|
|
|
Trojan? Zlob.DNSChanger & Zlob.DNSChanger.Rtk
|
|
|
texcutter
Newbie
|
1. October 2008 @ 03:11 |
Link to this message
|
I have been trying to get rid of this for a long time. I run Spybot and find Zlob.DNSChanger and Zlob.DNSChanger.Rtk. I select FixIt and Spybot says it has fixed it. I run Sypbot again and it is still there. I have MacAfee but it never finds it. Does anyone have any suggestions? I would really be greatful.
|
|
Advertisement
|
|
|
|
Senior Member
|
1. October 2008 @ 09:40 |
Link to this message
|
Hey texcutter
First, please then reboot your computer into Safe Mode by doing the following:
? Restart your computer
? After pressing the power button, repeatedly tap the F8 key.
? Instead of Windows loading as normal, the Advanced Options Menu should appear;
? Select the first option, to run Windows in Safe Mode, then press Enter.
? Choose the administrator's account.
In safe mode, please scan with Spybot and remove all detected items.
Next follow steps #3-6 on here: http://forums.afterdawn.com/thread_view.cfm/370698#2210178
After that, please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file.
Rename HijackThis(.exe) to scanner(.exe).
Next, run scanner(.exe). A window will pop up.
? Click on the button which says Main Menu, then Do a system scan and save a logfile.
? Please wait for the scan to be completed.
? After the scan has completed, a text window will pop up. Please post the contents of this window here.
This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved.
NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
texcutter
Newbie
|
1. October 2008 @ 15:45 |
Link to this message
|
|
Thank you very much for your help. I have enough knowledge about computers to get myself in trouble. But, I followed your instructions and everything went smoothly. Zlob is gone!! Thank you again for taking the time to help me. Makes me feel good that there are good helpful people out there.
Tex Cutter
|
Senior Member
|
2. October 2008 @ 12:00 |
Link to this message
|
|
You're welcome, texcutter.
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
madnessx7
Newbie
|
27. October 2008 @ 16:24 |
Link to this message
|
I tried this and it still does not work for me. I followed the steps exactly, but did notice that there was one error in during ther smitfraudfix process, but it just continued.
|
Senior Member
|
28. October 2008 @ 01:12 |
Link to this message
|
Hi madnessx7
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
madnessx7
Newbie
|
28. October 2008 @ 01:55 |
Link to this message
|
Hi
this is the log that you had mentioned. I noticed the clock time did not change back. Are there any other steps? Thanks in advance for you help on this matter.
ComboFix 08-10-27.03 - vdoan 2008-10-27 22:39:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1083 [GMT -7:00]
Running from: G:\Combo-Fix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\kdwre.exe
----- BITS: Possible infected sites -----
hxxp://us-hqwsus1
.
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-28 )))))))))))))))))))))))))))))))
.
2008-10-27 19:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-27 19:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-27 19:02 . 2008-09-08 22:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-27 19:02 . 2008-10-01 14:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-27 19:02 . 2008-05-18 20:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-27 19:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-10-27 19:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-27 19:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-27 13:50 . 2008-10-27 13:50 <DIR> d-------- C:\Documents and Settings\zeus\Application Data\Helios
2008-10-27 12:49 . 2008-10-27 19:09 5,244 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-26 23:05 . 2008-10-26 23:05 <DIR> d-------- C:\Program Files\Lavasoft
2008-10-26 23:05 . 2008-10-26 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-26 21:57 . 2008-10-27 19:01 393 --a------ C:\WINDOWS\wininit.ini
2008-10-26 20:51 . 2008-10-26 20:51 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys
2008-10-24 11:24 . 2007-10-17 14:27 172,032 --a------ C:\WINDOWS\system32\AeXSWDInstSvc.exe
2008-10-24 09:31 . 2008-10-15 09:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-22 11:06 . 2008-09-08 03:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-22 11:05 . 2008-08-14 03:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-22 11:05 . 2008-08-14 03:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-22 11:05 . 2008-08-14 02:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-22 11:05 . 2008-08-14 02:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-22 11:05 . 2008-09-15 05:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-22 10:18 . 2008-10-22 10:18 <DIR> d-------- C:\Program Files\Beyond Compare 3
