Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Inactive Malware Help Topics

User Tag List

Virus Trojan horse downloader.generic6.abkb - Could not be removed

This is a discussion on Virus Trojan horse downloader.generic6.abkb - Could not be removed within the Inactive Malware Help Topics forums, part of the Tech Support Forum category. Hope someone could help me with this virus : Trojan horse downloader.generic6.abkb AVG tried to heal it but it keeps


 
 
Thread Tools Search this Thread
Old 01-12-2008, 06:50 PM   #1
Guest
 
Join Date: Jan 2008
Posts: 4
OS:



Hope someone could help me with this virus : Trojan horse downloader.generic6.abkb

AVG tried to heal it but it keeps coming back and it freezes my browser.
I had tried several online scanner but none of them resolved it.

Hope someone could help me.
Thanks.

Here is the hijackthis file:
Logfile of HijackThis v1.99.1
Scan saved at 806 AM, on 1/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\wscntfy.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\WINDOWS\17PHolmes390.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu390.exe 61A847B5BBF728113B9B284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L08AXLRD_6717187] "G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - https://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - https://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Big City Adventure\Images\stg_drm.ocx
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - https://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {7BB30A04-A6AC-480C-BB18-5A18D79F4455} (GenimoWebGames Control) - https://games.bigfishgames.com/en_but...mesControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Big City Adventure\Images\armhelper.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - https://download.mcafee.com/molbin/is...05/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Microsoft wscntfy Service - Unknown owner - C:\WINDOWS\wscntfy.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
julianlukas is offline  
Sponsored Links
Advertisement
 
Old 01-15-2008, 10:29 AM   #2
TSF Team, Emeritus
 
Join Date: Oct 2006
Location: UK
Posts: 5,264
OS: OS



Hello and welcome to TSF

You are using an outdated version of Hijackthis. Please uninstall from Add/Remove programs, and delete your current version.

Next, download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Do not post that log, instead, do this next:

=====================================================

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
  1. Close all applications and windows.
  2. Double-click on dss.exe to run it, and follow the prompts.
  3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
  4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.
  5. Please attach extra.txt to your post.
To attach a file to a new post, simply
  1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
  2. copy and paste the following into the "Upload File from your Computer" box:
    C:\Deckard\System Scanner\extra.txt
  3. Click Upload.
What DSS will do:
  • create a new System Restore point in Windows XP and Vista.
  • clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

======================
Logs Required
C:\Deckard\System Scanner\main.txt
C:\Deckard\System Scanner\extra.txt<----Attached
__________________
Member of ASAP since 2007
Member of UNITE since 2008


If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Old 01-17-2008, 02:51 AM   #3
Guest
 
Join Date: Jan 2008
Posts: 4
OS:



Thank you very much for the help and the reply. I am getting Trojan Horse Generic6.ANDW, Trojan Horse Proxy.XKB, and Trojan Horse Downloader Generic9.ADIC. I followed the instructions and attached the required files. Thanks again.
Attached Files
File Type: txt extra.txt (33.2 KB, 17 views)
julianlukas is offline  
Sponsored Links
Advertisement
 
Old 01-17-2008, 05:43 AM   #4
TSF Team, Emeritus
 
Join Date: Oct 2006
Location: UK
Posts: 5,264
OS: OS



Seems you forgot to post the main.txt, please post that text(no need to attach).
__________________
Member of ASAP since 2007
Member of UNITE since 2008


If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Old 01-17-2008, 06:41 AM   #5
Guest
 
Join Date: Jan 2008
Posts: 4
OS:



Thank you again. I'm sorry about the missing text requirement. But here is the main txt. -- I had attached the extra text again..

Again Thank you sir.

