|
|
|
how to clean trojan horse downloader.zlob.afvc
|
|
|
sandneet
Newbie
|
3. November 2008 @ 11:59 |
Link to this message
|
|
Hi,
I have been facing the pop ups of avg7.5 anti virus scan that threat is detected but i am not able to remove the trojan horse downloader.zlob.afvc.
Pl someone help me get rid of this problem as it has been a mental harassment. I have scaned with pctool anti virus as well but no traces of trojan in that scan.
Pl someone help me. I dont know where from I have got this.
|
|
Advertisement
|
|
|
|
Senior Member
|
4. November 2008 @ 04:34 |
Link to this message
|
Hi sandneet
No worries; the zlob trojan is currently relatively easy to remove with the right tools.
1.
First, please reboot your computer into Safe Mode by doing the following:
? Restart your computer
? After pressing the power button, repeatedly tap the F8 key.
? Instead of Windows loading as normal, the Advanced Options Menu should appear;
? Select the first option, to run Windows in Safe Mode, then press Enter.
? Choose the administrator's account.
Scan with AVG, and quarantine all found threats.
2.
Next, follow steps #3-6 on here: http://forums.afterdawn.com/thread_view.cfm/370698#2210178
3.
Then, please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sandneet
Newbie
|
4. November 2008 @ 13:07 |
Link to this message
|
|
Hi Friend,
Thanks for your reply. I will do the things as directed and will post the log .
Thanks......
|
|
sandneet
Newbie
|
5. November 2008 @ 11:21 |
Link to this message
|
|
Hi,
I am not able to start the machine in safe mode. After selecting the safe mode and window xp.. it doesnot start but give a lot of entris om screen and i dont understand all those.
What should I do now/ Can I do the entire process in normal mode as well. Pl help.
|
Senior Member
|
5. November 2008 @ 22:25 |
Link to this message
|
|
Yes, follow my instructions in normal mode.
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sandneet
Newbie
|
6. November 2008 @ 13:24 |
Link to this message
|
Hi,
I hope. its gone now.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/06/2008 at 11:44 PM
Application Version : 4.21.1004
Core Rules Database Version : 3625
Trace Rules Database Version: 1609
Scan type : Complete Scan
Total Scan Time : 00:44:20
Memory items scanned : 436
Memory threats detected : 0
Registry items scanned : 5878
Registry threats detected : 60
File items scanned : 44550
File threats detected : 69
Trojan.FakeAlert-IEBT
HKLM\Software\Classes\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}
HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}
HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}#www
HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}\InprocServer32
HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}\InprocServer32#ThreadingModel
C:\PROGRAM FILES\APPLICATIONS\IEBT.DLL
HKLM\Software\Classes\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\Implemented Categories
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\InprocServer32
HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\InprocServer32#ThreadingModel
C:\PROGRAM FILES\APPLICATIONS\IEBR.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}
HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}
Adware.E404 Helper/Variant-AM
HKLM\Software\Classes\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\InprocServer32
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\InprocServer32#ThreadingModel
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\ProgID
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\Programmable
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\TypeLib
HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\VersionIndependentProgID
HKCR\z444.z444mgr.1
HKCR\z444.z444mgr.1\CLSID
HKCR\z444.z444mgr
HKCR\z444.z444mgr\CLSID
HKCR\z444.z444mgr\CurVer
HKCR\TypeLib\{E63648F7-3933-440E-AAAA-A8584DD7B7EB}
C:\WINDOWS\SYSTEM32\512686\512686.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP46\A0016085.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP53\A0017085.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP55\A0017122.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP56\A0017135.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017152.DLL
Adware.Tracking Cookie
