|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-30-2005, 06:34 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 20
OS: WinXP
|
yyy102.html, flash advertisement, az_landing, etc.. HELP
Hey, i just recently had spysheriff on my computer and i think i removed it. Anyway, i decided to reformat my comp and i keep getting these stupid popups which end with yyy102.html and i keep getting these annoying flash advertisements. I need help!! i think these popups are related to spysheriff? i think? because i started getting these popups after i got that stupid spysheriff program. so please help me!!
Logfile of HijackThis v1.99.1 Scan saved at 12:27:25 PM, on 12/31/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wpabaln.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKCU\..\Run: [aupd] C:\WINDOWS\system32\sywsvcs.exe O4 - HKCU\..\Run: [uqrr] C:\PROGRA~1\COMMON~1\uqrr\uqrrm.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Group Policy - C:\WINDOWS\system32\en00l1dm1.dll O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
12-30-2005, 10:32 PM
|
#2 (permalink) |
|
Analyst, Security Team
|
Welcome to TSF.
Are you sure you formatted and not did a upgrade install? A format should have wiped these problems out... Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Please download Ewido Security Suite at http://www.ewido.net/en/download/. 1. Install Ewido Security Suite. 2. When installing, under 'Additional Options' uncheck: * Install background guard * Install scan via context menu 3. Launch Ewido, there should be an icon on your desktop, double click it. 4. The program will now open to the main screen. 5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment. 6. You will need to update Ewido to the latest definition files. * On the left hand side of the main screen click update. * Then click on Start Update. 7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'. 8. Exit Ewido. DO NOT scan yet. If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don't run it yet. Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ). CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff. Now open Ewido and do a scan on your system. * Click on scanner. * Click on 'Complete System Scan' and the scan will begin. * While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK. Exit Ewido when it's done. Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - Default URLSearchHook is missing O4 - HKCU\..\Run: [aupd] C:\WINDOWS\system32\sywsvcs.exe O4 - HKCU\..\Run: [uqrr] C:\PROGRA~1\COMMON~1\uqrr\uqrrm.exe O20 - Winlogon Notify: Group Policy - C:\WINDOWS\system32\en00l1dm1.dll O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing) Locate and delete the following: C:\WINDOWS\system32\sywsvcs.exe C:\PROGRA~1\COMMON~1\uqrr\ C:\WINDOWS\system32\en00l1dm1.dll ssldr32.dll Restart your computer and boot back to Safe Mode again. Run Ewido scan again... * Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'. * Click 'Save report'. * Save the report to your desktop. Restart your computer to get back to Normal Mode. Post the Ewido report and a new HijackThis log here. Also give us this log: Download L2MFix from one of these two locations: http://www.atribune.org/downloads/l2mfix.exe http://www.downloads.subratam.org/l2mfix.exe Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread. IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so! Don't restart or shutdown once you give me the logs above. Doing so will mean giving us new logs again since the filename will most likely change.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
12-31-2005, 01:59 AM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 20
OS: WinXP
|
reports
hey greyknight .. thank you for helping me!