Deckard's System Scanner v20071014.68
Run by Diony on 2008-01-17 17:39:43
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; unknown error code 0x0000001F


-- Last 5 Restore Point(s) --
71: 2008-01-13 15:44:15 UTC - RP120 - ComboFix created restore point
70: 2008-01-13 11:32:14 UTC - RP119 - System Checkpoint
69: 2008-01-12 09:54:48 UTC - RP118 - System Checkpoint
68: 2008-01-11 09:49:12 UTC - RP117 - System Checkpoint
67: 2008-01-10 06:42:51 UTC - RP116 - Software Distribution Service 3.0


-- First Restore Point --
1: 2007-10-17 00:08:31 UTC - RP50 - Installed Next Generation Visualisations


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 448 MiB (512 MiB recommended).


-- HijackThis (run as Diony.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:37 PM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Diony\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Diony.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L08AXLRD_6717187] "G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - https://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - https://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Big City Adventure\Images\stg_drm.ocx
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - https://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {7BB30A04-A6AC-480C-BB18-5A18D79F4455} (GenimoWebGames Control) - https://games.bigfishgames.com/en_but...mesControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Big City Adventure\Images\armhelper.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - https://download.mcafee.com/molbin/is...05/mcfscan.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Microsoft wscntfy Service - Unknown owner - C:\WINDOWS\wscntfy.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7690 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - shell\open\command - NOTEPAD.EXE %1
.scr - scrfile - shell\open\command - NOTEPAD.EXE %1
.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys

S3 catchme - c:\docume~1\diony\locals~1\temp\catchme.sys (file missing)
S3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
S3 SNP2STD (USB2.0 PC Camera (SNP2STD)) - c:\windows\system32\drivers\snp2sxp.sys <Not Verified; ; USB2.0 PC Camera driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 RichVideo (Cyberlink RichVideo Service(CRVS)) - "c:\program files\cyberlink\shared files\richvideo.exe" <Not Verified; ; RichVideo Module>
R3 NMIndexingService - "c:\program files\common files\ahead\lib\nmindexingservice.exe" <Not Verified; Nero AG; Nero Home>

S2 Microsoft wscntfy Service - "c:\windows\wscntfy.exe" (file missing)
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2007-12-17 and 2008-01-17 -----------------------------

2008-01-16 13:04:06 0 d-------- C:\Program Files\Mp3 My Mp3 2.0
2008-01-15 21:26:10 0 d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-01-13 10:58:21 0 d-------- C:\Documents and Settings\LocalService\Desktop
2008-01-13 10:57:41 0 d---s---- C:\Documents and Settings\LocalService\Favorites
2008-01-13 10:56:49 0 d-------- C:\Documents and Settings\LocalService\Application Data\Mozilla
2008-01-13 10:53:59 2 --a------ C:\-669657805
2008-01-13 10:53:40 8 --a------ C:\WINDOWS\system32\-669657805
2008-01-13 10:53:39 15360 --a------ C:\lwpyck.exe
2008-01-13 06:47:42 0 d-------- C:\WINDOWS\McAfee.com
2008-01-10 19:39:00 0 d-------- C:\Documents and Settings\Lemuel\Application Data\PrevxCSI
2008-01-10 18:37:42 0 d-------- C:\Program Files\PrevxCSI
2008-01-10 18:30:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-10 18:30:09 0 d-------- C:\Documents and Settings\Diony\Application Data\PrevxCSI
2008-01-09 19:24:11 0 d-------- C:\Documents and Settings\Diony\.housecall6.6
2008-01-08 19:16:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-08 19:16:28 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-08 18:56:37 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-07 17:41:54 719872 --a------ C:\WINDOWS\system32\devil.dll <Not Verified; Abysmal Software; Developer's Image Library (DevIL)>
2008-01-07 17:41:54 314368 --a------ C:\WINDOWS\system32\avisynth.dll <Not Verified; The Public; Avisynth 2.5>
2008-01-07 17:41:52 0 d-------- C:\Program Files\Magic Video Converter
2008-01-01 10:47:08 0 d-------- C:\Documents and Settings\Technician\Application Data\Adobe
2007-12-30 23:23:20 0 d-------- C:\Program Files\NCH Software
2007-12-30 23:21:08 0 d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2007-12-30 23:18:56 0 d-------- C:\Program Files\NCH Swift Sound
2007-12-30 23:18:56 0 d-------- C:\Documents and Settings\Diony\Application Data\NCH Swift Sound
2007-12-29 18:45:30 57436 --a------ C:\WINDOWS\DASShp.dll <Not Verified; Microsoft Corporation; Microsoft DAS Client Components>
2007-12-29 18:45:30 0 d-------- C:\Program Files\Microsoft Reader


