|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-20-2005, 09:49 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 43
OS: Win XP
|
Log exam please
I've had a couple of restarts with the message of "Your system has recovered from a serious error" and on occasion, Installer tries to run when I'm accessing a random website. I have run Trend micro's spyware thingy( technical term),CWShredder, AVG free edition, and ad aware with nothing found. I have also run Kaspersky online scan, cleanup and ewido and HJT and the following are the results of those scans. I have also noticed smss.exe and crss.exe in My running processes if that helps any. Here are the logs...
Logfile of HijackThis v1.99.1 Scan saved at 9:48:17 PM, on 11/20/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\cisvc.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\PREVX\Prevx Home\PXAgent.exe C:\Program Files\AWS\WeatherBug\Weather.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\cidaemon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Avant Browser\avant.exe C:\WINDOWS\SYSTEM32\notepad.exe C:\Program Files\hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Open With JPEGCompress - res://C:\Program Files\JPEGCompress\owjc.dll/CONTEXT_HANDLE.HTM O8 - Extra context menu item: RoboForm Toolbar &R - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar &R - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU) O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} - http://www.uproar.com//applets/activ...side_web18.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1130512418095 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole...rcadeRdxIE.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab O16 - DPF: {E4DFABBD-F5F6-11D3-8421-0080C6F79C42} (SpeechControl Class) - http://www.directxtras.com/speaksfor...eechplugin.cab O16 - DPF: {F76DF680-EC17-4272-B1C7-CDB2641FA20B} (KB836528 Object) - http://microsoft.com/security/controls/DoomChk.CAB O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Prevx Agent (PrevxAgent) - Prevx Ltd. - C:\Program Files\PREVX\Prevx Home\PXAgent.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2003\Tmntsrv.exe (file missing) O23 - Service: Trend Micro Proxy Service (tmproxy) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe (file missing) --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 4:21:04 PM, 11/20/2005 + Report-Checksum: 366DAF28 + Scan result: C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.RiskWare.Downloader.PopCap.a : Cleaned with backup C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@com[1].txt -> Spyware.Cookie.Com : Cleaned with backup C:\WINDOWS\SYSTEM32\msprxcore.dll -> Spyware.MediaBack : Cleaned with backup C:\WINDOWS\SYSTEM32\qnklcot.dll -> Spyware.WurldMedia : Cleaned with backup C:\WINDOWS\tool.exe -> Trojan.LowZones.y : Cleaned with backup ::Report End CleanUp! started on 11/20/05 18:28:02. ... http://by107fd.bay107.hotmail.msn.co..._1021000204.js - deleted http://www.liutilities.com/graphics/titlebkg.gif - deleted http://www.liutilities.com/products/...xes/WT5PRO.JPG - deleted http://www.processlibrary.com/graphics/rgb.gif - deleted http://www.intermute.com/new_images/...pport_blue.gif - deleted http://www.intermute.com/new_images/...mpany_blue.gif - deleted http://www.techsupportforum.com/cwd/images/toplogin.jpg - deleted http://www.techsupportforum.com/cwd/...ient_thead.gif - deleted http://www.ameeshia.com/simple/Theme...ages/blank.gif - deleted http://www.ameeshia.com/simple/Theme...h/register.gif - deleted http://www.aimoo.com/Avatar_Shop/ima...lico_light.gif - deleted http://by107fd.bay107.hotmail.msn.co...