|
|
|
Trouble with Spy/Mal/Adware!
|
|
|
AceDay
Newbie
|
30. June 2007 @ 17:43 |
Link to this message
|
Hello, I'm new to the site and very frustrated at this point. I thought I would be able to remove all files related to the above with no trouble(I've done it before with net help of course) but that isn't the case and for the past week I've been trying to deal with: insane numbers of IE popups(20 at one time and grows to 40 if I ignore it), winfixer, purityscan, my desktop becomes useless(ie I can click all I want on something but no reply), and any windows I minimize still appear on my desktop. I use Ad-Aware, Spybot S&D, CCleaner, and I just recently downloaded Hijack This and created a log for this site. I didn't delete anything because it seemed a tad overwhelming at the moment and I didn't want to make things worse. I've seen posts like this before but never done it myself. So please be gentle. Any help is appreciated at the moment. I might not reply within 24 hours just so I can relax for awhile without dealing with this mess.
Logfile of HijackThis v1.99.1
Scan saved at 8:40:47 PM, on 06/30/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\avp.exe
C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\System32\msvofipf.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\ALEXSC~1\LOCALS~1\Temp\powersv.exe
C:\WINDOWS\avp.exe
C:\DOCUME~1\ALEXSC~1\LOCALS~1\Temp\agentlook.exe
C:\WINDOWS\avp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customiz...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: msdn_lib.msdn_hlp - {19D3A5DB-A5A3-4F95-9713-833AE4B950A4} - C:\WINDOWS\System32\msdn_lib.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\vtaqulkn.dll
O2 - BHO: (no name) - {27218055-DEB8-4768-8991-30B5E14EB704} - C:\Program Files\Windows NT\hokerof43855.dll
O2 - BHO: (no name) - {2D343DD6-0EA5-4229-9578-46765B1FDE52} - C:\WINDOWS\System32\geede.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {DC192567-65F9-4AB6-ADB7-E13575F81726} - C:\WINDOWS\System32\vtuvurq.dll
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\cnulthvt.dll",forkonce
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20040...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: geede - C:\WINDOWS\System32\geede.dll
O20 - Winlogon Notify: RelevantKnowledge - C:\WINDOWS\System32\rlls.dll (file missing)
O20 - Winlogon Notify: vtuvurq - C:\WINDOWS\SYSTEM32\vtuvurq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: winzdn32 - C:\WINDOWS\SYSTEM32\winzdn32.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\msvofipf.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
|
|
Advertisement
|
 |
|
|
|
hilu
Junior Member
|
1. July 2007 @ 05:57 |
Link to this message
|
Hi AceDay
Please download VundoFix.exe to your desktop.[list]
[*]Double-click VundoFix.exe to run it.
[*]Click the Scan for Vundo button.
[*]Once it's done scanning, click the Remove Vundo button.
[*]You will receive a prompt asking if you want to remove the files, click YES
[*]Once you click yes, your desktop will go blank as it starts removing Vundo.
[*]When completed, it will prompt that it will reboot your computer, click OK.
[*]Please post the contents of C:\vundofix.txt and a new HijackThis log.
[/list]
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Download ComboFix from Here or Here to your Desktop.[list][*]Double click combofix.exe and follow the prompts.[*]When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply[/list][color=Blue]Note: Do not mouseclick combofix's window while its running. That may cause it to stall[/color]
Pease, post these logs:
C:\vundofix.txt
C:\ComboFix.txt
HiJackThis log
|
|
AceDay
Newbie
|
1. July 2007 @ 13:33 |
Link to this message
|
Here you go hilu, I appreciate the help. So far everything is running a little better but by the time I say that something will go wrong. Ha ha!
Vundofix text file:
VundoFix V6.5.4
Checking Java version...
Sun Java not detected
Scan started at 1:19:17 PM 07/01/2007
Listing files found while scanning....
C:\windows\system32\awtuvtr.dll
C:\windows\system32\bmfhmgxa.exe
C:\windows\system32\boesfwcl.exe
C:\windows\system32\cnulthvt.dll
C:\windows\system32\doiycbfb.exe
C:\WINDOWS\System32\edeeg.bak1
C:\WINDOWS\System32\edeeg.bak2
C:\WINDOWS\System32\edeeg.ini
C:\WINDOWS\System32\eppdxmvm.dll
C:\windows\system32\fccbyvw.dll
C:\windows\system32\fwkplyem.exe
C:\WINDOWS\System32\geede.dll
C:\windows\system32\hllfdlwo.dll
C:\windows\system32\msvofipf.exe
C:\WINDOWS\System32\mvmxdppe.ini
C:\windows\system32\pgdyxswj.exe
C:\windows\system32\tvhtlunc.ini
C:\windows\system32\vaysildi.exe
C:\WINDOWS\System32\vtaqulkn.dll
C:\WINDOWS\System32\vtuvurq.dll
Beginning removal...
Attempting to delete C:\windows\system32\awtuvtr.dll
C:\windows\system32\awtuvtr.dll Has been deleted!
