|
|
|
Virus/Spyware Help
|
|
|
4runnerda
Newbie
|
7. October 2008 @ 21:44 |
Link to this message
|
Here is my logfile - I don't know where to startsn
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:35:04 PM, on 10/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Administrator\Desktop\Scanner(.exe)\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O3 - Toolbar: dkwqgnbe - {DC51F59F-D0BA-4CE7-8CDB-15ABF290546E} - C:\WINDOWS\dkwqgnbe.dll
O3 - Toolbar: peltodgx - {0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - C:\WINDOWS\peltodgx.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [28bae072] rundll32.exe "C:\WINDOWS\system32\tedxecrb.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - AppInit_DLLs: yxtmuw.dll
O21 - SSODL: xgpsarbm - {6ED6D4EF-44FF-414D-86E2-03B22C0D5145} - C:\WINDOWS\xgpsarbm.dll
O21 - SSODL: neksolda - {E5948172-3E31-4B6A-9410-EFD9792EC8C3} - C:\WINDOWS\neksolda.dll
O21 - SSODL: onfwbsak - {969B147E-41A9-45B8-BFBF-8DA229350FDE} - C:\WINDOWS\onfwbsak.dll
O21 - SSODL: rwlfsdmk - {81A9EEB3-7D6E-4DE5-A0ED-E2475C093CEC} - C:\WINDOWS\rwlfsdmk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: dkab_device - Dell - C:\WINDOWS\system32\DKabcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
--
End of file - 6685 bytes
David
|
Senior Member
|
8. October 2008 @ 08:59 |
Link to this message
|
Hi 4runnerda
From your hijackthis log, you are infected. Are there any symptoms?
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
4runnerda
Newbie
|
9. October 2008 @ 00:28 |
Link to this message
|
It all started when my PC got several popups stating that I was infected and to " click yes" to run a virus program - I didn't. But by then it was too late - i had several new shortcuts on my desktop - pop up blockers, virus scans, etc. and in my system tray instead of the time, it displayed "You are Infected with a virus"
I am having to run in SAfe mode.
Thanks in Advance for your help
ComboFix 08-10-08.02 - Administrator 2008-10-08 21:17:26.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.121 [GMT -5:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Owner\Application Data\EHAES8121.dll
C:\Documents and Settings\Owner\Application Data\EHBase648121.dll
C:\Documents and Settings\Owner\Application Data\EHTLEncryption4401.dll
C:\Documents and Settings\Owner\Application Data\EHTLStreams4401.dll
C:\Documents and Settings\Owner\Application Data\EHZComp8121.dll
C:\Documents and Settings\Owner\Application Data\EHZStream8121.dll
C:\Documents and Settings\Owner\Application Data\MBSDeclarePlugin4707.dll
C:\Documents and Settings\Owner\Application Data\MBSRegistrationPlugin4987.dll
C:\Documents and Settings\Owner\Application Data\MBSWinPlugin5046.dll
C:\Documents and Settings\Owner\Application Data\nphost1101.dll
C:\Documents and Settings\Owner\Application Data\rbap550.dll
C:\Documents and Settings\Owner\Application Data\RBInternetEncodings550.dll
C:\Documents and Settings\Owner\Application Data\RBShell550.dll
C:\Documents and Settings\Owner\Application Data\RBSSLSocket550.dll
C:\Documents and Settings\Owner\Application Data\RBXML550.dll
C:\Documents and Settings\Owner\Application Data\V4RB.dll
C:\WINDOWS\dkwqgnbe.dll
C:\WINDOWS\eepa.exe
C:\WINDOWS\evqb.exe
C:\WINDOWS\fbxrqtwn.exe
C:\WINDOWS\fkebanrw.exe
C:\WINDOWS\hosts
C:\WINDOWS\IE4 Error Log.txt
C:\WINDOWS\onfwbsak.dll
C:\WINDOWS\peltodgx.dll
C:\WINDOWS\rwlfsdmk.dll
C:\WINDOWS\system32\aGjSAcfe.ini
C:\WINDOWS\system32\aGjSAcfe.ini2
C:\WINDOWS\system32\ajggjwbf.dll
C:\WINDOWS\system32\brcexdet.ini
C:\WINDOWS\system32\ddcbCRij.dll
C:\WINDOWS\system32\ddeokyeg.ini
C:\WINDOWS\system32\efcASjGa.dll
C:\WINDOWS\system32\ejmbqf.dll
C:\WINDOWS\system32\geykoedd.dll
C:\WINDOWS\system32\oVwyHRqr.ini
C:\WINDOWS\system32\oVwyHRqr.ini2
C:\WINDOWS\system32\rqRHywVo.dll
C:\WINDOWS\system32\TDSSerrors.log
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\yaanrkwa.dll
C:\WINDOWS\system32\yxtmuw.dll
C:\WINDOWS\xgpsarbm.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 )))))))))))))))))))))))))))))))
.