-- Find3M Report ---------------------------------------------------------------

2008-01-17 17:30:17 0 d-------- C:\Program Files\Trend Micro
2008-01-17 03:20:05 0 d-------- C:\Documents and Settings\Diony\Application Data\uTorrent
2008-01-16 19:44:14 0 d-------- C:\Documents and Settings\Diony\Application Data\LimeWire
2008-01-14 18:14:25 0 d-------- C:\Documents and Settings\Diony\Application Data\AVG7
2008-01-14 08:16:50 0 d-------- C:\Program Files\Free FLV Converter
2008-01-13 17:51:45 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-01-13 07:48:17 0 d-------- C:\Program Files\CyberLink
2008-01-13 07:48:17 0 d-------- C:\Program Files\CinemaForge
2008-01-13 07:48:17 0 d-------- C:\Program Files\CCleaner
2008-01-13 07:48:16 0 d-------- C:\Program Files\BearShare Applications
2008-01-13 07:48:15 0 d-------- C:\Program Files\AvRack
2008-01-13 07:48:15 0 d-------- C:\Program Files\AVI MPEG RM WMV Splitter
2008-01-13 07:48:14 0 d-------- C:\Program Files\Adssite Advanced Toolbar
2008-01-13 07:48:14 0 d-------- C:\Program Files\3M
2008-01-05 01:50:11 0 d-------- C:\Program Files\LimeWire
2007-12-29 18:45:30 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-25 12:09:10 0 d-------- C:\Documents and Settings\Diony\Application Data\Adobe
2007-12-24 07:44:16 0 d-------- C:\Program Files\Guitar Speed Trainer
2007-12-07 18:11:06 0 d-------- C:\Documents and Settings\Diony\Application Data\FxFotoDB
2007-12-04 22:08:59 0 d-------- C:\Program Files\MSXML 6.0
2007-12-03 20:03:17 0 d-------- C:\Program Files\Microsoft Student
2007-12-03 20:02:27 0 d-------- C:\Program Files\Learning Essentials
2007-11-30 00:21:53 0 d-------- C:\Program Files\AVI MPEG RM WMV Joiner
2007-11-30 00:20:55 2573 --a------ C:\WINDOWS\WINDVDBOOTRECDOE.sys
2007-11-30 00:20:51 0 d-------- C:\Program Files\WinAVI DVD Copy
2007-11-25 16:50:29 2174 --a------ C:\Documents and Settings\Diony\Application Data\update.log
2007-11-25 10:47:57 0 d-------- C:\Program Files\Common Files\Adobe
2007-11-25 10:47:32 0 d-------- C:\Program Files\Common Files
2007-11-20 09:29:46 0 d-------- C:\Program Files\Common Files\snp2std
2007-10-21 19:48:30 74703 --a------ C:\WINDOWS\system32\mfc45.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [08/22/2006 05:16 PM C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [08/03/2006 05:12 AM C:\WINDOWS\soundman.exe]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [03/24/2005 04:52 AM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 01:25 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/30/2007 09:35 AM]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [05/12/2007 11:19 AM]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [05/10/2007 04:58 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [12/23/2006 05:05 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:00 AM]
"L08AXLRD_6717187"="G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.exe" [05/21/2007 03:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [6/16/2007 10:32:04 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 12:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Post-it Software Notes Lite.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Post-it Software Notes Lite.lnk
backup=C:\WINDOWS\pss\Post-it Software Notes Lite.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Lemuel^Start Menu^Programs^Startup^Y'z ToolBar.lnk]
path=C:\Documents and Settings\Lemuel\Start Menu\Programs\Startup\Y'z ToolBar.lnk
backup=C:\WINDOWS\pss\Y'z ToolBar.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdvancedCleaner Free]
"C:\Program Files\AdvancedCleaner Free\UADC.exe" /min