Attempting to delete C:\windows\system32\bmfhmgxa.exe
C:\windows\system32\bmfhmgxa.exe Has been deleted!
Attempting to delete C:\windows\system32\boesfwcl.exe
C:\windows\system32\boesfwcl.exe Has been deleted!
Attempting to delete C:\windows\system32\cnulthvt.dll
C:\windows\system32\cnulthvt.dll Has been deleted!
Attempting to delete C:\windows\system32\doiycbfb.exe
C:\windows\system32\doiycbfb.exe Has been deleted!
Attempting to delete C:\WINDOWS\System32\edeeg.bak1
C:\WINDOWS\System32\edeeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\System32\edeeg.bak2
C:\WINDOWS\System32\edeeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\System32\edeeg.ini
C:\WINDOWS\System32\edeeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\System32\eppdxmvm.dll
C:\WINDOWS\System32\eppdxmvm.dll Has been deleted!
Attempting to delete C:\windows\system32\fccbyvw.dll
C:\windows\system32\fccbyvw.dll Has been deleted!
Attempting to delete C:\windows\system32\fwkplyem.exe
C:\windows\system32\fwkplyem.exe Has been deleted!
Attempting to delete C:\WINDOWS\System32\geede.dll
C:\WINDOWS\System32\geede.dll Could not be deleted.
Attempting to delete C:\windows\system32\hllfdlwo.dll
C:\windows\system32\hllfdlwo.dll Has been deleted!
Attempting to delete C:\windows\system32\msvofipf.exe
C:\windows\system32\msvofipf.exe Could not be deleted.
Attempting to delete C:\WINDOWS\System32\mvmxdppe.ini
C:\WINDOWS\System32\mvmxdppe.ini Has been deleted!
Attempting to delete C:\windows\system32\pgdyxswj.exe
C:\windows\system32\pgdyxswj.exe Has been deleted!
Attempting to delete C:\windows\system32\tvhtlunc.ini
C:\windows\system32\tvhtlunc.ini Has been deleted!
Attempting to delete C:\windows\system32\vaysildi.exe
C:\windows\system32\vaysildi.exe Has been deleted!
Attempting to delete C:\WINDOWS\System32\vtaqulkn.dll
C:\WINDOWS\System32\vtaqulkn.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\vtuvurq.dll
C:\WINDOWS\System32\vtuvurq.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\System32\geede.dll
C:\WINDOWS\System32\geede.dll Has been deleted!
Attempting to delete C:\windows\system32\msvofipf.exe
C:\windows\system32\msvofipf.exe Could not be deleted.
Attempting to delete C:\WINDOWS\System32\vtuvurq.dll
C:\WINDOWS\System32\vtuvurq.dll Has been deleted!
Performing Repairs to the registry.
Done!
Combofix text file:
ComboFix 07-06-18.2 - C:\Documents and Settings\Alex Schwartz\Desktop\ComboFix.exe
"Alex Schwartz" - 2007-07-01 13:38:54 - Service Pack 1 NTFS
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\winzdn32.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\ALEXSC~1\APPLIC~1.\.rdr.ini
C:\DOCUME~1\ALEXSC~1\APPLIC~1.\WinAntiSpyware 2007
C:\DOCUME~1\ALEXSC~1\APPLIC~1.\WinAntiSpyware 2007\Logs\update.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007\Data\ProductCode
C:\Program Files\Common Files\smante~1
C:\Program Files\Common Files\smante~1\dllhost.exe
C:\Program Files\Common Files\WinAntiSpyware 2007
C:\Program Files\Common Files\WinAntiSpyware 2007\err.log
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
C:\Program Files\Common Files\Yazzle1716OinAdmin.exe
C:\Program Files\Common Files\Yazzle1716OinUninstaller.exe
C:\Program Files\fnts~1
C:\Program Files\fnts~1\m?dtc.exe
C:\Program Files\Internet Explorer\profsyzyzoz.html
C:\Temp\0b9
C:\Temp\0b9\tmpTF.log
C:\Temp\tn3
C:\WINDOWS\avp.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\cs_cache.ini
C:\WINDOWS\rau001978.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\driver.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\rlvknlg.exe
C:\WINDOWS\system32\winsys64.exe
C:\WINDOWS\system32\wmvds32.dll
C:\WINDOWS\Uninst2.htm
C:\WINDOWS\Unist1.htm
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CORE
-------\LEGACY_NET_AGENT
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
-------\core
-------\Net Agent
((((((((((((((((((((((((( Files Created from 2007-06-01 to 2007-07-01 )))))))))))))))))))))))))))))))
2007-07-01 13:39 31,254 --a------ C:\WINDOWS\system32\rqrrspm.dll
2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-07-01 13:28 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-07-01 13:19 <DIR> d-------- C:\VundoFix Backups
2007-06-30 18:09 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe
2007-06-28 08:43 11,776 --a------ C:\WINDOWS\mgrs.exe
2007-06-28 08:42 56,832 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfmlibal.exe
2007-06-28 08:42 4 --a------ C:\WINDOWS\system32\stfv.bin
2007-06-28 08:41 28,928 --a------ C:\WINDOWS\system32\updatetc.exe
2007-06-28 08:41 25,088 --a------ C:\WINDOWS\system32\msdn_lib.dll
2007-06-28 08:41 19,456 --a------ C:\WINDOWS\system32\180ax.exe
2007-06-28 08:41 17,920 --a------ C:\WINDOWS\system32\salm.exe
2007-06-28 08:41 13,312 --a------ C:\WINDOWS\saiemod.dll