C:\Documents and Settings\Lenovo\Cookies\lenovo@advertising[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@ad.yieldmanager[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@enhance[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@adtech[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@personalantispy[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@avgtechnologies.112.2o7[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@2o7[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@cts.metricsdirect[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@ads.bleepingcomputer[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@microsoftwindows.112.2o7[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@doubleclick[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@adtrafficstats[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@virusresponse2009[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@1071670925[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@revsci[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@adrevolver[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@clickbank[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@richmedia.yahoo[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@adopt.specificclick[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@atdmt[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@realmedia[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@tribalfusion[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@zedo[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@media.adrevolver[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@casalemedia[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@fastclick[2].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@scan.antispyware-free-scanner[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@mywebsearch[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@yadro[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@msnportal.112.2o7[1].txt
C:\Documents and Settings\Lenovo\Cookies\lenovo@burstnet[2].txt
Adware.MyWebSearch/FunWebProducts
HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\TreatAs
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\FLAGS
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid32
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib#Version
C:\Program Files\FunWebProducts\Shared\00494727.dat
C:\Program Files\FunWebProducts\Shared
C:\Program Files\FunWebProducts
Trojan.Media-Codec
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#InstDate
Adware.E404 Helper/Hij
HKCR\CLSID\e405.e405mgr
HKCR\CLSID\e405.e405mgr#UserId
Adware.180solutions/Seekmo/Zango
C:\DOCUMENTS AND SETTINGS\LENOVO\MY DOCUMENTS\MY PICTURES\MONU PIC\SETUP.EXE
C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC20.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013556.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013551.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013552.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013553.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013554.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013555.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013558.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013560.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013561.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013562.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013563.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013564.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013565.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013566.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013567.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013568.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013578.DLL
Rogue.VirusResponseLab2009
C:\DOWNLOADS\SOFTWARE\VIRLAB_INSTALL.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013533.EXE
C:\WINDOWS\Prefetch\VIRLAB_INSTALL.EXE-21751DCD.pf
Trojan.Dropper/Gen-PHP
C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC23.PHP
C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC24.PHP
Adware.E404 Helper/Dropper
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017141.EXE
Trojan.Dropper/Gen
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017142.DLL
Trojan.Unclassified-Packed/Suspicious
C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017143.DLL
|
Senior Member
|
6. November 2008 @ 20:41 |
Link to this message
|
Hey sandneet
1.
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
2.
Please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file.
Rename HijackThis(.exe) to scanner(.exe).
Next, run scanner(.exe). A window will pop up.
? Click on the button which says Main Menu, then Do a system scan and save a logfile.
? Please wait for the scan to be completed.
? After the scan has completed, a text window will pop up. Please post the contents of this window here.
This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved.
NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer.