2008-10-07 23:20 . 2008-10-07 23:20 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-10-07 23:20 . 2008-10-07 23:20 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy)
2008-10-07 20:11 . 2008-10-07 20:11 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-10-07 20:10 . 2008-10-07 20:12 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-10-07 06:30 . 2008-10-07 06:30 <DIR> d-------- C:\WINDOWS\CRYSTAL
2008-10-07 06:30 . 2008-10-07 06:30 <DIR> d-------- C:\Program Files\Seagate Software
2008-10-04 09:26 . 2008-10-07 20:10 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-03 23:37 . 2005-09-08 16:26 1,406,112 --a------ C:\WINDOWS\system32\FPSPR70.ocx
2008-10-03 23:37 . 2001-11-20 11:29 571,096 --a------ C:\WINDOWS\system32\Cal32x30.ocx
2008-10-03 23:37 . 2002-01-03 11:02 337,672 --a------ C:\WINDOWS\system32\SSTree.ocx
2008-10-03 23:37 . 2000-07-15 00:00 311,296 --a------ C:\WINDOWS\system32\MSDBRPT.DLL
2008-10-03 23:37 . 2000-12-06 00:00 209,608 --a------ C:\WINDOWS\system32\tabctl32.ocx
2008-10-03 23:37 . 2001-05-30 16:42 194,248 --a------ C:\WINDOWS\system32\ssscrl30.ocx
2008-10-03 23:37 . 2001-05-30 16:43 181,960 --a------ C:\WINDOWS\system32\sssplt30.ocx
2008-10-03 23:37 . 2001-05-30 16:41 153,288 --a------ C:\WINDOWS\system32\ssresz30.ocx
2008-10-03 23:36 . 2008-10-03 23:36 <DIR> d-------- C:\Program Files\Wiley
2008-10-03 19:25 . 2008-10-03 19:25 <DIR> d-------- C:\Program Files\Apple Software Update
2008-10-03 19:20 . 2008-10-03 19:21 <DIR> d-------- C:\Program Files\iTunes
2008-10-03 19:20 . 2008-10-03 19:20 <DIR> d-------- C:\Program Files\iPod
2008-10-03 19:20 . 2008-10-03 19:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 19:13 . 2008-10-03 19:13 <DIR> d-------- C:\Program Files\Bonjour
2008-10-03 19:08 . 2008-10-03 19:11 <DIR> d-------- C:\Program Files\QuickTime
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-08 04:38 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-08 04:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-04 19:11 --------- d-----w C:\Documents and Settings\Owner\Application Data\SiteAdvisor
2008-10-04 00:09 --------- d-----w C:\Program Files\Common Files\Apple
2008-10-03 23:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-10-03 23:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-03 23:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-03 14:49 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\SiteAdvisor
2008-09-14 02:22 --------- d-----w C:\Program Files\McAfee
2008-09-06 21:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
2007-03-25 21:50 23,520 -c--a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2006-07-24 02:41 26,624 -c-ha-w C:\Documents and Settings\Owner\Application Data\EHGuid.dll
2006-07-24 02:41 245,760 -c-ha-w C:\Documents and Settings\Owner\Application Data\HttpProxyPlugin.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"McAfee QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [2004-08-25 94208]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 126976]
"Dell AIO Printer A940"="C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"iRiver Updater"="\Updater.exe" [2004-07-01 212992]
"D-Link AirPlus XtremeG"="C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2004-10-27 987136]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-14 45056]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe" [2005-03-23 1111040]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 C:\WINDOWS\BCMSMMSG.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ejmbqf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Microsoft SQL Server\\MSSQL\\Binn\\sqlservr.exe"=
"C:\\WINDOWS\\system32\\DKabcoms.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:Shareaza
"6346:UDP"= 6346:UDP:Shareaza
S3 A5AGU;D-Link USB Wireless Network Adapter Service;C:\WINDOWS\system32\DRIVERS\A5AGU.sys [2004-10-06 283904]
S3 ATHFMWDL;D-Link predator Bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys [2004-10-04 43392]
S3 dkab_device;dkab_device;C:\WINDOWS\system32\DKabcoms.exe [2005-05-23 487424]
.
Contents of the 'Scheduled Tasks' folder
2008-10-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-09-15 C:\WINDOWS\Tasks\McDefragTask.job
- C:\WINDOWS\system32\defrag.exe [2004-08-04 02:56]
2008-10-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -
BHO-{622DC620-E7AA-4A5A-A8A5-5E79745CAE61} - C:\WINDOWS\system32\rqRHywVo.dll
BHO-{674855C3-B0B1-4413-9BB4-BFA6A9B5257B} - C:\WINDOWS\system32\iifgEuRl.dll
BHO-{78F2D3BD-ADAC-4BB1-8503-E94279050E59} - C:\WINDOWS\system32\efcASjGa.dll
BHO-{8e3f9ef7-7478-4c40-b06b-e6fc1baed8c1} - C:\WINDOWS\system32\ejmbqf.dll
Toolbar-{DC51F59F-D0BA-4CE7-8CDB-15ABF290546E} - C:\WINDOWS\dkwqgnbe.dll
Toolbar-{0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - C:\WINDOWS\peltodgx.dll
HKCU-Run-Sonic RecordNow! - (no file)
HKCU-Run-Aim6 - (no file)
HKLM-Run-tgcmd - C:\Program Files\Support.com\bin\tgcmd.exe
HKLM-Run-ISUSPM - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKLM-Run-28bae072 - C:\WINDOWS\system32\geykoedd.dll
ShellExecuteHooks-{674855C3-B0B1-4413-9BB4-BFA6A9B5257B} - C:\WINDOWS\system32\iifgEuRl.dll
SSODL-xgpsarbm-{6ED6D4EF-44FF-414D-86E2-03B22C0D5145} - C:\WINDOWS\xgpsarbm.dll
SSODL-neksolda-{E5948172-3E31-4B6A-9410-EFD9792EC8C3} - C:\WINDOWS\neksolda.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\w8f1ev25.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-08 21:33:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Updater.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-10-08 21:43:39 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2008-10-09 02:43:30
Pre-Run: 18,650,562,560 bytes free
Post-Run: 18,960,769,024 bytes free
217 --- E O F --- 2008-09-10 08:03:20
David
|
|
Advertisement
|
|
|
Senior Member
|
9. October 2008 @ 01:25 |
Link to this message
|
Hey 4runnerda
Please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