2007-06-28 08:41 12 --a------ C:\WINDOWS\system32\gtv_sd.bin
2007-06-28 08:40 <DIR> d-------- C:\WINDOWS\system32\o05PrEz
2007-06-26 22:12 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-06-25 12:47 122,944 --------- C:\WINDOWS\system32\msvofipf.exe
2007-06-24 10:12 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-06-24 10:12 79,872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys
2007-06-24 10:12 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-06-24 10:12 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SalesMonitor
2007-06-24 10:08 46,592 --a------ C:\WINDOWS\oomoeke.exe
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\win
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\o02PrEz
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H5
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H4
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H3
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H2
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H1
2007-06-24 10:08 <DIR> d-------- C:\Temp\iee
2007-06-24 10:08 <DIR> d-------- C:\Temp
2007-06-20 23:37 <DIR> d-------- C:\Program Files\iTunes
2007-06-20 23:37 <DIR> d-------- C:\Program Files\iPod
2007-06-20 23:34 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-15 14:43 53,248 --a------ C:\WINDOWS\uni_eh43.exe
2007-06-15 14:42 53,248 --a------ C:\WINDOWS\uninst1014.exe
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-29 12:12:47 -------- d-----w C:\Program Files\Windows NT
2007-06-22 03:00:32 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-21 04:36:38 -------- d-----w C:\Program Files\QuickTime
2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat
2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX
2007-06-03 22:40:46 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent
2007-05-03 01:56:55 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\MusicIP
2007-05-03 01:56:23 -------- d-----w C:\Program Files\Winamp
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{19D3A5DB-A5A3-4F95-9713-833AE4B950A4}=C:\WINDOWS\System32\msdn_lib.dll [2007-06-28 08:41]
{27218055-DEB8-4768-8991-30B5E14EB704}=C:\Program Files\Windows NT\hokerof43855.dll [2007-06-14 06:54]
{43CBE820-B564-4B5A-BD5E-F365C19E445C}=C:\WINDOWS\System32\rqrrspm.dll [2007-07-01 13:39]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03]
{B7143108-4CC4-40F2-A7F0-4172F493BEB6}=C:\WINDOWS\System32\geede.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"nwiz"="nwiz.exe" []
"07rO3pP"="ddeput.exe" []
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51]
"Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"wfmlibal.exe"="C:\Documents and Settings\All Users\Application Data\wfmlibal.exe" [2007-06-28 08:42]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Arun"="C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" []
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Internet Explorer\profsyzyzoz.html
FriendlyName=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{43CBE820-B564-4B5A-BD5E-F365C19E445C}"="C:\WINDOWS\System32\rqrrspm.dll" [2007-07-01 13:39]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrrspm]
rqrrspm.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Alerter"=3 (0x3)
"TrkWks"=2 (0x2)
"MSDTC"=3 (0x3)
"ClipSrv"=3 (0x3)
Contents of the 'Scheduled Tasks' folder
2007-06-21 04:34:53 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 1:37:50 PM, on 07/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\msvofipf.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\avp.exe
C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customiz...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: msdn_lib.msdn_hlp - {19D3A5DB-A5A3-4F95-9713-833AE4B950A4} - C:\WINDOWS\System32\msdn_lib.dll
O2 - BHO: (no name) - {27218055-DEB8-4768-8991-30B5E14EB704} - C:\Program Files\Windows NT\hokerof43855.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20040...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: RelevantKnowledge - C:\WINDOWS\System32\rlls.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: winzdn32 - C:\WINDOWS\SYSTEM32\winzdn32.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\msvofipf.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
|
|
hilu
Junior Member
|
2. July 2007 @ 04:57 |
Link to this message
|
Hi
I can't see any evidence of anti-virus or firewall software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network.
Please download a free anti-virus software:
Antivir
Avast
Firewalls protect against hackers and malicious intruders. Please download a free firewall:
ZoneAlarm
Comodo
post:
fresh HijackThis log
|
|
AceDay
Newbie
|
6. July 2007 @ 22:00 |
Link to this message
|
Here's my newest log from Hijack This.