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
C:\WINDOWS\FixCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlyAway]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
C:\Program Files\IncrediMail\bin\IncMail.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L08AXLRD_34214140]
"G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L08AXLRD_8380796]
"G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp]
"C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svas]
C:\WINDOWS\TEMP\10B.tmp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UADC_1034651873]
"C:\Program Files\AdvancedCleaner Free\UADCcw.exe" -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
"C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57b7137c-5ea7-11dc-a57a-00012e2107bc}]
AutoRun\command- RavMon.exe




-- End of Deckard's System Scanner: finished at 2008-01-17 17:41:26 ------------
Attached Files
File Type: txt extra.txt (13.3 KB, 15 views)
julianlukas is offline  
Old 01-17-2008, 08:06 AM   #6
TSF Team, Emeritus
 
Join Date: Oct 2006
Location: UK
Posts: 5,264
OS: OS



Hello again

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

=================================

Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

=================================

P2P

P2P - I see you have P2P software 礣orrent, BearShare and LimeWire PRO 4.14.5 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

=================================

Please visit this webpage for download links, and instructions for running the tool: https://www.bleepingcomputer.com/comb...o-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

===================================
Logs Required
C:\Combofix.txt
Hijackthis log
__________________
Member of ASAP since 2007
Member of UNITE since 2008


If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
Old 01-18-2008, 05:38 AM   #7
Guest
 
Join Date: Jan 2008
Posts: 4
OS:



Sir my browser is working now, though once in a while AVG would pop up stating if I want to heal the Trojan Horse Downloader Generic6.ADIG, Trojan Horse Downloader Generic6.ADIC. There aren't noticeable activity of this virus nor any changes on the computer. Though I am bit worried about it being on my system. I initially run another AVG complete scan test, and the downloader Generic6.* viruses weren't detected until I ran an antispyware software.

I attached here the combofix log and a new hijackthis log.

