some legit files.

Your system does not appear to be infected. But if you're game, we can do another online scan at Trend Micro

julzy · 07-13-2005, 01:22 AM

lol your not an australian are you??? are you sure there was nothing in it as alexa and altnet is spyware isn't it? i know before mcafee was corrupted beyond use it told me it picked them up. i'll run the other scan anyway, you can't be too careful ay. do i do it in safe mode again?

julzy · 07-13-2005, 01:23 AM

never mind lol it's an online one, DUH!!!

julzy · 07-13-2005, 01:26 AM

it won't work either, what ever is in this shitbox is prevent these scans from happening, the mwav one only worked because i downloaded it into the system. i've tried to use panda as well and it won't start either. i can c & p some links into the empty window but when it comes to activating online scan it won't work.

sUBs · 07-13-2005, 01:44 AM

Please check that Internet explorer's security setting aren't set too high. These scans require the download of ActiveX controls. Your browser may be prohibiting this.

Alternately, you may download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).

Save it to your desktop.
Double-click the new icon on your desktop (tmas-web-scan.exe)
It will say "Loading TrendMicro definitions".
Once the definitions are loaded, the program will appear to close then re-open.
Click "Start Scan"
After it's done scanning, click "Scan Results"
Make sure all items found have a check next to them, then click "Clean Threats Now".
Click Exit.

Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here.

julzy · 07-13-2005, 02:05 AM

cheers, i'm downloading it now

julzy · 07-13-2005, 06:24 PM

sorry it's taken so long, okay i downloaded it, it wouldn't load because i didn't have MDAC. so i ran that and it's now saying '(odcs driver manager) data source name not found and no default driver specified Error 0x80004005.

julzy · 07-13-2005, 06:39 PM

heh heh getting sick of this yet? i'm ready to climb onto the roof with it and chuck it off.

sUBs · 07-13-2005, 11:07 PM

Visit Microsoft's Internet Explorer home page (www.microsoft.com/windows/ie) to download the latest version of IE. That may fix your problem with Panda.

julzy · 07-14-2005, 05:51 PM

okay i'm doing that now. thank you for your help so far

julzy · 07-14-2005, 06:18 PM

nope that didn't work either. i can't take it back to version 5 either as that just keeps crashing, i've tried that one before.

07-12-2005, 03:18 AM	#1 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	backdoor help hi guys and girls i've got probs with my pc and i'm hoping you can help. mcafee picked up two backdoor trojans a while back and couldn't clean them. don't ask me what they were as i wasn't wise enough to take note although GH or GW QHOST was one and the other was darksky, although i'm not %100 sure. since then i haven't been able to click on links as all that happens is an empty window comes up. sometimes i can c&p the link into it. also my pc won't do a windows update, the download box comes up but that's it. when i click cancel, explorer crashes. mcafee is corrupted so i've wiped it off, i've only got avg at the moment which i know is crap but it will have to do for now. i ran hijack this and i'm hoping someone will pick out something that's not right in it, i'm running win98. thanks for reading this thread. Logfile of HijackThis v1.99.1 Scan saved at 10:10:42 PM, on 7/12/05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\EN-US\MSNAPPAU.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

07-12-2005, 06:35 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,265 OS: N/A	Your log appears clean. Please do an online scan at Kaspersky. Take note the names and locations of any file it detects but fails to clean. * Turn off the real time scanner of any existing antivirus program while performing the online scan Then post the results of the scan here. __________________