2008-10-22 10:18 . 2008-10-22 10:18 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Scooter Software
2008-10-22 09:06 . 2008-10-22 09:06 <DIR> d-------- C:\Program Files\WebEx
2008-10-22 09:06 . 2008-10-22 09:06 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Productivity Tools
2008-10-18 14:20 . 2008-10-18 14:20 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-10-18 13:47 . 2008-10-18 13:47 <DIR> d-------- C:\Program Files\Amazon
2008-10-18 13:47 . 2008-10-18 13:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon
2008-10-17 10:56 . 2008-04-13 11:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-10-17 10:56 . 2008-04-13 11:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-10-17 10:56 . 2008-04-13 17:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-10-17 10:56 . 2008-04-13 17:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-10-17 10:56 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-10-17 10:56 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-10-17 10:56 . 2008-04-13 11:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-10-17 10:56 . 2008-04-13 11:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-10-16 13:04 . 2008-10-22 09:06 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\webex
2008-10-15 09:14 . 2006-06-28 11:54 <DIR> d-------- C:\Documents and Settings\altiristms\workspace
2008-10-15 09:14 . 2006-04-14 15:40 <DIR> d---s---- C:\Documents and Settings\altiristms\UserData
2008-10-15 09:14 . 2006-04-14 15:24 <DIR> d-------- C:\Documents and Settings\altiristms\Bluetooth Software
2008-10-15 09:14 . 2006-06-28 11:54 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\TextPad
2008-10-15 09:14 . 2006-04-14 14:26 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\Sonic
2008-10-15 09:14 . 2006-04-17 13:18 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\Intel
2008-10-15 09:14 . 2008-10-09 18:56 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\ATI
2008-10-15 09:14 . 2008-10-21 08:32 <DIR> d-------- C:\Documents and Settings\altiristms
2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\iTunes
2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\iPod
2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\Bonjour
2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-14 21:33 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-10-14 21:33 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-10-14 19:47 . 2008-10-14 19:47 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\acccore
2008-10-14 19:46 . 2008-10-22 12:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-10-14 19:46 . 2008-10-14 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\acccore
2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Program Files\Common Files\AOL
2008-10-14 19:45 . 2008-10-14 19:46 <DIR> d-------- C:\Program Files\AIM6
2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-10-14 19:45 . 2008-10-14 19:46 368 --ah----- C:\IPH.PH
2008-10-13 15:00 . 2008-10-13 15:00 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Helios
2008-10-13 13:06 . 2008-10-13 13:06 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-10-13 13:04 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-10-13 13:03 . 2008-10-26 22:39 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-10-13 13:03 . 2008-10-13 13:03 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-10-13 13:03 . 2008-10-13 13:03 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-10-13 13:01 . 2008-10-13 13:01 <DIR> dr-h----- C:\MSOCache
2008-10-13 12:49 . 2008-10-13 12:49 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\DAEMON Tools
2008-10-13 12:49 . 2008-10-13 12:50 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-10-13 12:33 . 2008-10-13 12:33 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\InterVideo
2008-10-10 11:01 . 2008-10-10 11:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-10-09 18:59 . 2008-10-09 18:59 <DIR> d-------- C:\Program Files\Common Files\InterVideo
2008-10-04 06:09 . 2008-10-04 06:09 <DIR> d-------- C:\Program Files\Digital Line Detect
2008-10-04 06:08 . 2008-10-04 06:08 <DIR> d-------- C:\Program Files\NetWaiting
2008-10-04 06:08 . 2008-10-04 06:08 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\InstallShield
2008-10-04 06:07 . 2008-10-09 18:39 <DIR> d-------- C:\Program Files\ThinkVantage Fingerprint Software
2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\RSA SecurID Token Common
2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\Common Files\ThinkVantage Fingerprint Software
2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\Common Files\SPBA
2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\UIB
2008-10-04 05:41 . 2008-10-04 05:41 <DIR> d-------- C:\Program Files\Common Files\Lenovo
2008-10-04 05:38 . 2008-10-09 18:42 <DIR> d-------- C:\swshare
2008-10-03 19:07 . 2008-10-03 19:07 <DIR> d-------- C:\WINDOWS\system32\(null)
2008-10-03 19:06 . 2007-02-18 22:56 21,376 --a------ C:\WINDOWS\system32\drivers\psadd.sys
2008-10-03 16:17 . 2008-10-03 16:17 <DIR> d-------- C:\Program Files\Google
2008-10-03 15:46 . 2008-10-03 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-10-03 15:40 . 2008-10-03 15:42 <DIR> d-------- C:\Program Files\SecureCRT
2008-10-03 15:23 . 2008-10-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-10-03 15:22 . 2008-10-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-10-03 15:21 . 2008-10-03 15:21 <DIR> d-------- C:\Program Files\NOS
2008-10-03 15:21 . 2008-10-03 15:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-10-03 15:20 . 2008-10-03 15:20 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-10-03 15:19 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Apple Computer
2008-10-03 15:15 . 2008-10-03 15:15 <DIR> d-------- C:\Program Files\QuickTime
2008-10-03 15:15 . 2008-10-14 21:32 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-10-03 15:15 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-10-03 15:14 . 2008-10-03 15:14 <DIR> d-------- C:\Program Files\Apple Software Update
2008-10-03 15:14 . 2008-10-03 15:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-10-03 14:30 . 2008-10-03 14:30 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks
2008-10-03 14:30 . 2008-10-03 14:31 1,592 --a------ C:\WINDOWS\VPNInstall.MIF
2008-10-03 14:10 . 2008-10-03 10:41 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-03 14:10 . 2007-04-17 02:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-03 14:10 . 2007-03-07 22:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-03 14:10 . 2008-08-26 00:24 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-03 14:10 . 2008-08-26 00:24 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-03 14:10 . 2008-08-26 00:24 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-03 14:10 . 2008-08-26 00:24 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-03 14:10 . 2008-08-26 00:24 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-03 14:10 . 2008-08-25 01:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-03 13:37 . 2008-10-26 20:02 <DIR> d-------- C:\Program Files\TextPad 5
2008-10-03 10:36 . 2008-10-03 10:36 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-10-03 10:34 . 2008-10-03 10:34 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Yahoo!
2008-10-03 10:14 . 2008-10-03 11:44 <DIR> d-------- C:\Program Files\Yahoo!
2008-10-03 10:14 . 2008-10-03 10:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\en
2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\bits
2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\l2schemas
2008-10-03 10:08 . 2008-10-03 10:11 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-03 09:58 . 2008-04-13 17:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-10-02 09:40 . 2008-10-02 09:40 <DIR> d-------- C:\WINDOWS\SchCache
2008-10-02 09:21 . 2008-10-02 09:21 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-10-02 08:43 . 2008-10-02 08:43 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy)
2008-10-02 08:15 . 2008-10-02 08:15 110,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-02 08:15 . 2008-10-02 08:15 48,768 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-27 06:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-10-27 04:21 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-27 04:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-24 18:23 --------- d-----w C:\Program Files\Perforce
2008-10-18 20:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-10 01:59 --------- d-----w C:\Program Files\InterVideo
2008-10-10 01:58 --------- d-----w C:\Program Files\ATI Technologies
2008-10-10 01:56 --------- d-----w C:\Documents and Settings\zeus\Application Data\ATI
2008-10-10 01:56 --------- d-----w C:\Documents and Settings\TSC\Application Data\ATI
2008-10-10 01:56 --------- d-----w C:\Documents and Settings\athena\Application Data\ATI
2008-10-04 13:05 --------- d-----w C:\Program Files\Lenovo
2008-10-02 16:47 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-10-02 15:15 --------- d-----w C:\Program Files\Symantec
2008-10-02 15:15 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-10-02 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-02 15:00 --------- d-----w C:\Program Files\Java
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-29 17:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 16:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-25 08:45 16,384 ------w C:\WINDOWS\PWMBTHLP.EXE
2008-08-14 10:09 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2005-11-15 22:32 3,638 ----a-r C:\Program Files\Common Files\Altiris_Icon.ico
2008-10-16 20:04 27,976 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
2008-10-16 20:04 125,848 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcext.dll
2008-10-16 20:04 46,408 ----a-w C:\Program Files\mozilla firefox\plugins\atmccli.dll
2008-10-16 20:04 98,712 ----a-w C:\Program Files\mozilla firefox\plugins\ieatgpc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"PTOneClick"="C:\Program Files\WebEx\Productivity Tools\ptoneclk.exe" [2008-08-03 165192]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BGInfo"="C:\windows\bginfo.exe" [2004-09-22 741421]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [2002-10-08 40960]
"TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-15 110592]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-15 512000]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-11-17 237568]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-08-25 331776]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-08-25 208896]
"LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-01-25 106496]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 864256]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-12-15 925696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-03-14 125632]
"AeXAgentLogon"="C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" [2008-01-30 143360]
"SgeEcView"="C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe" [2007-09-05 24576]
"EdWizard"="C:\Program Files\Utimaco\SafeGuard Easy\EdWizard.exe" [2007-09-05 245760]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"TP4EX"="tp4ex.exe" [2005-10-17 C:\WINDOWS\system32\TP4EX.exe]
"TpShocks"="TpShocks.exe" [2005-11-07 C:\WINDOWS\system32\TpShocks.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2005-11-01 581693]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-10-04 50688]
Monitor Apache Servers.lnk - D:\devtools\Apache Group\Apache2\bin\ApacheMonitor.exe [2008-01-17 41042]
VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2008-10-03 6144]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2004-02-11 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2008-06-24 17:31 95496 C:\WINDOWS\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 16:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-03-17 16:02 34080 C:\Program Files\Lenovo\HOTKEY\tphklock.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NotLog]
2002-01-22 15:28 110592 C:\WINDOWS\system32\SGLogEx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SGLogNotification]
2005-03-31 11:27 69632 C:\WINDOWS\system32\SGLogNotification.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= AMINIT.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=\\ariba.com\SysVol\ariba.com\scripts\zeus_change.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0]
"Script"=\\ariba.com\SysVol\ariba.com\scripts\InstallHQGrcDat.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\0]
"Script"=\\ariba.com\SysVol\ariba.com\scripts\Pull_Altiris.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\3\0]
"Script"=AddToLocalAdmins.bat
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\devtools\\ora92\\Apache\\Apache\\Apache.exe"=
"D:\\devtools\\Apache Group\\Apache2\\bin\\Apache.exe"=
"D:\\devtools\\j2sdk1.4.2_12\\bin\\javaw.exe"=
"D:\\devtools\\bea814\\jdk142_05\\bin\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6129:TCP"= 6129:TCP:10.0.0.0/255.0.0.0,192.168.0.0/255.255.0.0:Enabled:Dameware
R0 AES-256;AES-256;C:\WINDOWS\system32\DRIVERS\AES256.SYS [2007-09-05 19712]
R0 SgeFlt;SgeFlt;C:\WINDOWS\system32\DRIVERS\SGEFLT.SYS [2007-09-05 62720]
R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2005-11-30 85760]
R1 FSLX;FSLX;C:\WINDOWS\system32\drivers\fslx.sys [2008-02-01 191616]
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 4736]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2008-08-25 4442]
R2 agnwifi;AT&T Wi-Fi Support Driver;C:\WINDOWS\system32\DRIVERS\agnwifi.sys [2006-03-17 19328]
R2 OracleServiceARIBA;OracleServiceARIBA;c:\devtools\ora92\bin\ORACLE.EXE ARIBA [ ]
R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-08-25 94208]
R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2008-06-24 12560]
S2 OracleOraHome92Agent;OracleOraHome92Agent;c:\devtools\ora92\bin\agntsrvc.exe [2002-04-26 28944]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-26 27904]
S3 OracleOraHome92ClientCache;OracleOraHome92ClientCache;c:\devtools\ora92\BIN\ONRSD.EXE [2002-04-26 242328]
S3 OracleOraHome92HTTPServer;OracleOraHome92HTTPServer;c:\devtools\ora92\Apache\Apache\apache.exe [2002-04-18 4096]
S3 OracleOraHome92SNMPPeerEncapsulator;OracleOraHome92SNMPPeerEncapsulator;c:\devtools\ora92\BIN\ENCSVC.EXE [2002-02-13 187392]
S3 OracleOraHome92SNMPPeerMasterAgent;OracleOraHome92SNMPPeerMasterAgent;c:\devtools\ora92\BIN\AGNTSVC.EXE [2002-02-13 254464]
.
Contents of the 'Scheduled Tasks' folder
2008-10-11 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-10-28 C:\WINDOWS\Tasks\PMTask.job
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-08-25 01:45]
.
- - - - ORPHANS REMOVED - - - -
ShellIconOverlayIdentifiers-{ba930330-a721-11d3-a7b9-00500464ee16} - Sgedrse.Dll
ShellIconOverlayIdentifiers-{2030D939-54A7-4fea-9B06-49EA77EFC87F} - Sgedrse.Dll
HKCU-Run-Aim6 - (no file)
HKLM-Run-C:\WINDOWS\system32\kdouq.exe - C:\WINDOWS\system32\kdouq.exe
HKLM-Run-C:\WINDOWS\system32\kdwre.exe - C:\WINDOWS\system32\kdwre.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\vdoan\Application Data\Mozilla\Firefox\Profiles\tmi48ci6.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://web.ariba.com/
FF -: plugin - C:\Documents and Settings\vdoan\Application Data\Mozilla\Firefox\Profiles\tmi48ci6.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - c:\program files\mozilla firefox\plugins\np_gp.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-27 22:46:18
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\D:]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OracleOraHome92PagingServer]
"ImagePath"="c:\devtools\ora92/bin/pagntsrv.exe"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OracleOraHome92TNSListener]
"ImagePath"="c:\devtools\ora92\BIN\TNSLSNR "
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
D:\devtools\Apache Group\Apache2\bin\Apache.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\devtools\ora92\bin\omtsreco.exe
C:\devtools\ora92\bin\TNSLSNR.EXE
C:\devtools\ora92\bin\oracle.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe
C:\WINDOWS\system32\SgLogPlayer.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\WINDOWS\system32\TpKmpSvc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe
D:\devtools\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\DWRCST.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\ZOOM\TpScrex.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\WebEx\Productivity Tools\ptSrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-10-27 22:49:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-28 05:49:21
Pre-Run: 13,675,393,024 bytes free
Post-Run: 13,721,595,904 bytes free
377 --- E O F --- 2008-10-24 16:37:02
|
Senior Member
|
28. October 2008 @ 04:49 |
Link to this message
|
Hey madnessx7
Please download Malwarebytes Anti-Malware and install it. Follow the prompts and reboot if required.
Launch Malwarebytes either by running C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe or double-click the Malwarebytes' Anti-Malware shortcut on your Desktop.
Configuring Malwarebytes
? Click on the tab Settings.
? Make sure only these boxes are checked:
Terminate Internet Explorer
Automatically save and display logfile after removal
Always scan memory objects
Always scan registry objects
Always scan filesystem
Always scan extra and heuristics objects
Updating Malwarebytes
? Click on the tab Update.
? Press the button Check for Updates
? Wait for Malwarebytes to be fully updated.
Scanning Time
? Click on the tab Scanner.
? Check Perform full scan and click on Scan
? Wait for the scan to complete, and then click on Show Results.
? Make sure all items are checked, then click on Remove Selected.
**If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If you are asked to restart the computer, please do so immediately.
Post A Log
? A text box will pop up after the removal process is over. Post the contents of the text here.
? If no text box pops up, launch Malwarebytes, and click on the tab Logs.
? The logs will appear as mbam-log-*date-*time.txt. Select the latest one, and then click on Open.
? Post the log here.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
madnessx7
Newbie
|
29. October 2008 @ 11:25 |
Link to this message
|
Here is the post that was displayed. Thanks again.
Malwarebytes' Anti-Malware 1.30
Database version: 1335
Windows 5.1.2600 Service Pack 3
10/29/2008 8:16:38 AM
mbam-log-2008-10-29 (08-16-38).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 151498
Time elapsed: 1 hour(s), 4 minute(s), 25 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\sexvid (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
|
|
Advertisement
|
|
|
Senior Member
|
30. October 2008 @ 00:42 |
Link to this message
|
|
Hey madnessx7
You look just about clean. Any more problems?
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