I did the instructions you told me and here are my reports:: my report for ewido:: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 7:36:59 PM, 12/31/2005 + Report-Checksum: B8FD096E + Scan result: [680] C:\WINDOWS\system32\wyi.dll -> Spyware.Look2Me : Error during cleaning [808] C:\WINDOWS\system32\wyi.dll -> Spyware.Look2Me : Error during cleaning C:\WINDOWS\system32\mwr.dll -> Spyware.Look2Me : Cleaned with backup ::Report End my report for hijack this:: Logfile of HijackThis v1.99.1 Scan saved at 7:48:12 PM, on 12/31/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\WINDOWS\system32\wuauclt.exe C:\hijackthis\HijackThis.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Run - C:\WINDOWS\system32\m064lajq1doe.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe and finally my report for L2Mfix:: L2MFIX find log 122705 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Run] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\m064lajq1doe.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{BC18C822-26AB-60B8-471D-298307A6B6AA}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" "{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}"="" "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension" "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension" "{AD1602FE-D82A-4B05-982E-F64D05E6B868}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\InprocServer32] @="C:\\WINDOWS\\system32\\miutb.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Wed Nov 23 2005 5  34p A.... 1,022,464 998.50 Kcdfview.dll Thu Oct 20 2005 7:39:26p A.... 151,040 147.50 K danim.dll Fri Nov 4 2005 7:16:24p A.... 1,054,208 1.00 M dxtrans.dll Thu Oct 20 2005 7:39:28p A.... 205,312 200.50 K esent.dll Thu Oct 20 2005 2:20:04p A.... 1,082,368 1.03 M extmgr.dll Thu Oct 20 2005 7:39:28p A.... 55,808 54.50 K ff_vfw.dll Tue Nov 29 2005 9:17:16p A.... 5,632 5.50 K gdi32.dll Wed Oct 5 2005 7:09:36p A.... 280,064 273.50 K iepeers.dll Thu Oct 20 2005 7:39:28p A.... 251,392 245.50 K inseng.dll Thu Oct 20 2005 7:39:28p A.... 96,256 94.00 K lv8m09~1.dll Sat Dec 31 2005 7:42:42p ..S.R 235,397 229.88 K m064la~1.dll Sat Dec 31 2005 7:13:20p ..S.R 235,208 229.70 K miutb.dll Sat Dec 31 2005 7:42:42p ..S.R 235,208 229.70 K mshtml.dll Wed Nov 23 2005 5 34p A.... 3,015,680 2.88 Mmshtmled.dll Thu Oct 20 2005 7:39:30p A.... 448,512 438.00 K msrating.dll Thu Oct 20 2005 7:39:30p A.... 146,432 143.00 K mstime.dll Thu Oct 20 2005 7:39:30p A.... 530,944 518.50 K msvcp71.dll Wed Dec 28 2005 12:05:52a A.... 499,712 488.00 K msvcr71.dll Wed Dec 28 2005 12:05:52a A.... 348,160 340.00 K pngfilt.dll Thu Oct 20 2005 7:39:30p A.... 39,424 38.50 K shdocvw.dll Wed Nov 30 2005 7:59:30p A.... 1,492,480 1.42 M shlwapi.dll Thu Oct 20 2005 7:39:30p A.... 473,600 462.50 K sirenacm.dll Wed Oct 12 2005 5:11:06p A.... 118,784 116.00 K spmsg.dll Wed Oct 12 2005 3:12:26p ..... 14,048 13.72 K urlmon.dll Fri Nov 4 2005 7:16:28p A.... 609,280 595.00 K vp7vfw.dll Fri Dec 2 2005 4:42:38p A.... 630,784 616.00 K wininet.dll Thu Oct 20 2005 7:39:30p A.... 658,432 643.00 K winmgm~1.dll Tue Dec 27 2005 11:50:52p A.... 6,656 6.50 K wyi.dll Sat Dec 31 2005 7:13:20p ..S.R 233,748 228.27 K xp2781~1.dll Tue Dec 27 2005 11:50:52p A.... 21,504 21.00 K xvidcore.dll Sat Dec 10 2005 10:01:44a A.... 847,872 828.00 K xvidvfw.dll Fri Dec 9 2005 10:32:34a A.... 151,552 148.00 K zlbw.dll Tue Dec 27 2005 11:51:12p A.... 46,592 45.50 K 33 items found: 33 files (4 H/S), 0 directories. Total of file sizes: 15,244,553 bytes 14.54 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 2CE2-E1B6 Directory of C:\WINDOWS\System32 12/31/2005 07:42 PM 235,208 miutb.dll 12/31/2005 07:42 PM 235,397 lv8m09l1e.dll 12/31/2005 07:13 PM 233,748 wyi.dll 12/31/2005 07:13 PM 235,208 m064lajq1doe.dll 12/29/2005 01:41 PM <DIR> dllcache 12/27/2005 11:26 PM <DIR> Microsoft 4 File(s) 939,561 bytes 2 Dir(s) 34,081,624,064 bytes free I've been looking at the files in the hijackthis log, and it seems to me that there's this file that keeps changing itself to random letters and numbers. ><" i think its this one:: C:\WINDOWS\system32\m064lajq1doe.dll before it used to be:: C:\WINDOWS\system32\f2l00c3mef.dll is this related to the popups i've been getting? and oh yeah, you told me to delete this:: C:\WINDOWS\system32\en00l1dm1.dll i cannot find this file!! i think everytime i restart or put my computer on safe mode, this .dll keeps on changing. anyway, i did all the instructions you told me to, but i still get those stupid popups and flash advertisements!! please reply back ><" and again, thank you so much for helping me, these advertisements are driving me crazy ! |
|
|
|
|
12-31-2005, 02:36 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Close any programs you have open since this step requires a reboot.
On the reboot notepad will open with a log. Copy/paste the contents of that log back into this thread, along with a new hijackthis log.