Logfile of HijackThis v1.99.1
Scan saved at 12:59:19 AM, on 07/07/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20040...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll
O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
|
|
hilu
Junior Member
|
7. July 2007 @ 01:17 |
Link to this message
|
Hi AceDay
open HijackThis
clic "do a system scan only"
Check the following entries (if still present) :
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com
O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce
O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll
O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
clic "fix checked"
-------------------------------------------------------------------
Please Open notepad and copy/paste the text in the quotebox below into it:
Quote:
File::
C:\WINDOWS\system32\rqrrspm.dll
C:\WINDOWS\system32\VundoFixSVC.exe
C:\WINDOWS\system32\sysmon32.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\updatetc.exe
C:\WINDOWS\system32\msdn_lib.dll
C:\WINDOWS\system32\180ax.exe
C:\WINDOWS\system32\salm.exe
C:\WINDOWS\saiemod.dll
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\msvofipf.exe
C:\WINDOWS\system32\drivers\FOPN.sys
C:\WINDOWS\oomoeke.exe
C:\WINDOWS\uni_eh43.exe
C:\WINDOWS\uninst1014.exe
C:\WINDOWS\System32\awtss.dll
C:\WINDOWS\System32\wivoxwoh.dll
C:\WINDOWS\System32\rqrrspm.dll
C:\WINDOWS\System32\geede.dll
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
C:\WINDOWS\System32\lglwvxtf.dll
Folder::
C:\VundoFix Backups
C:\WINDOWS\system32\o05PrEz
C:\WINDOWS\system32\o02PrEz
C:\WINDOWS\system32\H5
C:\WINDOWS\system32\H4
C:\WINDOWS\system32\H3
C:\WINDOWS\system32\H2
C:\WINDOWS\system32\H1
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"07rO3pP"=-
"wfmlibal.exe"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{43CBE820-B564-4B5A-BD5E-F365C19E445C}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrrspm]
Save this as ComboFix-Do.txt
Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot (in case it asks to reboot)
---------------------------------------------------------------------------------
please download ATF Cleaner by Atribune.
[list]
[*]Double-click ATF-Cleaner.exe to run the program.
[*]Under Main choose: Select All
[*]Click the Empty Selected button.
[/list]
If you use [color=green] Firefox[/color] browser
[list]
[*]Click Firefox at the top and choose: Select All
[*]Click the Empty Selected button.
[*] NOTE: If you would like to keep your saved passwords, please click No at the prompt.[/list]
If you use [color=green] Opera[/color] browser
[list]
[*]Click Opera at the top and choose: Select All
[*]Click the Empty Selected button.
[*] NOTE: If you would like to keep your saved passwords, please click No at the prompt.[/list]
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
This will remove all files from the items that are checked so if you have some cookies you'd like to save. please move them to a different directory first.
------------------------------------------------------------------------------------
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
* Install AVG Anti-Spyware by double clicking the installer.
* Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
* On the main screen under Your Computer's security.
* Click on Change state next to Resident shield. It should now change to inactive.
* Click on Change state next to Automatic updates. It should now change to inactive.
* Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
* Wait until you see the Update succesfull message.
* Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
* Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
--------------------------------------------------------------------
Reboot your computer in Safe Mode.
* If the computer is running, shut down Windows, and then turn off the power.
* Wait 30 seconds, and then turn the computer on.
* Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
* Ensure that the Safe Mode option is selected.
* Press Enter. The computer then begins to start in Safe mode.
* Login on your usual account.
---------------------------------------------------------------------
Now we need to do a search.
Start > Search > For Files and Folders
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:
ddeput.exe
If any of these files are found please delete them.
---------------------------------------------------------------------------------
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
* Click on Scanner on the toolbar.
* Click on the Settings tab.
* Under How to act?
* Click on Recommended Action and choose Quarantine from the popup menu.
* Under How to scan?
* All checkboxes should be ticked.
* Under Possibly unwanted software:
* All checkboxes should be ticked.
* Under Reports:
* Select Automatically generate report after every scan and uncheck Only if threats were found.
* Under What to scan?
* Select Scan every file.
* Click on the Scan tab.
* Click on Complete System Scan to start the scan process.
* Let the program scan the machine.
* When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
* Make sure that Set all elements to: shows Quarantine
(1), if not click on the link and choose Quarantine from the popup menu. (2) *At the bottom of the window click on the Apply all Actions button. (3)
* When done, click the Save Scan Report button.
(4) *Click the Save Report as button.
* Save the report to your Desktop.
* Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot back into Normal Mode
----------------------------------------------------------------
post:
C:\combofix.txt
AVG anti-spyware log
fresh HijackThis log
|
|
AceDay
Newbie
|
11. July 2007 @ 16:50 |
Link to this message
|
Here's my latest logs and here's hoping I'm near the end. I didn't think the AVG log was gonna be so large. I appreciate your help hilu.