3.
Tell me what problems you have left.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sandneet
Newbie
|
7. November 2008 @ 12:13 |
Link to this message
|
Hi, Pl find the logs as directed...
ComboFix 08-11-06.01 - Lenovo 2008-11-07 22:29:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.580 [GMT 5.5:30]
Running from: c:\documents and settings\Lenovo\Desktop\Combo-Fix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Lenovo\My Documents\My Music\My Music.url
c:\documents and settings\Lenovo\My Documents\My Pictures\My Pictures.url
c:\documents and settings\Lenovo\My Documents\My Videos\My Video.url
c:\windows\IE4 Error Log.txt
c:\windows\system32\28463
c:\windows\system32\28463\svchost.001
c:\windows\system32\28463\svchost.002
c:\windows\system32\setup.ini
.
((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 )))))))))))))))))))))))))))))))
.
2008-11-07 00:32 . 2008-11-07 00:32 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-07 00:09 . 2008-11-07 21:58 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-07 00:09 . 2008-11-07 00:09 <DIR> d-------- c:\program files\AVG
2008-11-07 00:09 . 2008-11-07 00:11 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\AVGTOOLBAR
2008-11-07 00:09 . 2008-11-07 00:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-07 00:09 . 2008-11-07 00:09 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-07 00:09 . 2008-11-07 00:09 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-07 00:09 . 2008-11-07 00:09 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\SUPERAntiSpyware.com
2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-06 22:51 . 2008-11-06 22:51 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-06 22:48 . 2008-11-06 22:48 3,224 --a------ c:\windows\system32\tmp.reg
2008-11-05 21:26 . 2008-11-05 21:39 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-04 23:52 . 2008-11-04 23:58 <DIR> d-------- c:\program files\registry cleanr software
2008-11-04 23:45 . 2008-11-04 23:45 6,637,592 --a------ c:\program files\SUPERAntiSpyware.exe
2008-11-04 23:27 . 2008-11-05 00:37 <DIR> d-------- c:\program files\AVG 8
2008-11-04 22:54 . 2008-11-04 22:54 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-03 21:18 . 2008-11-03 21:18 <DIR> d--h----- c:\windows\system32\GroupPolicy
2008-11-03 00:29 . 2008-11-03 00:29 7,507,296 --a------ c:\program files\registrycleaner software.exe
2008-11-03 00:21 . 2008-08-14 15:30 2,180,352 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-03 00:21 . 2008-08-14 15:28 2,136,064 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-03 00:21 . 2008-08-14 14:52 2,057,728 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-03 00:21 . 2008-08-14 14:52 2,015,744 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-02 23:31 . 2008-11-02 23:31 <DIR> d-------- c:\program files\Common Files\PC Tools
2008-11-02 22:50 . 2008-11-05 00:38 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-02 01:56 . 2008-11-02 01:56 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\Sony
2008-11-02 01:56 . 2008-11-02 01:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony
2008-11-02 01:46 . 2008-11-06 22:49 <DIR> d-------- c:\windows\system32\512686
2008-11-02 01:46 . 2008-11-07 00:06 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-10-26 23:51 . 2007-11-01 11:15 862,922 --a------ c:\windows\system32\drivers\btkrnl.sys
2008-10-26 23:51 . 2007-11-01 11:15 106,557 --a------ c:\windows\system32\btw_ci.dll
2008-10-26 23:35 . 2008-10-26 23:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2008-10-23 23:55 . 2008-10-24 00:15 70,231,936 --ah----- c:\program files\62bl05ww.exe
2008-10-12 20:18 . 2007-04-19 07:20 198,144 --------- c:\windows\system32\_psisdecd.dll
2008-10-12 14:36 . 2008-10-12 14:36 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\Pingotron.com
2008-10-12 14:32 . 2008-10-12 14:32 <DIR> d-------- c:\program files\Internet RadioFan
2008-10-12 14:30 . 2008-10-12 14:31 855,508 --a------ c:\program files\irf.zip
2008-10-12 12:27 . 2008-10-30 23:57 <DIR> d-------- C:\Downloads
2008-10-12 11:04 . 2008-11-03 00:21 <DIR> d-------- c:\program files\Free Download Manager
2008-10-12 10:51 . 2008-10-12 10:51 6,518,873 --a------ c:\program files\fdminst3.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-02 17:10 --------- d-----w c:\program files\SoundTells
2008-11-01 20:27 --------- d-----w c:\program files\Sony Ericsson
2008-10-26 18:21 --------- d-----w c:\program files\Lenovo
2008-10-26 18:19 --------- d-----w c:\program files\Yahoo!
2008-10-26 18:19 --------- d-----w c:\documents and settings\Lenovo\Application Data\Yahoo!