__10210002F.js - deleted http://login.passport.net/pp320/CSS/...x=3.200.4104.0 - deleted http://gfx1.hotmail.com/i.p.writenew.gif - deleted http://www.intermute.com/new_images/...lue_arrow3.gif - deleted http://hp.msn.com/c/hotmail/fin.jpg - deleted http://gfx1.hotmail.com/crs_918.gif - deleted http://www.google.com/nav_page.gif - deleted http://www.processlibrary.com/graphics/RESULTL.GIF - deleted http://www.trendmicro.com/global/en/...n-security.gif - deleted http://www.trendmicro.com/spyware-scan/ - deleted http://www.ameeshia.com/memberpages/chloe/header.jpg - deleted http://www.techsupportforum.com/cwd/.../topsearch.jpg - deleted http://www.ameeshia.com/simple/Theme...sh/newsbox.gif - deleted http://www.ameeshia.com/simple/Theme...lish/login.gif - deleted http://www.aimoo.com/forum/images/sponsor/diamond.gif - deleted http://gfx1.hotmail.com/i.p.putinfolder.gif - deleted http://www.google.com/favicon.ico - deleted http://www.aimoo.com/Avatar_Shop/ima...read-plain.gif - deleted http://www.liutilities.com/products/...aphics/AW9.GIF - deleted http://a248.e.akamai.net/f/248/5462/...ssLibPopup.gif - deleted http://wdcs.trendmicro.com/dcs.gif?d...9%20MST%202005 - deleted http://www.greyknight17.com/navigation/custom.js - deleted http://login.passport.net/pp320/imag...x=3.200.4104.0 - deleted http://gfx1.hotmail.com/spacer.gif - deleted http://www.liutilities.com/products/...slibrary/crss/ - deleted http://www.liutilities.com/products/...ics/WUGNET.GIF - deleted http://www.processlibrary.com/scripts/newsletter.js - deleted http://www.aimoo.com/Avatar_Shop/ima.../favorites.gif - deleted http://gfx1.hotmail.com/i.F42AB.gif - deleted http://www.processlibrary.com/graphics/SEARCHP3.GIF - deleted http://login.passport.net/pp320/JS/P...x=3.200.4104.0 - deleted http://www.aimoo.com/Avatar_Shop/ima.../moderator.gif - deleted http://www.liutilities.com/products/...cs/ORDERL1.GIF - deleted http://www.intermute.com/new_images/...cts_yellow.gif - deleted http://hpc.msn.com/css/hotmail/default.css?v=2 - deleted http://www.ameeshia.com/simple/Theme...es/chatnow.gif - deleted http://www.ameeshia.com/simple/Theme...s/upshrink.gif - deleted http://gfx1.hotmail.com/i.p.white.b.gif - deleted http://gfx1.hotmail.com/i.F469D.gif - deleted http://www.liutilities.com/products/...ocess=crss.exe - deleted http://www.liutilities.com/products/...aphics/AW2.GIF - deleted http://www.techsupportforum.com/cwd/...tons/quote.gif - deleted http://gfx1.hotmail.com/tab.separator.on.r.gif - deleted http://www.processlibrary.com/graphics/titlebkg.gif - deleted http://www.intermute.com/new_images/trend/spy_glass.gif - deleted http://www.trendmicro.com/global/com...ages/carat.gif - deleted http://www.aimoo.com/forum/images/fo...ges/spacer.gif - deleted http://www.ameeshia.com/simple/Themes/default/fader.js - deleted http://www.techsupportforum.com/cwd/...er_offline.gif - deleted http://www.liutilities.com/graphics/arrow5.gif - deleted http://www.intermute.com/new_images/...eftnav/top.gif - deleted http://assets.bravenet.com/cp/announce.gif - deleted http://gfx1.hotmail.com/i.p.folder.inbox.gif - deleted http://www.liutilities.com/products/...phics/cnet.gif - deleted http://www.processlibrary.com/antivi...al-Plus-en.jpg - deleted http://www.trendmicro.com/global/en/js/footer.js - deleted http://www.greyknight17.com/navigation/sniffer.js - deleted http://gfx1.hotmail.com/i.p.delete.gif - deleted http://gfx1.hotmail.com/i.264D14.gif - deleted http://www.processlibrary.com/directory/files/crss/ - deleted http://www.intermute.com/new_images/...lue_arrow2.gif - deleted http://www.liutilities.com/products/...aphics/AW8.GIF - deleted http://www.greyknight17.com/spy/CWShredder.exe - deleted http://www.trendmicro.com/global/common/images/px.gif - deleted http://media.trendmicro.com/product/...re-product.swf - deleted http://www.trendmicro.com/global/com...bg-product.gif - deleted http://assets.bravenet.com/cp/bn-announce.gif - deleted http://www.liutilities.com/graphics/rgl.gif - deleted http://gfx1.hotmail.com/tab.bg.dln.gif - deleted http://www.liutilities.com/products/graphics/W5.GIF - deleted http://www.liutilities.com/graphics/ROM2.GIF - deleted http://www.intermute.com/new_images/...v/products.gif - deleted http://www.trendmicro.com/global/en/...n-products.gif - deleted http://www.ameeshia.com/simple/Theme...s/calendar.gif - deleted http://www.ameeshia.com/simple/Theme...id-xhtml10.gif - deleted http://www.techsupportforum.com/cwd/.../bottom_bg.gif - deleted http://www.liutilities.com/products/...hics/CORN1.GIF - deleted http://www.trendmicro.com/global/com...icon-email.gif - deleted http://www.trendmicro.com/NR/rdonlyr...wnloadanim.gif - deleted http://gfx1.hotmail.com/i.p.attach.gif - deleted http://www.liutilities.com/products/...s/ARROW1-2.GIF - deleted http://www.liutilities.com/products/...phics/AW10.GIF - deleted http://www.processlibrary.com/antivirus/ - deleted http://www.trendmicro.com/global/en/js/dcsav.js - deleted http://gfx1.hotmail.com/i.p.arr.left.gif - deleted http://gfx1.hotmail.com/i.p.importance.h.gif - deleted http://www.liutilities.com/graphics/title.gif - deleted http://www.processlibrary.com/graphics/bkgg.gif - deleted http://www.trendmicro.com/global/en/js/scripts.js - deleted http://www.trendmicro.com/global/en/...eader-logo.gif - deleted http://www.trendmicro.com/global/com...g-dotted-h.gif - deleted http://www.greyknight17.com/navigation/style.js - deleted http://www.ameeshia.com/simple/Theme...ges/box_bg.gif - deleted http://by107fd.bay107.hotmail.msn.co...1000000002.css - deleted http://gfx1.hotmail.com/i.p.search.gif - deleted http://www.liutilities.com/graphics/rot.gif - deleted http://www.trendmicro.com/global/com...g-dotted-v.gif - deleted http://www.techsupportforum.com/cwd/images/topfaq.jpg - deleted http://www.ameeshia.com/memberpages/chloe/88logo.gif - deleted http://www.liutilities.com/scripts/adsales/detect.js - deleted http://www.liutilities.com/products/...raphics/OS.gif - deleted http://www.processlibrary.com/graphics/DIRECT.GIF - deleted http://www.intermute.com/new_images/...dot_extend.gif - deleted http://cwshredder.net/bin/CWShredder.zip - deleted http://hp.msn.com/c/hotmail/env.jpg - deleted http://www.techsupportforum.com/cwd/...ode_hybrid.gif - deleted http://gfx1.hotmail.com/tab.bg.off.gif - deleted http://gfx1.hotmail.com/i.p.cont.group.gif - deleted http://www.liutilities.com/scripts/version.js - deleted http://www.liutilities.com/products/...aphics/IC9.GIF - deleted http://www.liutilities.com/products/graphics/BUY4.GIF - deleted http://www.ameeshia.com/simple/Theme.../valid-css.gif - deleted http://www.techsupportforum.com/imag...isitMS_new.gif - deleted http://gfx1.hotmail.com/tab.separator.off.gif - deleted http://gfx1.hotmail.com/i.p.cal.gif - deleted http://www.liutilities.com/products/...ics/ARROW1.GIF - deleted http://www.processlibrary.com/addtos...ts/search2.asp - deleted http://www.intermute.com/new_images/...blue_patch.gif - deleted http://gfx1.hotmail.com/i.p.new.gif - deleted http://gfx1.hotmail.com/i.F424A.gif - deleted http://www.liutilities.com/graphics/PLIBFEAT.GIF - deleted http://www.liutilities.com/products/...ocess=crss.exe - deleted http://www.liutilities.com/products/...phics/AW11.GIF - deleted http://www.processlibrary.com/graphics/botline.gif - deleted http://www.trendmicro.com/global/com...bg-leftnav.gif - deleted http://www.liutilities.com/products/...phics/SCR1.GIF - deleted http://www.liutilities.com/products/...ics/WT5PRO.JPG - deleted http://www.intermute.com/new_images/...tners_blue.gif - deleted http://www.trendmicro.com/global/com.../bg-topnav.gif - deleted http://www.liutilities.com/products/...s/USATODAY.GIF - deleted