Hijack This log:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20040...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll
O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Combofix:
2007-07-11 14:16 <DIR> d-------- C:\Program Files\Error Expert
2007-07-10 20:23 <DIR> d-------- C:\Program Files\Lionhead Studios
2007-07-10 07:35 31,254 --a------ C:\WINDOWS\system32\rqrqnnm.dll
2007-07-10 07:17 31,254 --a------ C:\WINDOWS\system32\nnnnono.dll
2007-07-10 07:16 <DIR> d-------- C:\WINDOWS\system32\o09PrEz
2007-07-10 07:16 <DIR> d-------- C:\Program Files\svhost
2007-07-10 07:12 36,352 --a------ C:\WINDOWS\poolsv.exe
2007-07-09 09:59 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-08 23:17 60,928 --------- C:\WINDOWS\system32\rivk.dll
2007-07-08 23:17 <DIR> d--hs---- C:\WINDOWS\QWxleCBTY2h3YXJ0eg
2007-07-08 23:17 <DIR> d-------- C:\Program Files\WinPop
2007-07-08 23:14 172,032 --a------ C:\WINDOWS\system32\launvxy.dll
2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X9
2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X5
2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X4
2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X3
2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X2
2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALEXSC~1\APPLIC~1\Comodo
2007-07-05 22:49 <DIR> d-------- C:\Program Files\Comodo
2007-07-05 22:45 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-07-05 22:45 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-05 22:45 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-05 22:45 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-05 22:45 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-05 22:45 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-05 22:45 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-05 22:45 <DIR> d-------- C:\Program Files\Alwil Software
2007-07-05 20:19 135,168 --a------ C:\WINDOWS\tk58.exe
2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-07-01 13:19 <DIR> d-------- C:\VundoFix Backups
2007-06-30 18:09 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe
2007-06-28 08:43 11,776 --a------ C:\WINDOWS\mgrs.exe
2007-06-28 08:42 56,832 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfmlibal.exe
2007-06-28 08:42 4 --a------ C:\WINDOWS\system32\stfv.bin
2007-06-28 08:41 28,928 --a------ C:\WINDOWS\system32\updatetc.exe
2007-06-28 08:41 19,456 --a------ C:\WINDOWS\system32\180ax.exe
2007-06-28 08:41 17,920 --a------ C:\WINDOWS\system32\salm.exe
2007-06-28 08:41 13,312 --a------ C:\WINDOWS\saiemod.dll
2007-06-28 08:41 12 --a------ C:\WINDOWS\system32\gtv_sd.bin
2007-06-28 08:40 <DIR> d-------- C:\WINDOWS\system32\o05PrEz
2007-06-26 22:12 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-06-24 10:12 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-06-24 10:12 79,872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys
2007-06-24 10:12 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-06-24 10:12 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SalesMonitor
2007-06-24 10:08 46,592 --a------ C:\WINDOWS\oomoeke.exe
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\win
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\o02PrEz
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H5
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H4
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H3
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H2
2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H1
2007-06-24 10:08 <DIR> d-------- C:\Temp\iee
2007-06-24 10:08 <DIR> d-------- C:\Temp
2007-06-20 23:37 <DIR> d-------- C:\Program Files\iTunes
2007-06-20 23:37 <DIR> d-------- C:\Program Files\iPod
2007-06-20 23:34 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-15 14:43 53,248 --a------ C:\WINDOWS\uni_eh43.exe
2007-06-15 14:42 53,248 --a------ C:\WINDOWS\uninst1014.exe
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-11 18:42:13 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-11 04:51:59 -------- d-----w C:\Program Files\D-Tools
2007-07-11 01:46:21 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-11 00:59:08 -------- d-----w C:\Program Files\Google
2007-07-09 12:36:40 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent
2007-07-09 04:23:05 -------- d-----w C:\Program Files\Windows NT
2007-06-21 04:36:38 -------- d-----w C:\Program Files\QuickTime
2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat
2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\QWxleCBTY2h3YXJ0eg\kqU5yF1nsZ1asrLXy0.vbs
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03]
{cdc41c99-8bed-46bc-97b6-9ec228afe395}=C:\WINDOWS\System32\launvxy.dll [2007-07-08 23:14]
{F1D18367-ED25-4A59-9881-8897EE3736C9}=C:\WINDOWS\System32\awtss.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"nwiz"="nwiz.exe" []
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51]
"Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 10:42]
"COMODO firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-05 22:49]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]
"Salestart"="C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe" []
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-27 21:43]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPop"="C:\Program Files\WinPop\winpop.exe" [2007-07-08 23:17]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Internet Explorer\profsyzyzoz.html
FriendlyName=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Alerter"=3 (0x3)
"TrkWks"=2 (0x2)
"MSDTC"=3 (0x3)
"ClipSrv"=3 (0x3)
Contents of the 'Scheduled Tasks' folder
2007-07-10 22:18:01 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
|
|
AceDay
Newbie
|
11. July 2007 @ 17:08 |
Link to this message
|
I looked at my AVG log and cut out all the tracking cookies. If you think you need them give me an email and I'll send them your way. Everything else should be there from the log
HKLM\SOFTWARE\SecureWin -> Adware.Adlogix : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069547.exe -> Adware.Adstart : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069548.exe -> Adware.Adstart : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069549.exe -> Adware.Adstart : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP517\A0070640.dll -> Adware.Adstart : Cleaned with backup (quarantined).