2008-10-26 18:06 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-12 14:48 --------- d-----w c:\documents and settings\Lenovo\Application Data\CyberLink
2008-10-12 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-10-12 14:45 --------- d-----w c:\program files\Google
2008-10-05 17:16 19,684,396 ----a-w c:\program files\marioforever.zip
2008-10-05 11:30 --------- d-----w c:\program files\Counter Strike Mega Edition setup
2008-10-05 07:12 --------- d-----w c:\program files\WoCa_1_3_2
2008-10-03 12:56 --------- d-----w c:\program files\GameHouse
2008-09-28 16:40 --------- d-----w c:\program files\Real
2008-09-28 16:40 --------- d-----w c:\program files\Common Files\xing shared
2008-09-28 16:40 --------- d-----w c:\program files\Common Files\Real
2008-09-28 16:26 353,840 ----a-w c:\program files\RealPlayer11GOLD.exe
2008-09-28 16:01 --------- d-----w c:\documents and settings\Lenovo\Application Data\MSNInstaller
2008-09-23 17:39 --------- d-----w c:\program files\WordWeb
2008-09-23 17:34 546,955 ----a-w c:\program files\ProjectWeightLoss[1].com_Calculator_v2.0.zip
2008-09-23 17:33 1,025,017 ----a-w c:\program files\woca.exe
2008-09-23 17:30 445,381 ----a-w c:\program files\CycleCalcPCSetupTrial.exe
2008-09-23 17:27 387,041 ----a-w c:\program files\FMDv1.exe
2008-09-23 17:26 7,794,368 ----a-w c:\program files\wordweb5.exe
2008-09-21 05:05 --------- d-----w c:\program files\Winamp
2008-09-20 17:46 1,416,944 ----a-w c:\program files\WM9Codecs.exe
2008-09-19 17:34 --------- d-----w c:\program files\PDFCreator
2008-09-19 17:33 253,116 ----a-w c:\windows\PDFCreator_Toolbar_Uninstaller_5312.exe
2008-09-19 17:33 14,290 ----a-w c:\program files\settings.dat
2008-09-19 17:33 --------- d-----w c:\program files\PDFCreator Toolbar
2008-09-19 17:30 860,391 ----a-w c:\program files\7z457.exe
2008-09-19 17:30 --------- d-----w c:\program files\7-Zip
2008-09-19 17:29 15,895,117 ----a-w c:\program files\PDFCreator-0_9_5_setup.exe
2008-09-19 17:10 1,282,048 ----a-w c:\program files\cah.exe
2008-09-18 17:49 --------- d-----w c:\documents and settings\All Users\Application Data\WinZipSE
2008-09-16 17:51 --------- d-----w c:\documents and settings\All Users\Application Data\VeriFace
2008-09-16 17:17 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-14 08:32 --------- d-----w c:\documents and settings\Lenovo\Application Data\Apple Computer
2008-09-14 08:22 --------- d-----w c:\program files\QuickTime
2008-09-14 08:21 --------- d-----w c:\program files\Apple Software Update
2008-09-14 08:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-14 08:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-14 08:09 --------- d-----w c:\program files\Avanquest update
2008-09-14 08:09 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2008-09-14 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-09-06 15:00 94,208 ----a-w c:\windows\system32\ScrUnZip.dll
2008-08-29 03:10 86,016 ----a-w c:\windows\system32\VideoOp.dll
2008-08-29 03:10 61,440 ----a-w c:\windows\system32\Momo.dll
2008-08-29 03:10 589,824 ----a-w c:\windows\system32\PicNotify.dll
2008-08-29 03:10 5,632 ----a-w c:\windows\system32\biologon.dll
2008-08-29 03:10 491,520 ----a-w c:\windows\system32\picn.dll
2008-08-29 03:10 491,520 ----a-w c:\windows\system32\MainOp.dll
2008-08-29 03:10 49,152 ----a-w c:\windows\system32\DevFilt.dll
2008-08-29 03:10 45,056 ----a-w c:\windows\system32\ApBlend.dll
2008-08-29 03:10 208,896 ----a-w c:\windows\system32\Image.dll
2008-08-29 03:10 1,314,816 ----a-w c:\windows\system32\ImageReog.dll
2008-08-29 03:04 89,088 ----a-w c:\windows\Atl71.dll
2008-08-29 03:04 626,688 ----a-w c:\windows\msvcr80.dll
2008-08-29 03:04 57,344 ----a-w c:\windows\AsfHelper.dll
2008-08-29 03:04 339,968 ----a-w c:\windows\VdoEct.dll
2008-08-29 03:04 241,664 ----a-w c:\windows\EasyCapSrcSaver.scr
2008-08-29 03:04 22,528 ----a-w c:\windows\ScrSav.dll
2008-08-29 03:04 2,222,800 ----a-w c:\windows\d3dx9_24.dll
2008-08-29 03:04 1,060,864 ----a-w c:\windows\MFC71.dll
2008-08-28 16:37 129,536 ----a-w c:\windows\system32\IJL15.dll
2008-08-25 14:40 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-08-25 14:40 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-08-25 13:52 315,392 ----a-w c:\windows\HideWin.exe
2008-08-20 05:38 659,456 ----a-w c:\windows\system32\wininet.dll
2008-08-17 03:56 1,049,784 ------w c:\windows\wweb32.dll
2008-08-14 09:58 2,136,064 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:22 2,015,744 ----a-w c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 356352]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2005-10-27 33792]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-23 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-23 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-23 138008]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-28 185872]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-07 1234712]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-30 c:\windows\RTHDCPL.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl]
