|
|
|
Zedo MSN Virus
|
|
|
theillusi
Junior Member
|
5. November 2008 @ 20:03 |
Link to this message
|
GAH, i think this had cropped up on here a couple of times, anyhoo, so my friend popped up, said hey look at this, its really funny, then posdted a link, now I know about the whole virus thing going about with these, but the link had "Obama" some where in it, and unfortunately my friend has an odd sense of humor, so i clicked it and it took me to a balnk web page asking me to download a java....muggins here downloaded it didnt he
ANYWAY, its screwd up msn, it logs in but i cant talk on it, so i ran AVG, came up with a load of ZEDO.txt type files, but it wont let me move it to the vault, ran Hijack and this is what came up
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:51:28, on 06/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\service.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Windows Service] service.exe
O4 - HKLM\..\RunOnce: [Windows Service] service.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 9061 bytes
i found a previous thread here with a remedy (http://forums.afterdawn.com/thread_view.cfm/411680) but hijack didnt come up with anything the other person did
basically, please help!
Thanks
|
|
Advertisement
|
 |
|
|
Senior Member
|
5. November 2008 @ 22:21 |
Link to this message
|
Hi theillusi
You have a MSN trojan all right, but not the same one as the other thread.
Please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
theillusi
Junior Member
|
6. November 2008 @ 05:09 |
Link to this message
|
|
Thanks, I'm following your instructions as we speak, just a couple more things, if it asks me to reboot is it possible to save pictures and music with out transfering them to an external memory source?
and also, out of morbid curiousity, what is the exact nature of my problem? I'd like to know what i'm trying to kill here :P
Thanks loads for your help so far!
|
|
theillusi
Junior Member
|
6. November 2008 @ 11:24 |
Link to this message
|
|
right, followed the instructions, as far as i can tell its fixed, i couldnt see an option anywhere to make a log for you though...:S
|
Senior Member
|
6. November 2008 @ 20:34 |
Link to this message
|
Follow these instructions for a log:
Originally posted by cdavfrew:
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
theillusi
Junior Member
|
7. November 2008 @ 04:08 |
Link to this message
|
ok, heres the log
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/06/2008 at 04:03 PM
Application Version : 4.21.1004
Core Rules Database Version : 3625
Trace Rules Database Version: 1609
Scan type : Complete Scan
Total Scan Time : 05:45:13
Memory items scanned : 171
Memory threats detected : 0
Registry items scanned : 4184
Registry threats detected : 0
File items scanned : 105282
File threats detected : 224
Adware.Tracking Cookie
C:\Documents and Settings\Nick\Cookies\nick@edge.ru4[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ad1.clickhype[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.us.e-planning[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad.yieldmanager[2].txt
C:\Documents and Settings\Nick\Cookies\nick@fastclick[1].txt
C:\Documents and Settings\Nick\Cookies\nick@w00tpublishers.wootmedia[2].txt
C:\Documents and Settings\Nick\Cookies\nick@overture[1].txt
C:\Documents and Settings\Nick\Cookies\nick@apmebf[1].txt
C:\Documents and Settings\Nick\Cookies\nick@sexintheuk[1].txt
C:\Documents and Settings\Nick\Cookies\nick@counter6.sextracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@bluestreak[2].txt
C:\Documents and Settings\Nick\Cookies\nick@media.adrevolver[3].txt
C:\Documents and Settings\Nick\Cookies\nick@adopt.euroclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.burstbeacon[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ad2.clickhype[1].txt
C:\Documents and Settings\Nick\Cookies\nick@msnportal.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@serving.adsrevenue.clicksor[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[3].txt
C:\Documents and Settings\Nick\Cookies\nick@partypoker[2].txt
C:\Documents and Settings\Nick\Cookies\nick@data.coremetrics[1].txt
C:\Documents and Settings\Nick\Cookies\nick@server.cpmstar[1].txt
C:\Documents and Settings\Nick\Cookies\nick@valueclick[1].txt
C:\Documents and Settings\Nick\Cookies\nick@barfquestion.newgrounds[1].txt
C:\Documents and Settings\Nick\Cookies\nick@versiontracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adv.xboard[1].txt
C:\Documents and Settings\Nick\Cookies\nick@hentaicounter[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ehg-idgentertainment.hitbox[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.xxxblackbook[1].txt
C:\Documents and Settings\Nick\Cookies\nick@advertising[1].txt
C:\Documents and Settings\Nick\Cookies\nick@zedo[2].txt
C:\Documents and Settings\Nick\Cookies\nick@collective-media[2].txt
C:\Documents and Settings\Nick\Cookies\nick@pornbb[2].txt
C:\Documents and Settings\Nick\Cookies\nick@questionmarket[1].txt
C:\Documents and Settings\Nick\Cookies\nick@pornotube[1].txt
C:\Documents and Settings\Nick\Cookies\nick@indextools[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.etracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad2.adecn[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmichd5cfp.stats.esomniture[1].txt
C:\Documents and Settings\Nick\Cookies\nick@atwola[1].txt
C:\Documents and Settings\Nick\Cookies\nick@sextracker[2].txt
C:\Documents and Settings\Nick\Cookies\nick@stat.onestat[2].txt
C:\Documents and Settings\Nick\Cookies\nick@mediaonenetwork[1].txt
C:\Documents and Settings\Nick\Cookies\nick@rotator.adjuggler[3].txt
C:\Documents and Settings\Nick\Cookies\nick@kontera[2].txt
C:\Documents and Settings\Nick\Cookies\nick@free.wegcash[2].txt
C:\Documents and Settings\Nick\Cookies\nick@paypal.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@statcounter[2].txt