C:\WINDOWS\system32\X5\wb73.exe -> Adware.Agent : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069550.exe -> Adware.Apropos : Cleaned with backup (quarantined).
C:\WINDOWS\QWxleCBTY2h3YXJ0eg\trzE4.tmp -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069511.exe -> Adware.EZula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-2506784691-2463499124-1038605604-1005\Software\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069535.exe -> Adware.MegaSearch : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\FNTS~1\mѕdtc.exe.vir -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Program Files\WinPop\winpop.exe -> Adware.Rond : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055206.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069487.exe -> Adware.SurfAccuracy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\H4\mwspasrt83122.exe -> Adware.TTC : Cleaned with backup (quarantined).
C:\WINDOWS\system32\X2\mwspasrt83122.exe -> Adware.TTC : Cleaned with backup (quarantined).
C:\VundoFix Backups\awtuvtr.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\efccyaa.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\gebbaya.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ljjkllk.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\vtuvurq.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\tk58.exe -> Adware.ZQuest : Cleaned with backup (quarantined).
C:\WINDOWS\system32\H3\wr620.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined).
C:\WINDOWS\trzE5.tmp -> Downloader.Agent.bls : Cleaned with backup (quarantined).
C:\WINDOWS\trzE6.tmp -> Downloader.Agent.bls : Cleaned with backup (quarantined).
C:\WINDOWS\mgrs.exe -> Downloader.Alphabet : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\driver.exe.vir -> Downloader.Alphabet.c : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sysmon32.exe -> Downloader.Alphabet.c : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\avp.exe.vir -> Downloader.Alphabet.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069496.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1162OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1716OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055195.exe -> Downloader.PurityScan.eg : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1122OinAdmin.exe.vir -> Downloader.PurityScan.eh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055193.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined).
C:\WINDOWS\b128.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\svhost.exe.vir -> Downloader.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055204.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINDOWS\b104.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\X3\w73r.exe -> Downloader.Small.eqn : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\wmvds32.dll.vir -> Downloader.VB.asx : Cleaned with backup (quarantined).
C:\WINDOWS\system32\o02PrEz\o02PrEz1065.exe -> Downloader.VB.awj : Cleaned with backup (quarantined).
C:\WINDOWS\system32\o09PrEz\o09PrEz1099.exe -> Downloader.VB.awj : Cleaned with backup (quarantined).
C:\WINDOWS\poolsv.exe -> Downloader.VB.aya : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir -> Dropper.Agent.bfr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055208.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined).
C:\WINDOWS\system32\H2\wen2.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined).
C:\WINDOWS\system32\X4\wen22.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined).
C:\WINDOWS\oomoeke.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined).
C:\WINDOWS\system32\H5\bk53.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users\Application Data\wfmlibal.exe -> Hijacker.Agent.ka : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\svchost.exe.vir -> Logger.Agent.or : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe.vir -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055203.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Network Monitor\trzE0.tmp.vir -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\Tools\Restart.exe -> Not-A-Virus.Tool.Win32.RestartCounter : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\catchme2007-07-01_134447.54.zip/core.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\catchme2007-07-11_150620.75.zip/core.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined).
C:\VundoFix Backups\fwkplyem.exe.bad -> Trojan.Agent.anr : Cleaned with backup (quarantined).
C:\VundoFix Backups\bmfhmgxa.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\boesfwcl.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\chgeawdd.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\ckyupygt.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\doiycbfb.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\msvofipf.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\pgdyxswj.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\qcnapsmx.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\vaysildi.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\VundoFix Backups\yeaeqmfa.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\winzdn32.dll.vir -> Trojan.Agent.qt : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe.vir -> Trojan.Fakealert.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055202.exe -> Trojan.Fakealert.fb : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\uninstall_nmon.vbs.vir -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055199.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\QWxleCBTY2h3YXJ0eg\kqU5yF1nsZ1asrLXy0.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\Program Files\WinPop\UnInstall.exe -> Trojan.Small.oa : Cleaned with backup (quarantined).
|
|
hilu
Junior Member
|
12. July 2007 @ 00:11 |
Link to this message
|
|
Hi
That didn't work at all.
Did you run ComboFix exactly as instructed above (it's not enough just doubleclick it)?
|
|
AceDay
Newbie
|
12. July 2007 @ 04:24 |
Link to this message
|
|
Yes, I ran Combfix as you said and so far my pc is running better than it has in a while. I wasn't even able to defrag my pc. Now it works just fine.
|
|
hilu
Junior Member
|
12. July 2007 @ 09:07 |
Link to this message
|
Hi :)
ok :)
1.