c:\documents and settings\Lenovo\Start Menu\Programs\Startup\
WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2008-09-23 42168]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2006-11-13 561213]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\Lenovo\Power2Go\CLMP3Enc.ACM
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-07 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-07 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-07 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-07 76040]
R3 CapFilt;CapFilt;c:\windows\system32\drivers\CapFilt.sys [2008-08-29 17536]
S3 a016bus;Sony Ericsson Device A016 driver (WDM);c:\windows\system32\DRIVERS\a016bus.sys [2008-01-18 83880]
S3 a016mdfl;Sony Ericsson Device A016 USB WMC Modeme Filter;c:\windows\system32\DRIVERS\a016mdfl.sys [2008-01-18 15016]
S3 a016mdm;Sony Ericsson Device A016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\a016mdm.sys [2008-01-18 110504]
S3 a016mgmt;Sony Ericsson Device A016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\a016mgmt.sys [2008-01-18 104488]
S3 a016obex;Sony Ericsson Device A016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\a016obex.sys [2008-01-18 100648]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2006-11-13 37296]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f347d98-738a-11dd-993e-001fe1f99edf}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe
\Shell\Open\command - H:\regsvr.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a626a17a-72c5-11dd-9939-001eec9186da}]
\Shell\AutoRun\command - System\DriveGuard\DriveProtect.exe -run
\Shell\Explore\Command - System\DriveGuard\DriveProtect.exe -run
\Shell\Open\Command - System\DriveGuard\DriveProtect.exe -run
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe7baa74-8237-11dd-9953-001fe1f99edf}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe
\Shell\Open\command - H:\regsvr.exe
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-10-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} - (no file)
HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
HKCU-Run-Power2GoExpress - (no file)
HKCU-Run-fsm - (no file)
HKLM-Run-VeriFacePassManager - c:\program files\Lenovo\VeriFace\PManage.exe
.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O17 -: HKLM\CCS\Interface\{9146E613-423D-48F0-9A4F-E5FFC6881271}: NameServer = 218.248.255.194 218.248.255.146
O17 -: HKLM\CCS\Interface\{FCE51623-65F4-4CE7-BF7E-126776340E48}: NameServer = 218.248.240.79,218.248.240.135
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-07 22:30:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-07 22:30:53
ComboFix-quarantined-files.txt 2008-11-07 17:00:48
Pre-Run: 30,591,221,760 bytes free
Post-Run: 30,592,221,184 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
247 --- E O F --- 2008-11-05 16:01:34
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:40:16, on 11/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lenovo\Desktop\HiJackThis\scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=111008 serial=DR12WEX-1504397-KTY lang=EN
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9146E613-423D-48F0-9A4F-E5FFC6881271}: NameServer = 218.248.255.194 218.248.255.146
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCE51623-65F4-4CE7-BF7E-126776340E48}: NameServer = 218.248.240.79,218.248.240.135
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
--
End of file - 7422 bytes
|
|
sandneet
Newbie
|
7. November 2008 @ 12:16 |
Link to this message
|
Hi,
I am very thankful to you that you have helped me so much. I had posted the logs of both scanes. Just need to know do i need to keep all the exe. file which i have downloaded or can i delete after completing the task/
I am experencing my system a bit slow and any specific reason for that or it just my illusion?
thanks
sandy
|
Senior Member
|
8. November 2008 @ 03:42 |
Link to this message
|
Hey sandneet
Please upload this file: C:\WINDOWS\system32\_psisdecd.dll to these two sites:
www.virustotal.com and www.uploadmalware.com
Post the results from www.virustotal.com here.
After that, please read here for some info about how to fix a slow PC.
http://windows.about.com/od/troubleshooting/tp/5waysperform.htm
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sandneet
Newbie
|
8. November 2008 @ 13:12 |
Link to this message
|
Hi D,
Pl find the result pested below.