http://www.liutilities.com/products/...aphics/SP2.JPG - deleted http://www.liutilities.com/products/...aphics/AW6.GIF - deleted http://www.trendmicro.com/global/en/...urity-over.gif - deleted http://www.trendmicro.com/global/en/...n-purchase.gif - deleted http://www.trendmicro.com/global/en/...chase-over.gif - deleted http://www.liutilities.com/products/...cs/ORDERL2.GIF - deleted http://www.processlibrary.com/graphics/title.gif - deleted http://www.processlibrary.com/antivirus/GET.GIF - deleted http://www.intermute.com/new_images/...blue_patch.gif - deleted http://www.intermute.com/new_images/...blue_patch.gif - deleted http://www.intermute.com/favicon.ico - deleted http://www.intermute.com/new_images/.../vert_span.gif - deleted http://www.intermute.com/new_images/...ews_yellow.gif - deleted http://www.trendmicro.com/global/com...language04.gif - deleted http://www.trendmicro.com/spyware-sc...scan-step1.gif - deleted http://www.liutilities.com/products/...hics/load3.gif - deleted http://www.liutilities.com/products/...hics/30DAY.GIF - deleted http://www.intermute.com/new_images/...freetrial2.gif - deleted http://www.trendmicro.com/global/common/css/style2.css - deleted http://www.trendmicro.com/global/en/...av/tn-home.gif - deleted http://www.trendmicro.com/global/en/css/style1.css - deleted http://www.processlibrary.com/direct...smss/index.php - deleted http://www.digitalriver.com/v2.0-img...css/style4.css - deleted http://www.intermute.com/new_images/...stepup_lb5.gif - deleted http://wdcs.trendmicro.com/dcs.gif?d...2%20MST%202005 - deleted http://www.trendmicro.com/global/en/...tners-over.gif - deleted http://www.liutilities.com/products/...hics/CORN3.GIF - deleted http://www.processlibrary.com/graphics/RESULTL2.GIF - deleted http://www.trendmicro.com/global/en/...roducts-on.gif - deleted http://www.liutilities.com/products/...hics/load1.gif - deleted http://www.intermute.com/new_images/...av/stepup5.gif - deleted http://www.trendmicro.com/footer/footer.js - deleted http://www.liutilities.com/products/...aphics/re6.GIF - deleted http://www.trendmicro.com/favicon.ico - deleted http://www.trendmicro.com/global/com...n-on-right.gif - deleted http://www.liutilities.com/products/...ics/title5.gif - deleted http://www.trendmicro.com/global/com...language03.gif - deleted http://www.trendmicro.com/NR/rdonlyr...allboxshot.gif - deleted http://www.trendmicro.com/global/com...duct-px-3d.gif - deleted http://www.trendmicro.com/ftp/produc...s-web-scan.exe - deleted C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat currently in use. Will be deleted when Windows is restarted. 'Typed URLs' (Internet Explorer) - removed from the registry. Visited: Owner@http://by107fd.bay107.hotmail.msn.com/cgi-bin/HoTMaiL?a=bab465a388435868de96a83156a8476234b1425c01d52de00846734eaa39c5dc& - deleted Visited: Owner@http://by107fd.bay107.hotmail.msn.com/cgi-bin/HoTMaiL?curmbox=00000000%2d0000%2d0000%2d0000%2d000000000001&a=bab465a388435868de96a83156a84762507caa0a9ecee803cd82229564258231&fti=yes - deleted Visited: Owner@res://C:\Documents%20and%20Set...der[1].exe/104 - deleted Visited: Owner@http://www.ameeshia.com/cgi-bi...rs/whochat.cgi - deleted Visited: Owner@http://www.processlibrary.com/antivirus - deleted Visited: Owner@http://www.trendmicro.com/en/p...e/overview.htm - deleted Visited: Owner@http://www.trendmicro.com/prod...re/us-info.asp - deleted Visited: Owner@http://www.aimoo.com/forumadmi...?id=396539.cfm?yes=no - deleted Visited: Owner@http://www.intermute.com/spysubtract/cwshredder/092704 - deleted Visited: Owner@http://www.processlibrary.com/directory/files/crss - deleted Visited: Owner@http://login.passport.net/uilogin.srf?lc=1033&id=2 - deleted Visited: Owner@http://www.aimoo.com/forum/freeboard.cfm?id=396539&NoCaches=Yes - deleted Visited: Owner@file:///C:/Documents%20and%20S...CWShredder.zip - deleted Visited: Owner@https://msnialogin.passport.com/ppsecure/post.srf?id=2&svc=mail&cbid=24325&msppjph=1&tw=0&fs=1&fsa=1&fsat=1296000&lc=1033&_lang=EN&bk=1132534590 - deleted Visited: Owner@http://www.liutilities.com/pro...ocess=crss.exe - deleted Visited: Owner@http://www.google.com/search?hl=en&q=crss.exe - deleted Visited: Owner@http://www.processlibrary.com/results - deleted Visited: Owner@http://www.intermute.com/produ...porations.html - deleted Visited: Owner@http://www.trendmicro.com/en/p...s/overview.htm - deleted Visited: Owner@http://cwshredder.net/cwshredder/cwsredir.php?target=spysubtract - deleted Visited: Owner@res://C:\Documents%20and%20Set...can[1].exe/133 - deleted Visited: Owner@http://www.aimoo.com/forum/login/login.cfm?id=396539 - deleted Visited: Owner@http://loginnet.passport.com/login.srf?id=2&svc=mail&cbid=24325&msppjph=1&tw=0&fs=1&fsa=1&fsat=1296000&lc=1033&_lang=EN - deleted Visited: Owner@http://www.ameeshia.com/simple/index.php - deleted Visited: Owner@http://www.greyknight17.com/spy/CWShredder.exe - deleted Visited: Owner@http://www.trendmicro.com/ftp/...s-web-scan.exe - deleted Visited: Owner@http://www.techsupportforum.com/showthread.php?p=395477 - deleted Visited: Owner@http://nct.digitalriver.com/fulfill/0138.008 - deleted Visited: Owner@http://www.trendmicro.com/spyware-scan - deleted Visited: Owner@http://www.processlibrary.com/...smss/index.php - deleted Visited: Owner@http://www.hotmail.com - deleted Visited: Owner@http://www.liutilities.com/products/wintaskspro/processlibrary/crss - deleted Visited: Owner@res://C:\Documents%20and%20Set...can[1].exe/204 - deleted Visited: Owner@res://C:\WINDOWS\System32\shdo...l/dnserror.htm - deleted Visited: Owner@res://C:\Documents%20and%20Set...can[1].exe/110 - deleted Visited: Owner@http://www.aimoo.com/forum/freeboard.cfm?id=396539&xxx=91576&NoCaches=Yes - deleted Visited: Owner@res://C:\WINDOWS\System32\shdo...l/navcancl.htm - deleted Visited: Owner@http://www.google.com - deleted Visited: Owner@res://C:\Documents%20and%20Set...can[1].exe/107 - deleted Visited: Owner@file:///C:/Program%20Files/ewi...t_20051120.txt - deleted Visited: Owner@http://www.liutilities.com/pro...ocess=crss.exe - deleted Visited: Owner@http://by107fd.bay107.hotmail.msn.com/cgi-bin/HoTMaiL?a=bab465a388435868de96a83156a84762e503cfc43104ee0274b09be3808bee24 - deleted Visited: Owner@http://www.greyknight17.com/spyware.htm - deleted Visited: Owner@res://C:\Documents%20and%20Set...can[1].exe/137 - deleted C:\Documents and Settings\Owner\Cookies\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Cookies\owner@google[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@hotmail.msn[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@msn[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@passport[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@wdcs.trendmicro[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@www.aimoo[2].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@www.processlibrary[1].txt - deleted C:\Documents and Settings\Owner\Cookies\owner@www.techsupportforum[2].txt - deleted Cookie:owner@www.techsupportforum.com/ - deleted Cookie:owner@www.processlibrary.com - deleted Cookie:owner@wdcs.trendmicro.com/ - deleted Cookie:owner@msn.com/ - deleted Cookie:owner@hotmail.msn.com/ - deleted Cookie:owner@www.aimoo.com/ - deleted Cookie:owner@google.com/ - deleted Cookie:owner@passport.com/ - deleted C:\Documents and Settings\Owner\Recent\CWShredder.lnk - deleted C:\DOCUME~1\Owner\LOCALS~1\Temp\652D29D3.TMP - deleted C:\DOCUME~1\Owner\LOCALS~1\Temp\DetailsTMP.htm - deleted C:\DOCUME~1\Owner\LOCALS~1\Temp\StatusRx.log - deleted C:\WINDOWS\temp\Perflib_Perfdata_788.dat currently in use. Will be deleted when Windows is restarted. C:\WINDOWS\temp\T30DebugLogFile.txt - deleted C:\Documents and Settings\Owner\Cookies\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\ADSAdClient31[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\ADSAdClient31[2].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\ADSAdClient31[3].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\ADSAdClient31[4].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\ADSAdClient31[5].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\myboard[1].cfm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\2ZLEDZ51\whochat[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\8R29U3GX\whochat[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\ENGLUBOF\freeboard[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\ENGLUBOF\overview[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\ENGLUBOF\spyware[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\KFSGZSOS\ADSAdClient31[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\KFSGZSOS\HoTMaiL[1] currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\locals~1\tempor~1\Content.IE5\KFSGZSOS\showthread[1].php currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Cookies\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\ADSAdClient31[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\ADSAdClient31[2].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\ADSAdClient31[3].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\ADSAdClient31[4].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\ADSAdClient31[5].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\myboard[1].cfm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2ZLEDZ51\whochat[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8R29U3GX\whochat[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ENGLUBOF\freeboard[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ENGLUBOF\overview[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ENGLUBOF\spyware[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KFSGZSOS\ADSAdClient31[1].htm currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KFSGZSOS\HoTMaiL[1] currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KFSGZSOS\showthread[1].php currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\LocalService\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted. C:\Documents and Settings\Administrator\Cookies\index.dat - deleted C:\Documents and Settings\Administrator\locals~1\tempor~1\Content.IE5\index.dat - deleted C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat - deleted C:\WINDOWS\Prefetch\AD-AWARE.EXE-2BB7AB56.pf - deleted C:\WINDOWS\Prefetch\AVANT.EXE-2A0080A3.pf - deleted C:\WINDOWS\Prefetch\AVGINET.EXE-0005112E.pf - deleted C:\WINDOWS\Prefetch\AVGVV.EXE-2F5CBD30.pf - deleted C:\WINDOWS\Prefetch\AVGW.EXE-30DE450D.pf - deleted C:\WINDOWS\Prefetch\CIDAEMON.EXE-01BEEBF3.pf - deleted C:\WINDOWS\Prefetch\CLEANUP.EXE-1671E52D.pf - deleted C:\WINDOWS\Prefetch\CWSHREDDER[1].EXE-07B8817F.pf - deleted C:\WINDOWS\Prefetch\DEFRAG.EXE-2858C7E2.pf - deleted C:\WINDOWS\Prefetch\DFRGNTFS.EXE-38C3807C.pf - deleted C:\WINDOWS\Prefetch\FXSSVC.EXE-140862E7.pf - deleted C:\WINDOWS\Prefetch\IMAPI.EXE-201490BB.pf - deleted C:\WINDOWS\Prefetch\Layout.ini - deleted C:\WINDOWS\Prefetch\LOGONUI.EXE-312BE1BF.pf - deleted C:\WINDOWS\Prefetch\NOTEPAD.EXE-2F2D61E1.pf - deleted C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf - deleted C:\WINDOWS\Prefetch\SECURITYSUITE.EXE-2EFD625D.pf - deleted C:\WINDOWS\Prefetch\SHREDDER.EXE-032ED1FD.pf - deleted C:\WINDOWS\Prefetch\TASKMGR.EXE-06144C13.pf - deleted C:\WINDOWS\Prefetch\TMAS-WEB-SCAN[1].EXE-14379C3C.pf - deleted C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0D449B4F.pf - deleted C:\WINDOWS\Prefetch\WUAUCLT.EXE-1360D60A.pf - deleted 'Run MRU' list - removed from the registry. Paint Recent File List - removed from the registry. WordPad Recent File List - removed from the registry. Telnet's MRU list - removed from the registry. WinZip Extract MRU list - removed from the registry. WinZip File MRU list - removed from the registry. CleanUp! 4.0 recovered 10.2 MB of disk space from 886 files. CleanUp! finished on 11/20/05 18:28:18. ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, November 20, 2005 21:36:16 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 21/11/2005 Kaspersky Anti-Virus database records: 151077 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 91310 Number of viruses found: 1 Number of infected objects: 1 Number of suspicious objects: 0 Duration of the scan process: 10737 sec Infected Object Name - Virus Name C:\WINDOWS\SYSTEM32\fiz5 Infected: Trojan-Spy.HTML.Bayfraud.ib Scan process completed. Last edited by Hossly; 11-20-2005 at 09:53 PM. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-21-2005, 06:45 PM
|
#2 (permalink) |
|
Analyst, Security Team
|
Please don't post the CleanUp log...I don't think anyone has asked for that log before...it's not needed.
Do you have problems changing your wallpaper? Delete this: C:\WINDOWS\SYSTEM32\fiz5 Restart and run another Kapersky scan. Post the log here. Also run both these scans and post their logs here also: Run an online virus scan at TrendMicro http://housecall60.trendmicro.com/en...rp.asp?id=scan. Just follow the instructions on the site to run the free online scan. If any viruses/trojans are detected, try to delete or clean them in that site. If any are not cleanable, copy and paste the infected files here. Also run Panda ActiveScan at http://www.pandasoftware.com/products/activescan. Post the log from the Panda scan here.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
11-22-2005, 12:27 PM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 43
OS: Win XP
|
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT Tuesday, November 22, 2005 12:23:20 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 22/11/2005 Kaspersky Anti-Virus database records: 151322 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 91893 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 9461 sec No malware has been detected. The sections that have been scanned are CLEAN. Scan process completed. Incident Status Location Spyware:spyware/whazit Not disinfected C:\WINDOWS\SYSTEM32\fiz1 Adware:adware/spysheriff Not disinfected C:\WINDOWS\SYSTEM32\thn.dll Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\Owner\Application Data\Sskcwrd.dll Adware:adware/searchaid Not disinfected C:\WINDOWS\dict.dat Adware:adware/neededware Not disinfected Windows Registry Dialer:Dialer.OK Not disinfected C:\WINDOWS\Downloaded Program Files\mm20.INF Trend Housecall deleted 3 cookies and that was it and removed them with no prob. And I do not have any problems changing wallpaper. If You would like a new HJT log just lemme know as Ya didn't ask for it this time |
|
|
|
|
11-23-2005, 02:25 AM
|
#4 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Download & launch KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175)
Select the following option - delete on Reboot Use your mouse to select all the filenames listed below & then right-click & select Copy
* Click the RED X button. * Click Yes at the Delete on Reboot prompt. * Click Yes at the 'Pending Operations prompt'. Quote:
Let us know if you still have other issues
__________________
Question - what have you done for the community today? |
|
|
|
|
|
11-23-2005, 07:48 AM
|
#6 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 43
OS: Win XP
|
I tried running killbox and got this as I went to reboot:
"PendingFileRenameOperations Registry data has been removed by external process!" so I tried the missing file D/L and ran killbox again and got the same message and that's all that happens. You only have option to exit killbox after that |
|
|
|
|
11-23-2005, 07:59 AM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Locate & manually delete this:
C:\WINDOWS\SYSTEM32\fiz1 Please change the file deletion list to this: C:\WINDOWS\SYSTEM32\thn.dll C:\Documents and Settings\Owner\Application Data\Sskcwrd.dll C:\WINDOWS\dict.dat C:\WINDOWS\Downloaded Program Files\mm20.INF
__________________
Question - what have you done for the community today? |
|
|
|
|
11-23-2005, 08:05 AM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
No problem...Hang on for awhile
I'll work out a workaround for you.
__________________
Question - what have you done for the community today? |
|
|
|
|
11-23-2005, 08:07 AM
|
#10 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 43
OS: Win XP
|
ok thanks..ummm..I accidently deleted the thn.dll with the standard button while I was doing the last run thru. will that make a diff?
also, at first killbox said that: C:\WINDOWS\Downloaded Program Files\mm20.INF didn't have a file extension to open with or something( just using the info about each file button to look) and now it shows it as a notepad file*shrugs* Last edited by Hossly; 11-23-2005 at 08:13 AM. |
|
|
|
|
11-23-2005, 08:19 AM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
Please download the file attached to this post - hossly.zip
 From within it, doubleclick on hossly.bat & allow it to run It shall produce a log for you to post back to me |
|
|
|
|
11-23-2005, 08:49 AM
|
#14 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 43
OS: Win XP
|
Logfile of HijackThis v1.99.1
Scan saved at 8:48:26 AM, on 11/23/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\windows\system\hpsysdrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\PREVX\Prevx Home\PXAgent.exe C:\PROGRA~1\AWS\WEATHE~1\Weather.exe C:\WINDOWS\System32\tcpsvcs.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Avant Browser\avant.exe C:\Program Files\hijackthis\HijackThis.exe O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1 O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Open With JPEGCompress - res://C:\Program Files\JPEGCompress\owjc.dll/CONTEXT_HANDLE.HTM O8 - Extra context menu item: RoboForm Toolbar &R - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: RoboForm Toolbar &R - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} - http://www.uproar.com//applets/activ...side_web18.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1130512418095 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole...rcadeRdxIE.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {E4DFABBD-F5F6-11D3-8421-0080C6F79C42} (SpeechControl Class) - http://www.directxtras.com/speaksfor...eechplugin.cab O16 - DPF: {F76DF680-EC17-4272-B1C7-CDB2641FA20B} (KB836528 Object) - http://microsoft.com/security/controls/DoomChk.CAB O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Prevx Agent (PrevxAgent) - Prevx Ltd. - C:\Program Files\PREVX\Prevx Home\PXAgent.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2003\Tmntsrv.exe (file missing) O23 - Service: Trend Micro Proxy Service (tmproxy) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe (file missing) |
|
|
|
|
11-23-2005, 09:00 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,473
OS: N/A
|
I notice that you have more than one anti-virus programs on your machine. That's not a good idea!!
 Alike firewalls, anti-virus programs have conflicts co-existing with each other & may produce undesirable results. Please uninstall ALL leaving only one of them. Other than that, your system looks okay. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