Click Start
Go to Control Panel
Go to Add/Remove Programs
Find and click Remove for the following (if present):
WinPop
2.
open HiJackThis
clic "do a system scan only"
Check the following entries (if still present) :
O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing)
O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file)
O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file)
O4 - HKLM\..\Run: [07rO3pP] ddeput.exe
O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce
O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll
O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
clic "fix checked"
-------------------------------------------------------------------
3.Please Open notepad and copy/paste the text in the quotebox below into it:
Quote:
File::
C:\WINDOWS\System32\lglwvxtf.dll
C:\WINDOWS\System32\geede.dll
C:\WINDOWS\System32\wivoxwoh.dll
C:\WINDOWS\System32\rqrrspm.dll
C:\WINDOWS\System32\awtss.dll
C:\WINDOWS\system32\rqrqnnm.dll
C:\WINDOWS\system32\nnnnono.dll
C:\WINDOWS\system32\o09PrEz
C:\WINDOWS\poolsv.exe
C:\WINDOWS\system32\rivk.dll
C:\WINDOWS\system32\launvxy.dll
C:\WINDOWS\tk58.exe
C:\WINDOWS\system32\sysmon32.exe
C:\WINDOWS\mgrs.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfmlibal.exe
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\updatetc.exe
C:\WINDOWS\system32\180ax.exe
C:\WINDOWS\system32\salm.exe
C:\WINDOWS\saiemod.dll
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\drivers\FOPN.sys
C:\WINDOWS\oomoeke.exe
C:\WINDOWS\uni_eh43.exe
C:\WINDOWS\uninst1014.exe
Folder::
C:\WINDOWS\QWxleCBTY2h3YXJ0eg
C:\WINDOWS\system32\X9
C:\WINDOWS\system32\X5
C:\WINDOWS\system32\X4
C:\WINDOWS\system32\X3
C:\WINDOWS\system32\X2
C:\VundoFix Backups
C:\WINDOWS\system32\o05PrEz
C:\WINDOWS\system32\o02PrEz
C:\WINDOWS\system32\H5
C:\WINDOWS\system32\H4
C:\WINDOWS\system32\H3
C:\WINDOWS\system32\H2
C:\WINDOWS\system32\H1
C:\WINDOWS\QWxleCBTY2h3YXJ0eg
C:\Program Files\WinPop
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Salestart"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPop"=-
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot (in case it asks to reboot),
---------------------------------------------------------------------------
Reboot your computer in Safe Mode.
If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.
-----------------------------------------------------------------------
Now we need to do a search.
Start > Search > For Files and Folders
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:
ddeput.exe
If any of these files are found please delete them.
Reboot back into Normal Mode
---------------------------------------------------------------------
post:
Combofix.txt
fresh hiJackThis log
|
|
Advertisement
|
|
|
|
AceDay
Newbie
|
29. July 2007 @ 18:41 |
Link to this message
|
I apologize about the long wait but here are the two logs you have asked for:
Hijack this:
Logfile of HijackThis v1.99.1
Scan saved at 9:36:10 PM, on 07/29/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Alex Schwartz\Desktop\Stuff\Jack This.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {cdc41c99-8bed-46bc-97b6-9ec228afe395} - C:\WINDOWS\System32\launvxy.dll
O2 - BHO: (no name) - {DCD53738-C4F9-414A-A03C-C7405A4AC844} - C:\WINDOWS\System32\opnkjif.dll (file missing)
O2 - BHO: (no name) - {F116E937-5F68-4D7E-9647-14BD1A1C934F} - C:\WINDOWS\System32\geeba.dll (file missing)
O2 - BHO: (no name) - {F1D18367-ED25-4A59-9881-8897EE3736C9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Arun] "C:\WINDOWS\STEM32~1\dllhost.exe" -vt yazb
O4 - HKCU\..\Run: [Dripaks] "C:\Documents and Settings\Alex Schwartz\My Documents\?icrosoft.NET\?canregw.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantispyware.com
O15 - Trusted Zone: *.winantivirus.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/i...ckerutility.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: opnkjif - opnkjif.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Combo Fix:
2007-07-29 11:29 66,112 --a------ C:\WINDOWS\system32\nrkowsgk.exe
2007-07-28 07:20 66,112 --a------ C:\WINDOWS\system32\chbslgrm.exe
2007-07-27 07:19 66,112 --a------ C:\WINDOWS\system32\ydichukr.exe
2007-07-27 07:18 66,112 --a------ C:\WINDOWS\system32\xvhkjqcy.exe
2007-07-25 20:23 66,624 --a------ C:\WINDOWS\system32\dhpwijje.dll
2007-07-25 20:18 66,112 --a------ C:\WINDOWS\system32\jikpgsoc.exe
2007-07-25 07:29 31,254 --a------ C:\WINDOWS\system32\gebbyxv.dll
2007-07-25 07:29 1,126,352 -r-hs---- C:\WINDOWS\oomoekeA.exe
2007-07-25 07:29 d-------- C:\WINDOWS\system32\T9
2007-07-25 07:29 d-------- C:\WINDOWS\system32\T5
2007-07-25 07:29 d-------- C:\WINDOWS\system32\T11
2007-07-25 07:29 d-------- C:\WINDOWS\system32\b02FdUe
2007-07-25 07:29 d-------- C:\Temp\brr
2007-07-25 07:29 d-------- C:\Temp\0c2
2007-07-22 19:30 d-------- C:\Program Files\GameSpy Arcade