__________________
Question - what have you done for the community today? |
|
|
|
|
12-31-2005, 04:41 AM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 20
OS: WinXP
|
reports #2
hey subs, thanks for replying, i did what you told me to do and here are my reports::
this is my log for the l2mfix.bat:: L2mfix Beta 122705 Creating Account. The command completed successfully. Adding Administrative privleges. The command completed successfully. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX ... successful Running From: C:\WINDOWS\system32 Killing Processes! Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 444 'smss.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 524 'winlogon.exe' Killing PID 524 'winlogon.exe' Killing PID 524 'winlogon.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 2028 'explorer.exe' Killing PID 2028 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1100 'rundll32.exe' Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators ... successful Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! moving: C:\WINDOWS\system32\lv8m09l1e.dll Successfully Moved: C:\WINDOWS\system32\lv8m09l1e.dll moving: C:\WINDOWS\system32\m064lajq1doe.dll Successfully Moved: C:\WINDOWS\system32\m064lajq1doe.dll moving: C:\WINDOWS\system32\miutb.dll Successfully Moved: C:\WINDOWS\system32\miutb.dll Restoring Windows Update Certificates.: The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Run] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\m064lajq1doe.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 The following are the files found: **************************************************************************** C:\WINDOWS\system32\lv8m09l1e.dll C:\WINDOWS\system32\m064lajq1doe.dll C:\WINDOWS\system32\miutb.dll Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}\InprocServer32] @="C:\\WINDOWS\\system32\\miutb.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}"=- "{AD1602FE-D82A-4B05-982E-F64D05E6B868}"=- [-HKEY_CLASSES_ROOT\CLSID\{FBB53C7B-E4A3-4173-8D2B-10362EC12E58}] [-HKEY_CLASSES_ROOT\CLSID\{AD1602FE-D82A-4B05-982E-F64D05E6B868}] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" **************************************************************************** Desktop.ini Contents: **************************************************************************** **************************************************************************** Checking for L2MFix account(0=no 1=yes): 0 Zipping up files for submission: adding: dlls/lv8m09l1e.dll (148 bytes security) (deflated 5%) adding: dlls/m064lajq1doe.dll (148 bytes security) (deflated 5%) adding: dlls/miutb.dll (148 bytes security) (deflated 5%) adding: backregs/AD1602FE-D82A-4B05-982E-F64D05E6B868.reg (212 bytes security) (deflated 70%) adding: backregs/FBB53C7B-E4A3-4173-8D2B-10362EC12E58.reg (212 bytes security) (deflated 70%) adding: backregs/notibac.reg (164 bytes security) (deflated 87%) adding: backregs/shell.reg (164 bytes security) (deflated 74%) and here is my current report for hijack this:: Logfile of HijackThis v1.99.1 Scan saved at 10:34:40 PM, on 12/31/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\wuauclt.exe C:\hijackthis\HijackThis.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Run - C:\WINDOWS\system32\m064lajq1doe.dll (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe thank you for helping me greyknight and subs !! you guys rock!! .. so far, im not getting any advertisements popping up, but i'll tell you guys if i still get popups .. if there is anything else i need to do, PLEASE tell me .. anything to improve my computer performance! ! and again THANK YOU so much !! |
|
|
|
|
12-31-2005, 06:07 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Have HijackThis fix this entry:
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\m064lajq1doe.dll (file missing) Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Post Kaspersky's report & a new HJT log in your next reply
__________________
Question - what have you done for the community today? |
|
|
|
|
12-31-2005, 08:11 AM
|
#7 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 20
OS: WinXP
|
kaspersky && hijack this
hey .. this is my report for kaspersky .. it doesn't look good .. =/
------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, January 01, 2006 02:08:04 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 31/12/2005 Kaspersky Anti-Virus database records: 168427 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 17216 Number of viruses found: 5 Number of infected objects: 62 Number of suspicious objects: 0 Duration of the scan process: 1431 sec Infected Object Name - Virus Name C:\Documents and Settings\Rommel\Desktop\l2mfix\backup.zip/dlls/lv8m09l1e.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\backup.zip/dlls/m064lajq1doe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\backup.zip/dlls/miutb.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\backup.zip Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\dlls\lv8m09l1e.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\dlls\m064lajq1doe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\Documents and Settings\Rommel\Desktop\l2mfix\dlls\miutb.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\SS1001.exe/data0010 Infected: Trojan-Dropper.Win32.Small.qn C:\SS1001.exe Infected: Trojan-Dropper.Win32.Small.qn C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007705.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007710.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007716.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007759.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007774.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007775.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007780.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007787.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007790.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007794.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP10\A0007800.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000405.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000412.exe/data0010 Infected: Trojan-Downloader.Win32.Qoologic.at C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000412.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000424.exe Infected: Trojan-Downloader.Win32.Tiny.al C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000425.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000439.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000443.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000446.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000450.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000453.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000457.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000478.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000483.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000490.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP3\A0000494.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP4\A0000508.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP4\A0000519.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP4\A0000525.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP4\A0000531.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP5\A0000552.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP5\A0000556.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP7\A0000579.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP7\A0000598.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP7\A0000660.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP7\A0001669.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP8\A0001676.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP8\A0001692.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP8\A0002681.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0002694.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0002695.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0002696.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0003707.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0004681.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006681.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006686.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006687.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006688.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006689.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006690.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006695.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{DFD0034C-3CE7-4251-8E37-22B6B812327C}\RP9\A0006708.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\WINDOWS\secure32.html Infected: Trojan.Win32.Harnig.a Scan process completed. and this is my latest hijack this log:: Logfile of HijackThis v1.99.1 Scan saved at 2:09:38 AM, on 1/1/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\wpabaln.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\hijackthis\HijackThis.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32 \IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E- 00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32 \Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1 \Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe |
|
|
|
|
12-31-2005, 08:18 AM
|
#8 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,492
OS: N/A
|
Quote:
L2Mfix folder has done it's job. You can delete it now. Locate & delete these other files: C:\SS1001.exe C:\WINDOWS\secure32.html After that, you're clean.  Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
|
|
12-31-2005, 02:28 PM
|
#9 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 20
OS: WinXP
|
thank you`
hey, my computer is free from popups and advertising !! thank you so much subs !! and thank you so much TSF !! and i know where to go to when i need help! ! THANK YOU !!
Last edited by filo_romz; 12-31-2005 at 02:33 PM. |
|
|
|
| Thread Tools | |
|
|