ComboFix 08-01-13.1 - Diony 2008-01-18 20:18:34.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.171 [GMT -8:00]
Running from: C:\Documents and Settings\Diony\My Documents\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\RECYCLER\Desktop_.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-17 17:39 . 2008-01-17 17:39 <DIR> d-------- C:\Deckard
2008-01-16 13:04 . 2008-01-16 13:22 <DIR> d-------- C:\Program Files\Mp3 My Mp3 2.0
2008-01-15 21:26 . 2008-01-15 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-01-13 10:53 . 2008-01-13 10:56 8 --a------ C:\WINDOWS\system32\-669657805
2008-01-13 10:53 . 2008-01-13 10:54 2 --a------ C:\-669657805
2008-01-13 07:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 06:47 . 2008-01-13 06:47 <DIR> d-------- C:\WINDOWS\McAfee.com
2008-01-10 19:39 . 2008-01-10 19:39 <DIR> d-------- C:\Documents and Settings\Lemuel\Application Data\PrevxCSI
2008-01-10 18:37 . 2008-01-10 20:49 <DIR> d-------- C:\Program Files\PrevxCSI
2008-01-10 18:30 . 2008-01-10 18:38 <DIR> d-------- C:\Documents and Settings\Diony\Application Data\PrevxCSI
2008-01-10 18:30 . 2008-01-10 18:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-09 19:30 . 2008-01-09 19:25 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-09 19:24 . 2008-01-13 17:30 <DIR> d-------- C:\Documents and Settings\Diony\.housecall6.6
2008-01-08 19:19 . 2008-01-08 19:19 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-08 19:16 . 2008-01-08 19:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-08 19:16 . 2008-01-08 19:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-08 18:56 . 2008-01-13 14:59 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-07 17:41 . 2008-01-14 08:51 <DIR> d-------- C:\Program Files\Magic Video Converter
2008-01-07 17:41 . 2004-05-26 21:37 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-01-07 17:41 . 2006-09-16 19:44 314,368 --a------ C:\WINDOWS\system32\avisynth.dll
2007-12-30 23:23 . 2008-01-15 21:28 <DIR> d-------- C:\Program Files\NCH Software
2007-12-30 23:21 . 2008-01-06 19:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2007-12-30 23:18 . 2008-01-18 18:39 <DIR> d-------- C:\Program Files\NCH Swift Sound
2007-12-30 23:18 . 2007-12-30 23:22 <DIR> d-------- C:\Documents and Settings\Diony\Application Data\NCH Swift Sound
2007-12-29 18:45 . 2007-12-29 18:45 <DIR> d-------- C:\Program Files\Microsoft Reader
2007-12-29 18:45 . 2003-06-05 17:15 57,436 --a------ C:\WINDOWS\DASShp.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 04:16 --------- d-----w C:\Documents and Settings\Diony\Application Data\uTorrent
2008-01-19 02:53 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-01-19 01:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-18 04:16 --------- d-----w C:\Program Files\Free FLV Converter
2008-01-18 04:03 --------- d-----w C:\Documents and Settings\Diony\Application Data\LimeWire
2008-01-18 01:30 --------- d-----w C:\Program Files\Trend Micro
2008-01-15 11:01 --------- d-----w C:\Documents and Settings\Lemuel\Application Data\LimeWire
2008-01-15 02:14 --------- d-----w C:\Documents and Settings\Diony\Application Data\AVG7
2008-01-14 01:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-13 15:48 --------- d-----w C:\Program Files\CyberLink
2008-01-13 15:48 --------- d-----w C:\Program Files\CinemaForge
2008-01-13 15:48 --------- d-----w C:\Program Files\CCleaner
2008-01-13 15:48 --------- d-----w C:\Program Files\AvRack
2008-01-13 15:48 --------- d-----w C:\Program Files\AVI MPEG RM WMV Splitter
2008-01-13 15:48 --------- d-----w C:\Program Files\3M
2008-01-05 09:50 --------- d-----w C:\Program Files\LimeWire
2007-12-30 02:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-24 15:44 --------- d-----w C:\Program Files\Guitar Speed Trainer
2007-12-08 02:11 --------- d-----w C:\Documents and Settings\Diony\Application Data\FxFotoDB
2007-12-05 06:08 --------- d-----w C:\Program Files\MSXML 6.0
2007-12-04 04:03 --------- d-----w C:\Program Files\Microsoft Student
2007-12-04 04:02 --------- d-----w C:\Program Files\Learning Essentials
2007-11-30 08:21 --------- d-----w C:\Program Files\AVI MPEG RM WMV Joiner
2007-11-30 08:20 --------- d-----w C:\Program Files\WinAVI DVD Copy
2007-11-25 18:47 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-22 16:07 --------- d-----w C:\Documents and Settings\Lemuel\Application Data\AVG7
2007-11-20 17:29 --------- d-----w C:\Program Files\Common Files\snp2std
2007-11-20 17:29 --------- d-----w C:\Documents and Settings\Lemuel\Application Data\InstallShield
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 01:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-22 03:48 74,703 ----a-w C:\WINDOWS\system32\mfc45.dll
.
Code:
<pre>
----a-w         3,855,600 2007-10-07 15:28:06  C:\Documents and Settings\Diony\Incomplete\HPS77STN4QBREJMXC6I2B4YFHPN2JNVW\Boilsoft Splitter 4.28 & Joiner 4.82\Boilsoft AVI MPEG RM WMV Splitter 4.28 .exe
</pre>