07-12-2005, 07:31 PM	#4 (permalink)
skate_punk_21 1337 C0D3R Join Date: Mar 2005 Location: Canada Posts: 1,457 OS: Server 2K3/XP Pro/XP MCE/Win 98/Ubuntu Linux/BackTrack 2 My System	Lets try a different Approach shall we *Please empty any Quarantine folder in your antivirus programs and purge all recovery items in the Spybot program (if you use it) before running this tool.* Download the Mwav Virus Checker (Use Link 3) 1.Boot Into Safe Mode Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears). 2. Double click the Mwav.exe file. This is a stand alone tool and NOT just a virus checker......so it won't install anything. 3. Put a check next to the below items before scanning: Memory Startup Folders Drive - All Local Drives Folder - then click "browse" to change the directory to C: (default is C:\Windows) Registry System Folders Services Include Sub-Directory Scan All Files 4. Select all local drives, scan all files, and press SCAN. When it is completed, anything found will be displayed in the lower pane. 5. In the Virus Log Information Pane...... Left click and highlight all the information in the Lower pane --- Use &CTRL C &on your keyboard to copy everything found in the lower pane and save it to a notepad file Note If prompted that a virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning. We are not going to use this to remove anything...but to ID the bad files. Once you copy that to a Notepad file...highlight the text and copy it here. __________________ Have I Helped you? Please Consider a Donation to TechSupportForums

07-13-2005, 12:14 AM	#10 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,265 OS: N/A	It's 3pm where I am. Not gonna fall asleep that easy. Mwav didnt find anything noteworthy. Just orphaned reg entries & some legit files. Your system does not appear to be infected. But if you're game, we can do another online scan at Trend Micro __________________ Last edited by sUBs; 07-13-2005 at 12:16 AM.

07-13-2005, 01:44 AM	#14 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,265 OS: N/A	Please check that Internet explorer's security setting aren't set too high. These scans require the download of ActiveX controls. Your browser may be prohibiting this. Alternately, you may download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button). Save it to your desktop. Double-click the new icon on your desktop (tmas-web-scan.exe) It will say "Loading TrendMicro definitions". Once the definitions are loaded, the program will appear to close then re-open. Click "Start Scan" After it's done scanning, click "Scan Results" Make sure all items found have a check next to them, then click "Clean Threats Now". Click Exit. Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here. __________________ Last edited by sUBs; 07-13-2005 at 01:46 AM.

07-12-2005, 06:21 PM	#3 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	it won't bring the link up to run the scan. i right clicked on it to copy and paste the link but it wouldn't do that either (copy option was unavailable). any other suggestions?

07-12-2005, 07:38 PM	#5 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	thanks i'll just give it a try now.

07-13-2005, 12:04 AM	#7 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	yeah i did, it tried to bring up the link but it only brings up the outside window