File _psisdecd.dll_ received on 09.10.2008 17:58:11 (CET)
Current status: finished
Result: 0/36 (0.00%)
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.9.6.0 2008.09.10 -
AntiVir 7.8.1.28 2008.09.10 -
Authentium 5.1.0.4 2008.09.10 -
Avast 4.8.1195.0 2008.09.10 -
AVG 8.0.0.161 2008.09.10 -
BitDefender 7.2 2008.09.10 -
CAT-QuickHeal 9.50 2008.09.10 -
ClamAV 0.93.1 2008.09.10 -
DrWeb 4.44.0.09170 2008.09.10 -
eSafe 7.0.17.0 2008.09.10 -
eTrust-Vet 31.6.6082 2008.09.10 -
Ewido 4.0 2008.09.10 -
F-Prot 4.4.4.56 2008.09.09 -
F-Secure 8.0.14332.0 2008.09.10 -
Fortinet 3.112.0.0 2008.09.10 -
GData 19 2008.09.10 -
Ikarus T3.1.1.34.0 2008.09.10 -
K7AntiVirus 7.10.450 2008.09.10 -
Kaspersky 7.0.0.125 2008.09.10 -
McAfee 5380 2008.09.09 -
Microsoft 1.3903 2008.09.10 -
NOD32v2 3429 2008.09.09 -
Norman 5.80.02 2008.09.10 -
Panda 9.0.0.4 2008.09.09 -
PCTools 4.4.2.0 2008.09.10 -
Prevx1 V2 2008.09.10 -
Rising 20.61.22.00 2008.09.10 -
Sophos 4.33.0 2008.09.10 -
Sunbelt 3.1.1616.1 2008.09.09 -
Symantec 10 2008.09.10 -
TheHacker 6.3.0.9.077 2008.09.10 -
TrendMicro 8.700.0.1004 2008.09.10 -
VBA32 3.12.8.5 2008.09.10 -
ViRobot 2008.9.10.1371 2008.09.10 -
VirusBuster 4.5.11.0 2008.09.10 -
Webwasher-Gateway 6.6.2 2008.09.10 -
Additional information
File size: 198144 bytes
MD5...: dccf363dadfcf9bc838c7f81702a51b7
SHA1..: a0dc87a345d87874df9250e869eb35f0148911db
SHA256: aa1de6bbb09ded409328bf2496ff302406e8119e594fa24ef8badadd645f3bff
SHA512: 7764381cb4c143b35656e5dbcd18cf93004a37bf41bea174910cb7c842ef6ce9
b14dd9edc40f0206d742a6a705c0d4bcefd75ca0f440bec6517abf1117d7f91f
PEiD..: -
TrID..: File type identification
DirectShow filter (52.6%)
Windows OCX File (32.2%)
Win32 Executable MS Visual C++ (generic) (9.8%)
Win32 Executable Generic (2.2%)
Win32 Dynamic Link Library (generic) (1.9%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x5e106893
timedatestamp.....: 0x415926d7 (Tue Sep 28 08:54:47 2004)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x27835 0x27a00 6.49 8ed065367f9ffa557db95a6b0b1f0f44
.data 0x29000 0x9d8 0x600 5.55 6a7f4f5e383a6f662bbfb44715002d83
.rsrc 0x2a000 0x5ef0 0x6000 5.81 7c2e780e40af0616240e03c8624ae456
.reloc 0x30000 0x2066 0x2200 5.80 2c4c22d5f626c69b6f2ab23686b4e29f
( 7 imports )
> msvcrt.dll: _purecall, free, _except_handler3, __3@YAXPAX@Z, __CxxFrameHandler, gmtime, realloc, malloc, mktime, wcstol, _vsnprintf, _ftol, wcschr, _CxxThrowException, _initterm, _adjust_fdiv, _terminate@@YAXXZ, __dllonexit, _onexit, __1type_info@@UAE@XZ, __2@YAPAXI@Z
> MSVCP60.dll: __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ
> KERNEL32.dll: GetProcessHeap, lstrlenA, HeapAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, SystemTimeToFileTime, lstrlenW, InterlockedIncrement, InterlockedDecrement, LocalFree, LocalAlloc, GetLastError, LockResource, LoadResource, FindResourceW, GetModuleHandleW, MultiByteToWideChar, lstrcpyW, lstrcmpiW, lstrcpynW, HeapDestroy, lstrcatW, GetModuleFileNameW, DisableThreadLibraryCalls, FreeLibrary, GetProcAddress, LoadLibraryW, HeapFree, SizeofResource, LoadLibraryExW, GetShortPathNameW
> ADVAPI32.dll: RegEnumValueW, RegQueryValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, RegCloseKey, RegCreateKeyExW, RegDeleteValueW, RegSetValueExW
> USER32.dll: CharNextW
> ole32.dll: CoTaskMemRealloc, CoTaskMemFree, CoCreateFreeThreadedMarshaler, CoCreateInstance, CoTaskMemAlloc
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -
( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
|
|
sandneet
Newbie
|
8. November 2008 @ 13:24 |
Link to this message
|
|
Hi D,
Thank you so much for helping me with this problem. I hope my problem is solved now. You guys are really wonderful.
I have submitted the file on uploadmakware site.
Can i remove all the programms which i downloaded for cleaning this virus/malware
Thanks a lot.
rgds
Sandneet
|
|
Advertisement
|
|
|
Senior Member
|
9. November 2008 @ 02:12 |
Link to this message
|
|
Your problem is solved now! You are clean!
Yes, you can remove whatever programs we have used.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