((((((((((((((((((((((((((((( [email protected]_ 7.53.42.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-13 15:44:30 1,105,920 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-18 01:23:38 1,105,920 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-13 15:44:30 888,832 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-18 01:23:38 888,832 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-13 15:44:30 1,110,016 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-18 01:23:38 1,110,016 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-13 15:44:30 888,832 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-18 01:23:38 888,832 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-13 15:44:31 5,156,864 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-18 01:23:39 5,218,304 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-13 15:44:31 151,552 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-18 01:23:39 151,552 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2007-06-24 06:49:05 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-13 22:51:19 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-06-24 06:49:05 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-13 22:51:19 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 17:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"L08AXLRD_6717187"="G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.exe" [2007-05-21 03:00 351000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2006-08-22 17:16 49152 C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [2005-03-24 04:52 94770]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-30 09:35 579072]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2007-05-12 11:19 270336]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2007-05-10 16:58 344064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 23:03 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-06-16 22:32:04]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Post-it Software Notes Lite.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Post-it Software Notes Lite.lnk
backup=C:\WINDOWS\pss\Post-it Software Notes Lite.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Lemuel^Start Menu^Programs^Startup^Y'z ToolBar.lnk]
path=C:\Documents and Settings\Lemuel\Start Menu\Programs\Startup\Y'z ToolBar.lnk
backup=C:\WINDOWS\pss\Y'z ToolBar.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdvancedCleaner Free]
C:\Program Files\AdvancedCleaner Free\UADC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 2007-02-12 14:50 20480 C:\WINDOWS\FixCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlyAway]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
--a------ 2007-06-12 10:28 208946 C:\Program Files\IncrediMail\bin\IncMail.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L08AXLRD_34214140]
--a------ 2007-05-21 03:00 351000 G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L08AXLRD_8380796]
--a------ 2007-05-21 03:00 351000 G:\Microsoft Student with Encarta Premium 2008 DVD\EDICT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2006-12-05 21:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 14:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp]
C:\Program Files\PC Tools AntiVirus\PCTAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2007-10-23 13:18 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2006-11-23 14:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2007-09-22 14:51 1318912 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svas]
C:\WINDOWS\TEMP\10B.tmp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UADC_1034651873]
C:\Program Files\AdvancedCleaner Free\UADCcw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2007-06-08 06:59 224248 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

S2 Microsoft wscntfy Service;Microsoft wscntfy Service;"C:\WINDOWS\wscntfy.exe" []
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-05-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57b7137c-5ea7-11dc-a57a-00012e2107bc}]
\Shell\AutoRun\command - RavMon.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2008-01-18 20:20:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\drivers\ntio922.sys 37632 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NDIS]

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ndisaluo]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\ndisaluo.sys"
--

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ntio922]
"ImagePath"="system32\Drivers\ntio922.sys"
.
Completion time: 2008-01-18 20:21:17
ComboFix-quarantined-files.txt 2008-01-19 04:21:09
ComboFix2.txt 2008-01-18 01:27:37
ComboFix3.txt 2008-01-13 18:53:28
ComboFix4.txt 2008-01-13 17:28:30
ComboFix5.txt 2008-01-13 15:53:58
.
2008-01-10 06:44:41 --- E O F ---

-------------



Thank you again.
Attached Files
File Type: txt hijackthis.log.txr.txt (7.5 KB, 19 views)
File Type: txt log.txt (14.0 KB, 18 views)
julianlukas is offline  
Old 01-18-2008, 01:39 PM   #8
TSF Team, Emeritus
 
Join Date: Oct 2006
Location: UK
Posts: 5,264
OS: OS



Are you being helped at Tech Support Guy as well https://forums.techguy.org/malware-re...-generic6.html

The logs at Tech Support Guy are identical to the one posted here at TechSupport, this is a complete waste of time to have two analysts working on the same log, Cheeseball81 and myself could be helping someone else instead.

As the logs are the same i am no longer offering my services on this thread.
__________________
Member of ASAP since 2007
Member of UNITE since 2008


If we have helped you in anyway, please consider Donating
TheBruce1 is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 09:27 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts