|
|
|
Need help before it gets worse
|
|
|
felix100
Member
|
16. September 2008 @ 05:47 |
Link to this message
|
Well, lately my internet has been running very slow and sometimes it won't even work and from time to time a window pops up telling me to install some antivirus program to clean the computer but im pretty sure it's a virus, this hasnt happened before. The point is my internet is not working, it will sometimes but most of the time it's too slow to be able to use it. Im guessing this is because of a virus.
After this happened i installed Lavasoft Ad-aware and did a scan, found about 80 infected files which was removed. Then i installed COMODO firewall pro and did a scan there, found a few viruses that was removed aswell. And after that i installed Windows defender, which also found some infected files. But my internet is still not working properly. Have i forgot to do something?
And one more thing, for some reason i can't install windows updates. At the bottom of the screen theres a red shield with a cross in it and i double click it and it says automatic updates are disabled. When i press "activate automatic updates" i get an error message telling me to enable them manually through the configuration panel but it says its already activated.
I heard something about a program called hijackthis. Is that something i need?
This message has been edited since posting. Last time this message was edited on 16. September 2008 @ 05:52
|
|
Advertisement
|
 |
|
|
Senior Member
|
16. September 2008 @ 10:17 |
Link to this message
|
Hi felix100
HijackThis is precisely what you need. However, let's do some cleanup first.
First, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
After that, please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file.
Rename HijackThis(.exe) to scanner(.exe).
Next, run scanner(.exe). A window will pop up.
? Click on the button which says Main Menu, then Do a system scan and save a logfile.
? Please wait for the scan to be completed.
? After the scan has completed, a text window will pop up. Please post the contents of this window here.
This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved.
NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
felix100
Member
|
17. September 2008 @ 05:18 |
Link to this message
|
Heres the combofix log:
ComboFix 08-09-16.03 - Malmberg 2008-09-17 10:57:44.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.1453 [GMT 2:00]
Running from: C:\Documents and Settings\Malmberg\Skrivbord\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program\Delade filer\{A8470~1
C:\Program\RichVideoCodec
C:\WINDOWS\BMab743e51.txt
C:\WINDOWS\BMab743e51.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\afxugkmm.dll
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\fPXIRXbc.ini
C:\WINDOWS\system32\fPXIRXbc.ini2
C:\WINDOWS\system32\fthbhilp.ini
C:\WINDOWS\system32\hckvtpan.dll
C:\WINDOWS\system32\lolmvflr.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ofmicogp.dll
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\plihbhtf.dll
C:\WINDOWS\system32\qkxjjvwy.ini
C:\WINDOWS\system32\qrapbsle.ini
C:\WINDOWS\system32\qslyhtuw.ini
C:\WINDOWS\system32\tmp34.tmp
C:\WINDOWS\system32\uodiec.dll
C:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_XPROTECTOR
-------\Service_NPF
-------\Service_XPROTECTOR
((((((((((((((((((((((((( Files Created from 2008-08-17 to 2008-09-17 )))))))))))))))))))))))))))))))
.
2008-09-16 11:31 . 2008-09-16 11:32 <KAT> d-------- C:\Program\Privoxy
2008-09-15 22:33 . 2008-09-15 22:33 <KAT> d-------- C:\Program\Windows Defender
2008-09-15 19:24 . 2008-09-15 19:24 2,367,664 ---hs---- C:\WINDOWS\system32\ppiycfrf.tmp
2008-09-15 19:01 . 2008-09-15 19:02 <KAT> d-------- C:\Program\CCleaner
2008-09-15 15:36 . 2008-09-15 15:36 <KAT> d-------- C:\Program\AskSBar
2008-09-15 15:36 . 2008-09-15 15:36 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll
2008-09-15 15:35 . 2008-09-15 15:36 <KAT> d-------- C:\Program\COMODO
2008-09-15 15:35 . 2008-09-15 15:35 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\Comodo
2008-09-15 15:35 . 2008-09-15 15:55 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-09-15 15:35 . 2008-09-15 15:35 143,104 --a------ C:\WINDOWS\system32\guard32.dll
2008-09-15 15:35 . 2008-09-15 15:35 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-09-15 15:35 . 2008-09-15 15:35 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-09-15 15:31 . 2008-09-15 15:31 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-09-15 15:31 . 2008-09-15 15:31 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-09-15 15:30 . 2008-09-15 16:58 <KAT> d-------- C:\WINDOWS\system32\ZoneLabs
2008-09-15 15:30 . 2008-09-15 16:58 <KAT> d-------- C:\WINDOWS\Internet Logs
2008-09-15 12:36 . 2008-09-15 12:36 <KAT> d-------- C:\Program\Lavasoft
2008-09-15 12:36 . 2008-09-15 12:36 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-15 12:32 . 2008-09-15 12:32 <KAT> d-------- C:\Program\Panda Security
2008-09-15 12:32 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-14 19:32 . 2008-09-14 19:32 111,616 --a------ C:\WINDOWS\system32\svvjga.dll
2008-09-14 19:32 . 2008-09-14 19:32 111,616 --a------ C:\WINDOWS\system32\fslxffbb.dll
2008-09-14 11:27 . 2008-09-14 11:27 <KAT> d-------- C:\Program\Personal
2008-09-14 11:25 . 2008-09-14 11:25 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\TiFiC
2008-09-14 11:24 . 2008-09-14 11:24 <KAT> d-------- C:\Program\TiFiC
2008-09-14 11:24 . 2008-09-14 11:25 <KAT> d-------- C:\Program\Delade filer\TiFiC
2008-09-13 16:23 . 2008-02-26 14:01 294,912 --------- C:\WINDOWS\system32\dllcache\msctf.dll
2008-09-13 16:08 . 2008-09-13 16:08 <KAT> d-------- C:\WINDOWS\system32\sv-se
2008-09-12 19:23 . 2008-09-12 19:23 112,640 --a------ C:\WINDOWS\system32\lpxqphog.dll
2008-09-12 19:23 . 2008-09-12 19:23 112,640 --a------ C:\WINDOWS\system32\amzotq.dll
2008-09-10 20:44 . 2008-09-15 12:21 <KAT> d-------- C:\Documents and Settings\Malmberg\.housecall6.6
2008-09-10 13:00 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\system32\XAudio2_1.dll
2008-09-10 13:00 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\system32\XAPOFX1_0.dll
2008-09-10 09:52 . 2008-09-10 09:52 155,648 --a------ C:\WINDOWS\system32\CodecBHO.dll
2008-09-03 15:54 . 2008-09-03 15:55 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\SPORE
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-17 09:05 --------- d-----w C:\Program\Lx_cats
2008-09-17 09:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-16 16:51 --------- d-----w C:\Program\Steam
2008-09-15 14:49 --------- d--h--w C:\Program\InstallShield Installation Information
2008-09-15 10:35 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard
2008-09-12 10:35 --------- d-----w C:\Program\Java
2008-09-10 11:23 --------- d-----w C:\Documents and Settings\Malmberg\Application Data\Azureus
2008-09-08 20:21 --------- d-----w C:\Program\ModMan
2008-08-07 17:27 --------- d-----w C:\Program\Delade filer\Adobe
2008-08-07 17:25 --------- d-----w C:\Program\NVIDIA Corporation
2008-08-02 00:59 0 ----a-w C:\Documents and Settings\Malmberg\jagex_runescape_preferences.dat
2008-04-10 10:23 22,328 ----a-w C:\Documents and Settings\Malmberg\Application Data\PnkBstrK.sys
2007-02-19 17:06 46 ----a-w C:\Documents and Settings\Malmberg\test.bat
2007-06-13 13:23 933,888 --sh--r C:\WINDOWS\system32\sdchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 1694208]
"swg"="C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 68856]
"DAEMON Tools Pro Agent"="C:\Program\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 133576]
"ISUSPM"="C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" [2006-09-10 218032]
"Start WingMan Profiler"="C:\Program\Logitech\Profiler\lwemon.exe" [2006-07-05 60416]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"WMPNSCFG"="C:\Program\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"IntelMeM"="C:\Program\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="C:\Program\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"DMXLauncher"="C:\Program\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"ISUSPM Startup"="C:\Program\DELADE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-09-10 218032]
"ISUSScheduler"="C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" [2006-09-10 86960]
"lxcdmon.exe"="C:\Program\Lexmark 6300 Series\lxcdmon.exe" [2005-06-24 200704]
"EzPrint"="C:\Program\Lexmark 6300 Series\ezprint.exe" [2005-07-05 94208]
"FaxCenterServer"="C:\Program\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 299008]
"Windows Media Connect 2"="C:\Program\Windows Media Connect 2\WMCCFG.exe" [2006-10-18 8704]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-01-25 77824]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008]
"PWRISOVM.EXE"="C:\Program\PowerISO\PWRISOVM.EXE" [2006-07-29 188416]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"nod32kui"="C:\Program\Eset\nod32kui.exe" [2007-05-16 949376]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112]
"COMODO SafeSurf"="C:\Program\COMODO\SafeSurf\cssurf.exe" [2008-09-15 278264]
"COMODO Firewall Pro"="C:\Program\COMODO\Firewall\cfp.exe" [2008-09-15 1655552]
"LXCDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll" [2005-07-11 69632]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl]
"nwiz"="nwiz.exe" [2007-10-04 C:\WINDOWS\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2004-03-11 C:\WINDOWS\system32\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 C:\WINDOWS\system32\CTXFIHLP.EXE]
"Download Manager"="sdchost.exe" [2007-06-13 C:\WINDOWS\system32\sdchost.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Download Manager"="sdchost.exe" [2007-06-13 C:\WINDOWS\system32\sdchost.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
C:\Documents and Settings\Malmberg\Start-meny\Program\Autostart\
Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
Privoxy.lnk - C:\Program\Privoxy\privoxy.exe [2008-08-17 301056]
Registration Lock On [2007-04-20 0]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Gamma Loader.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
Certificate Mover.lnk - C:\Program\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe [2005-11-25 126976]
Personal.lnk - C:\Program\Personal\bin\Personal.exe [2008-09-14 910864]
Service Manager.lnk - C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
ZDWLan Utility.lnk - C:\Program\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2006-08-23 475136]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\lxcdcoms.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcdPSWX.EXE"=
"C:\\Program\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program\\BitLord\\BitLord.exe"=
"C:\\Program\\Messenger\\msmsgs.exe"=
"C:\\Program\\Azureus\\Azureus.exe"=
"C:\\Spel\\Lock on\\LockOn.exe"=
"C:\\Program\\DAP\\DAP.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\day of defeat source\\hl2.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\counter-strike source\\hl2.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program\\MSN Messenger\\livecall.exe"=
"C:\\Program\\Steam\\Steam.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\source sdk base\\hl2.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\half-life 2\\hl2.exe"=
"C:\\Spel\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Spel\\Live For Speed\\LFS.exe"=
"C:\\Program\\DC++\\DCPlusPlus.exe"=
"C:\\Documents and Settings\\Malmberg\\Skrivbord\\LfsRevLimiter.0.3.exe"=
"C:\\Documents and Settings\\Malmberg\\Skrivbord\\LfsRevLimiter.0.9.exe"=
"C:\\Program\\Steam\\SteamApps\\fmalmberg\\source sdk base 2007\\hl2.exe"=
"C:\\Program\\Steam\\SteamApps\\SourceMods\\Condition Zero\\hl.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"12888:TCP"= 12888:TCP:12888
"6889:TCP"= 6889:TCP:6889
"43594:TCP"= 43594:TCP:43594
"33627:TCP"= 33627:TCP:33627
"33627:UDP"= 33627:UDP:33627
"10308:TCP"= 10308:TCP:10308
"63392:UDP"= 63392:UDP:LFS?
"63392:TCP"= 63392:TCP:63392
"29332:UDP"= 29332:UDP:29332
"29332:TCP"= 29332:TCP:29332 TCP
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 35328]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-09-15 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-09-15 24208]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-07-08 33952]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 98304]
R2 MSSQL$INVENTORCONTENT;MSSQL$INVENTORCONTENT;C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe [2002-12-17 7520337]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-20 118784]
R3 chdrvr01;CH Control Manager Driver 1;C:\WINDOWS\system32\DRIVERS\chdrvr01.sys [2004-09-14 198880]
R3 chdrvr02;CH Control Manager Driver 2;C:\WINDOWS\system32\DRIVERS\chdrvr02.sys [2001-10-30 3712]
R3 chdrvr03;CH Control Manager Driver 3;C:\WINDOWS\system32\DRIVERS\chdrvr03.sys [2001-10-30 7584]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 20608]
S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2006-04-23 29184]
S3 NPF;Netgroup Packet Filter;C:\WINDOWS\system32\drivers\npf.sys [ ]
S3 NPUSB;NPUSB;C:\WINDOWS\system32\DRIVERS\npusb.sys [2007-03-23 22816]
S3 PAP(ZyDas);PAP Blue USB Driver (ZyDas);C:\WINDOWS\system32\DRIVERS\PAPBlue.sys [2005-10-28 402432]
S3 SQLAgent$INVENTORCONTENT;SQLAgent$INVENTORCONTENT;C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE [2002-12-17 311872]
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-08-17 330240]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
BHO-{0dccb97f-924a-45b4-9f2f-49cbeea03a54} - C:\WINDOWS\system32\uodiec.dll
BHO-{286BD0FE-2946-46E5-BA43-ECBD3D6DFF5F} - C:\WINDOWS\system32\cbXRIXPf.dll
BHO-{88BF540D-0CFD-453A-8FFE-A352132EEEBE} - C:\Documents and Settings\Malmberg\Lokala inställningar\Temporary Internet Files\Content.IE5\YZE0A0SZ\silent.dll[1].bak
BHO-{DABB1C43-1596-49C4-9E4D-51AE7A1518BB} - C:\WINDOWS\system32\ssqQkHAS.dll
BHO-{E37B713E-B4BE-4DA8-864A-2F385F6EA724} - C:\Documents and Settings\Malmberg\Lokala inställningar\Temporary Internet Files\Content.IE5\YZE0A0SZ\silent.dll[1].bak
HKLM-Run-a8470dcd - C:\WINDOWS\system32\plihbhtf.dll
HKLM-Run-NWEReboot - (no file)
HKLM-Run-NaturalPoint - (no file)
ShellExecuteHooks-{DABB1C43-1596-49C4-9E4D-51AE7A1518BB} - C:\WINDOWS\system32\ssqQkHAS.dll
Notify-ssqQkHAS - ssqQkHAS.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Malmberg\Application Data\Mozilla\Firefox\Profiles\ycp98e9v.default\
FF -: plugin - C:\Program\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program\Mozilla Firefox\plugins\NPAskSBr.dll
FF -: plugin - C:\Program\Personal\bin\np_prsnl.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-17 11:04:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCDCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program\Windows Defender\MsMpEng.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\COMODO\Firewall\cmdagent.exe
C:\Program\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\SmartScaps.exe
C:\Program\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\lxcdcoms.exe
.
**************************************************************************
.
Completion time: 2008-09-17 11:11:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-17 09:11:41
Pre-Run: 124,528,541,696 byte ledigt
Post-Run: 133,441,019,904 byte ledigt
294 --- E O F --- 2008-08-14 23:46:37
|
|
felix100
Member
|
17. September 2008 @ 05:24 |
Link to this message
|
Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:27, on 2008-09-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program\Dell\Media Experience\DMXLauncher.exe
C:\Program\Lexmark 6300 Series\lxcdmon.exe
C:\Program\PowerISO\PWRISOVM.EXE
C:\Program\DAEMON Tools\daemon.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\sdchost.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe
C:\Program\Logitech\Profiler\lwemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Windows Media Player\WMPNSCFG.exe
C:\Program\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\Program\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe
C:\Program\Eset\nod32krn.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program\Privoxy\privoxy.exe
C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\Smartscaps.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\lxcdcoms.exe
C:\WINDOWS\explorer.exe
C:\Program\internet explorer\iexplore.exe
C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Malmberg\Skrivbord\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\Program\DELADE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [lxcdmon.exe] "C:\Program\Lexmark 6300 Series\lxcdmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program\Lexmark 6300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Download Manager] sdchost.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [LXCDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll,_RunDLLEntry@16
O4 - HKLM\..\RunServices: [Download Manager] sdchost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Privoxy.lnk = C:\Program\Privoxy\privoxy.exe
O4 - Startup: Registration Lock On
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Certificate Mover.lnk = ?