2007-07-22 19:27 d-------- C:\Program Files\Microsoft Games
2007-07-21 21:49 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-07-21 21:49 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-07-21 21:49 18,436 --a------ C:\WINDOWS\DIIUnin.dat
2007-07-21 21:42 d-------- C:\Program Files\Diablo II
2007-07-21 21:24 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-07-21 21:24 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-07-21 21:24 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-07-19 00:42 d-------- C:\Program Files\iPod
2007-07-19 00:41 d-------- C:\Program Files\iTunes
2007-07-19 00:40 d-------- C:\Program Files\QuickTime
2007-07-19 00:38 d-------- C:\Program Files\Apple Software Update
2007-07-19 00:38 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-11 14:16 d-------- C:\Program Files\Error Expert
2007-07-10 07:35 31,254 --a------ C:\WINDOWS\system32\rqrqnnm.dll
2007-07-10 07:17 31,254 --a------ C:\WINDOWS\system32\nnnnono.dll
2007-07-10 07:16 d-------- C:\WINDOWS\system32\o09PrEz
2007-07-10 07:16 d-------- C:\Program Files\svhost
2007-07-09 09:59 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-08 23:17 d--hs---- C:\WINDOWS\QWxleCBTY2h3YXJ0eg
2007-07-08 23:14 171,520 --a------ C:\WINDOWS\system32\launvxy.dll
2007-07-08 23:13 d-------- C:\WINDOWS\system32\X9
2007-07-08 23:13 d-------- C:\WINDOWS\system32\X5
2007-07-08 23:13 d-------- C:\WINDOWS\system32\X4
2007-07-08 23:13 d-------- C:\WINDOWS\system32\X3
2007-07-08 23:13 d-------- C:\WINDOWS\system32\X2
2007-07-05 22:56 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-07-05 22:56 d-------- C:\DOCUME~1\ALEXSC~1\APPLIC~1\Comodo
2007-07-05 22:49 d-------- C:\Program Files\Comodo
2007-07-05 22:45 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-07-05 22:45 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-05 22:45 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-05 22:45 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-05 22:45 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-05 22:45 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-05 22:45 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-05 22:45 d-------- C:\Program Files\Alwil Software
2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-07-01 13:19 d-------- C:\VundoFix Backups
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-29 22:48:47 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-26 01:31:12 -------- d-----w C:\Program Files\Windows NT
2007-07-22 02:35:33 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-19 05:18:40 -------- d-----w C:\Program Files\CCleaner
2007-07-19 05:10:30 -------- d-----w C:\Program Files\Yahoo!
2007-07-11 01:46:21 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-10 12:34:17 79,872 ----a-w C:\WINDOWS\system32\drivers\FOPN.sys
2007-07-09 12:36:40 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent
2007-07-06 04:12:13 4 ----a-w C:\WINDOWS\system32\stfv.bin
2007-06-30 01:24:50 -------- d-----w C:\Program Files\Enigma Software Group
2007-06-28 13:41:59 19,456 ----a-w C:\WINDOWS\system32\180ax.exe
2007-06-28 13:41:57 28,928 ----a-w C:\WINDOWS\system32\updatetc.exe
2007-06-28 13:41:57 17,920 ----a-w C:\WINDOWS\system32\salm.exe
2007-06-28 13:41:50 13,312 ----a-w C:\WINDOWS\saiemod.dll
2007-06-28 13:41:39 12 ----a-w C:\WINDOWS\system32\gtv_sd.bin
2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat
2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX
2007-06-15 19:43:08 53,248 ----a-w C:\WINDOWS\uni_eh43.exe
2007-06-15 19:42:02 53,248 ----a-w C:\WINDOWS\uninst1014.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03]
{cdc41c99-8bed-46bc-97b6-9ec228afe395}=C:\WINDOWS\System32\launvxy.dll [2007-07-25 07:29]
{DCD53738-C4F9-414A-A03C-C7405A4AC844}=C:\WINDOWS\System32\opnkjif.dll []
{F116E937-5F68-4D7E-9647-14BD1A1C934F}=C:\WINDOWS\System32\geeba.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51]
"Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51]
"IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 10:42]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-05 22:49]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Arun"="C:\WINDOWS\STEM32~1\dllhost.exe" []
"Dripaks"="C:\Documents and Settings\Alex Schwartz\My Documents\?icrosoft.NET\?canregw.exe" []
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Internet Explorer\profsyzyzoz.html
FriendlyName=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29]
"{DCD53738-C4F9-414A-A03C-C7405A4AC844}"="C:\WINDOWS\System32\opnkjif.dll" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnkjif]
opnkjif.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Alerter"=3 (0x3)
"TrkWks"=2 (0x2)
"MSDTC"=3 (0x3)
"ClipSrv"=3 (0x3)
Contents of the 'Scheduled Tasks' folder
2007-07-20 03:21:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-29 21:39:23
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
|
|