07-13-2005, 12:07 AM	#8 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	ok i did it, unfortunately it crashed the first time round, but it picked up 6 viruses. heres the info you asked for: Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKCR\McScIndx.McSecurityIndex.1" refers to invalid object "{9ECF572B-8638-4FEB-BBAC-D6A9631B4D98}". Action Taken: No Action Taken. Entry "HKCR\McScIndx.McSecurityIndex" refers to invalid object "{9ECF572B-8638-4FEB-BBAC-D6A9631B4D98}". Action Taken: No Action Taken. Entry "HKCR\McSubMgr.McSubMgr.1" refers to invalid object "{9BE8D7B2-329C-442A-A4AC-ABA9D7572602}". Action Taken: No Action Taken. Entry "HKCR\McSubMgr.McSubMgr" refers to invalid object "{9BE8D7B2-329C-442A-A4AC-ABA9D7572602}". Action Taken: No Action Taken. Entry "HKCR\McAfee.com.MCVSScan.1" refers to invalid object "{B793DE5F-29C9-440c-A9E2-4644145DDD3D}". Action Taken: No Action Taken. Entry "HKCR\McAfee.com.MCVSQTColl.1" refers to invalid object "{7DC23152-6B5E-4A65-B42E-AE5AC4199577}". Action Taken: No Action Taken. Entry "HKCR\EDisk2.MgEdisk.1" refers to invalid object "{340A0150-9DC7-11D3-9A01-005004677EF4}". Action Taken: No Action Taken. Entry "HKCR\EDisk2.MgEdisk" refers to invalid object "{340A0150-9DC7-11D3-9A01-005004677EF4}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSProperties.1" refers to invalid object "{510C5313-D85C-4307-95FB-AC87A2D3743F}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSProperties" refers to invalid object "{510C5313-D85C-4307-95FB-AC87A2D3743F}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSPropNotify.1" refers to invalid object "{55F94612-19DD-4C2E-9E1F-E26624933DAD}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSPropNotify" refers to invalid object "{55F94612-19DD-4C2E-9E1F-E26624933DAD}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSUpdate.1" refers to invalid object "{6950611A-E2CF-421f-88C3-61C27A3832C5}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.MCVSUpdate" refers to invalid object "{6950611A-E2CF-421f-88C3-61C27A3832C5}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.VSOInfoObject.1" refers to invalid object "{1BCD38AE-A539-40D6-B448-04F20D47433F}". Action Taken: No Action Taken. Entry "HKCR\Vsoupd.VSOInfoObject" refers to invalid object "{1BCD38AE-A539-40D6-B448-04F20D47433F}". Action Taken: No Action Taken. Entry "HKCR\Mccomctl.McDrives.1" refers to invalid object "{28E74E8D-7B99-4486-AE32-11B67F93B54B}". Action Taken: No Action Taken. Entry "HKCR\Mccomctl.McDrives" refers to invalid object "{28E74E8D-7B99-4486-AE32-11B67F93B54B}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListView.1" refers to invalid object "{B02F4EEB-78D3-414D-8814-7E88F4828C28}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListView" refers to invalid object "{B02F4EEB-78D3-414D-8814-7E88F4828C28}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItem.1" refers to invalid object "{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItem" refers to invalid object "{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItems.1" refers to invalid object "{3ED232B4-0346-4A74-A883-B85B69ADA6A4}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItems" refers to invalid object "{3ED232B4-0346-4A74-A883-B85B69ADA6A4}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ColumnHeader.1" refers to invalid object "{C657669A-754D-4E13-BB96-B7269F2078F0}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ColumnHeader" refers to invalid object "{C657669A-754D-4E13-BB96-B7269F2078F0}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ColumnHeaders.1" refers to invalid object "{BF4C25B5-CD0A-4770-B2F5-750A4407957F}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ColumnHeaders" refers to invalid object "{BF4C25B5-CD0A-4770-B2F5-750A4407957F}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItemsEnum.1" refers to invalid object "{78D0C657-22F0-4E19-A34A-757B14A30344}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.ListItemsEnum" refers to invalid object "{78D0C657-22F0-4E19-A34A-757B14A30344}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.CheckedItems.1" refers to invalid object "{0025F2F6-5458-478E-997C-76BBB056B3D6}". Action Taken: No Action Taken. Entry "HKCR\McComCtlLib.CheckedItems" refers to invalid object "{0025F2F6-5458-478E-997C-76BBB056B3D6}". Action Taken: No Action Taken. Entry "HKCR\McVsShl.VSCContextMenu.1" refers to invalid object "{CFC7205E-2792-4378-9591-3879CC6C9022}". Action Taken: No Action Taken. Entry "HKCR\McVsShl.VSCContextMenu" refers to invalid object "{CFC7205E-2792-4378-9591-3879CC6C9022}". Action Taken: No Action Taken. Entry "HKCR\McVsShl.VSCDeskBand.1" refers to invalid object "{BA52B914-B692-46c4-B683-905236F6F655}". Action Taken: No Action Taken. Entry "HKCR\McVsShl.VSCDeskBand" refers to invalid object "{BA52B914-B692-46c4-B683-905236F6F655}". Action Taken: No Action Taken. Entry "HKCR\McAfee.Agent.PingObj" refers to invalid object "{A30C94ED-ED1D-4cd9-931B-032481FED884}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbSkin.1" refers to invalid object "{3D5D83B0-47DC-4862-93D6-3E827A14AED1}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbSkin" refers to invalid object "{3D5D83B0-47DC-4862-93D6-3E827A14AED1}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbButtonX.1" refers to invalid object "{B448FAA5-DC36-4C3D-9436-67021CDECA82}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbButtonX" refers to invalid object "{B448FAA5-DC36-4C3D-9436-67021CDECA82}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbImage.1" refers to invalid object "{E4528244-55B0-4FBC-B27E-26851B634D02}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbImage" refers to invalid object "{E4528244-55B0-4FBC-B27E-26851B634D02}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbImgX.1" refers to invalid object "{E7EEC168-A4C4-42C6-8601-B02816959B24}". Action Taken: No Action Taken. Entry "HKCR\YbSkin.YbImgX" refers to invalid object "{E7EEC168-A4C4-42C6-8601-B02816959B24}". Action Taken: No Action Taken. Entry "HKCR\YbSkinSelect.SkinSelector.1" refers to invalid object "{2018C303-E3F2-4455-AA1A-773F84F10902}". Action Taken: No Action Taken. Entry "HKCR\YbSkinSelect.SkinSelector" refers to invalid object "{2018C303-E3F2-4455-AA1A-773F84F10902}". Action Taken: No Action Taken. Entry "HKCR\YAlertCenter.YAlert.1" refers to invalid object "{97D85205-80CF-4b71-90A5-D220DA4FEE58}". Action Taken: No Action Taken. Entry "HKCR\YAlertCenter.YAlert" refers to invalid object "{97D85205-80CF-4b71-90A5-D220DA4FEE58}". Action Taken: No Action Taken. Entry "HKCR\KewlButtonz.KewlButtons" refers to invalid object "{D4BBE4C0-BD72-4A33-817C-2E7E16DE20BC}". Action Taken: No Action Taken. Entry "HKCR\DOWNLOADMANAGER.IEDownloadManager" refers to invalid object "{FEC76531-D69B-448D-840F-AD7865DD9F7B}". Action Taken: No Action Taken. Entry "HKCR\InetCtls.Inet" refers to invalid object "{48E59293-9880-11CF-9754-00AA00C00908}". Action Taken: No Action Taken. Entry "HKCR\InetCtls.Inet.1" refers to invalid object "{48E59293-9880-11CF-9754-00AA00C00908}". Action Taken: No Action Taken. Entry "HKCR\Yahoo.MessengerCompanionControl.3" refers to invalid object "{977046B0-A87F-11d5-8FEA-FFFFFF000000}". Action Taken: No Action Taken. File C:\WINDOWS\COMMAND\EBD\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken. File C:\RECYCLED\DC45\Installs\ymsgr7us.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.File C:\Program Files\Online Services\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\ICQ\UNWISE32.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

07-13-2005, 12:07 AM	#9 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	bloody hell i hope you get all that and don't fall asleep reading it lol

07-13-2005, 01:22 AM	#11 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	lol your not an australian are you??? are you sure there was nothing in it as alexa and altnet is spyware isn't it? i know before mcafee was corrupted beyond use it told me it picked them up. i'll run the other scan anyway, you can't be too careful ay. do i do it in safe mode again?

07-13-2005, 01:23 AM	#12 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	never mind lol it's an online one, DUH!!!

07-13-2005, 01:26 AM	#13 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	it won't work either, what ever is in this shitbox is prevent these scans from happening, the mwav one only worked because i downloaded it into the system. i've tried to use panda as well and it won't start either. i can c & p some links into the empty window but when it comes to activating online scan it won't work.

07-13-2005, 02:05 AM	#15 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	cheers, i'm downloading it now

07-13-2005, 06:24 PM	#16 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	sorry it's taken so long, okay i downloaded it, it wouldn't load because i didn't have MDAC. so i ran that and it's now saying '(odcs driver manager) data source name not found and no default driver specified Error 0x80004005.

07-13-2005, 06:39 PM	#17 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	heh heh getting sick of this yet? i'm ready to climb onto the roof with it and chuck it off.

07-13-2005, 11:07 PM	#18 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,265 OS: N/A	Visit Microsoft's Internet Explorer home page (www.microsoft.com/windows/ie) to download the latest version of IE. That may fix your problem with Panda. __________________

07-14-2005, 05:51 PM	#19 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	okay i'm doing that now. thank you for your help so far

07-14-2005, 06:18 PM	#20 (permalink)
julzy Registered User Join Date: Jul 2005 Posts: 88 OS: xp	nope that didn't work either. i can't take it back to version 5 either as that just keeps crashing, i've tried that one before.