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O4 - Global Startup: Service Manager.lnk = C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O15 - Trusted Zone: *.handelsbanken.se
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDown.../sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housec...ivex/hcImpl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDown.../sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b...5/Installer.exe
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program\Delade filer\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: lxcd_device - Unknown owner - C:\WINDOWS\system32\lxcdcoms.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe
--
End of file - 13500 bytes
|
|
felix100
Member
|
17. September 2008 @ 05:28 |
Link to this message
|
|
So what do i do next? And thanks for helping.
|
Senior Member
|
17. September 2008 @ 06:08 |
Link to this message
|
Hey felix100
Malware still lurks there. Let's try to clean it with a separate scanner.
Please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
felix100
Member
|
17. September 2008 @ 12:15 |
Link to this message
|
Here's the SUPERAntiSpyware log (the scan was run in safe mode):
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 09/17/2008 at 05:47 PM
Application Version : 4.21.1004
Core Rules Database Version : 3570
Trace Rules Database Version: 1558
Scan type : Complete Scan
Total Scan Time : 02:42:54
Memory items scanned : 164
Memory threats detected : 0
Registry items scanned : 7499
Registry threats detected : 29
File items scanned : 292673
File threats detected : 19
Unclassified.Oreans32
HKLM\System\ControlSet001\Services\oreans32
C:\WINDOWS\SYSTEM32\DRIVERS\OREANS32.SYS
HKLM\System\ControlSet001\Enum\Root\LEGACY_oreans32
HKLM\System\ControlSet003\Services\oreans32
HKLM\System\ControlSet003\Enum\Root\LEGACY_oreans32
HKLM\System\CurrentControlSet\Services\oreans32
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_oreans32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Driver
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\LogConf
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control
HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Type
HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Start
HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ErrorControl
HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ImagePath
HKLM\SYSTEM\CurrentControlSet\Services\oreans32#DisplayName
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security#Security
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#NextInstance
Adware.Tracking Cookie
C:\Documents and Settings\Malmberg\Cookies\malmberg@msnportal.112.2o7[2].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@track.adform[2].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[4].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[2].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@atdmt[3].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[3].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@doubleclick[3].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@serving-sys[2].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@tradedoubler[1].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@bs.serving-sys[1].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@ad.adtoma[2].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@spyguardpro[1].txt
C:\Documents and Settings\Malmberg\Cookies\malmberg@imrworldwide[3].txt
Trojan.Downloader-CREW
C:\SYSTEM VOLUME INFORMATION\_RESTORE{619781AC-CF96-4B2F-8E58-2353903809FC}\RP1250\A0294332.DLL
Adware.Vundo Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{619781AC-CF96-4B2F-8E58-2353903809FC}\RP1250\A0294664.DLL
C:\WINDOWS\SYSTEM32\FSLXFFBB.DLL
C:\WINDOWS\SYSTEM32\SVVJGA.DLL
Trojan.ZLob/CodecBHO
C:\WINDOWS\SYSTEM32\CODECBHO.DLL
|
|
felix100
Member
|
17. September 2008 @ 17:57 |
Link to this message
|
|
So is there anything else i need to do?
|
|
Advertisement
|
|
|
Senior Member
|
18. September 2008 @ 09:05 |
Link to this message
|
Hey felix100
Yes, there is more for you to do.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
Open Notepad and copy/paste the text in the code box below into it:
File::
C:\WINDOWS\system32\ppiycfrf.tmp
C:\WINDOWS\system32\lpxqphog.dll
C:\WINDOWS\system32\amzotq.dll
C:\WINDOWS\system32\sdchost.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Download Manager"=-
Save this as CFScript.txt in the same folder as ComboFix.
Then drag the CFScript.txt into Combo-Fix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt).
Do not click on the ComoboFix window, as it may cause it to stall.
After that, post a new HijackThis log, and tell me what problems you have left.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