C:\Documents and Settings\Nick\Cookies\nick@tracking.summitmedia.co[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad2.doublepimp[1].txt
C:\Documents and Settings\Nick\Cookies\nick@12.go.globaladsales[1].txt
C:\Documents and Settings\Nick\Cookies\nick@allporntube[1].txt
C:\Documents and Settings\Nick\Cookies\nick@clickthrough.wegcash[2].txt
C:\Documents and Settings\Nick\Cookies\nick@tribalfusion[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.pornbb[2].txt
C:\Documents and Settings\Nick\Cookies\nick@at.atwola[1].txt
C:\Documents and Settings\Nick\Cookies\nick@casalemedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@msnaccountservices.112.2o7[2].txt
C:\Documents and Settings\Nick\Cookies\nick@serving-sys[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmygkdzkco.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adecn[1].txt
C:\Documents and Settings\Nick\Cookies\nick@tradedoubler[1].txt
C:\Documents and Settings\Nick\Cookies\nick@tripod[1].txt
C:\Documents and Settings\Nick\Cookies\nick@counter2.sextracker[2].txt
C:\Documents and Settings\Nick\Cookies\nick@videoegg.adbureau[1].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkowldpwhq.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@reduxads.valuead[2].txt
C:\Documents and Settings\Nick\Cookies\nick@publishers.clickbooth[1].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkiejdjggp.stats.esomniture[1].txt
C:\Documents and Settings\Nick\Cookies\nick@bs.serving-sys[1].txt
C:\Documents and Settings\Nick\Cookies\nick@247realmedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@clickbank[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adultfriendfinder.cams[2].txt
C:\Documents and Settings\Nick\Cookies\nick@doubleclick[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.anm.co[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad.uk.tangozebra[1].txt
C:\Documents and Settings\Nick\Cookies\nick@insightexpressai[2].txt
C:\Documents and Settings\Nick\Cookies\nick@porntube[2].txt
C:\Documents and Settings\Nick\Cookies\nick@pro-market[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ehg-autotrader.hitbox[1].txt
C:\Documents and Settings\Nick\Cookies\nick@media6degrees[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adtech[1].txt
C:\Documents and Settings\Nick\Cookies\nick@track.adform[1].txt
C:\Documents and Settings\Nick\Cookies\nick@mediaplex[2].txt
C:\Documents and Settings\Nick\Cookies\nick@clicktorrent[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adrevolver[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.burstnet[1].txt
C:\Documents and Settings\Nick\Cookies\nick@xiti[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjl4ejd5slp.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@revsci[1].txt
C:\Documents and Settings\Nick\Cookies\nick@realmedia[2].txt
C:\Documents and Settings\Nick\Cookies\nick@media.mtvnservices[2].txt
C:\Documents and Settings\Nick\Cookies\nick@serif.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad1.emediate[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adultadworld[1].txt
C:\Documents and Settings\Nick\Cookies\nick@servedby.onlinemediadiva[2].txt
C:\Documents and Settings\Nick\Cookies\nick@account.live[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.pointroll[1].txt
C:\Documents and Settings\Nick\Cookies\nick@atdmt[1].txt
C:\Documents and Settings\Nick\Cookies\nick@rotator.adjuggler[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adbrite[2].txt
C:\Documents and Settings\Nick\Cookies\nick@media.adrevolver[1].txt
C:\Documents and Settings\Nick\Cookies\nick@xxxblackbook[2].txt
C:\Documents and Settings\Nick\Cookies\nick@trvlnet.adbureau[2].txt
C:\Documents and Settings\Nick\Cookies\nick@interclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@dynamic.media.adrevolver[1].txt
C:\Documents and Settings\Nick\Cookies\nick@americanexpress.122.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adserver.adreactor[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adlegend[1].txt
C:\Documents and Settings\Nick\Cookies\nick@trafficmp[1].txt
C:\Documents and Settings\Nick\Cookies\nick@burstnet[2].txt
C:\Documents and Settings\Nick\Cookies\nick@stat.dealtime[2].txt
C:\Documents and Settings\Nick\Cookies\nick@blykservices.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.pregnantxxxmovies[2].txt
C:\Documents and Settings\Nick\Cookies\nick@yadro[2].txt
C:\Documents and Settings\Nick\Cookies\nick@pacificpoker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@socialmedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@2o7[2].txt
C:\Documents and Settings\Nick\Cookies\nick@specificclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@rktrack[1].txt
C:\Documents and Settings\Nick\Cookies\nick@a.websponsors[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adviva[1].txt
C:\Documents and Settings\Nick\Cookies\nick@highbeam.122.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wdk4wjcjshq.stats.esomniture[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adserve.rupizads[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.rlcomics[1].txt
C:\Documents and Settings\Nick\Cookies\nick@trinitymirror.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adcentriconline[1].txt
C:\Documents and Settings\Nick\Cookies\nick@eas.apm.emediate[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfl4uodjsap.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@cms.trafficmp[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ice.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ssa.adxdnet[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.3pintracking[1].txt
C:\Documents and Settings\Nick\Cookies\nick@sixapart.adbureau[2].txt
C:\Documents and Settings\Nick\Cookies\nick@vip.clickzs[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.clicksor[1].txt
C:\Documents and Settings\Nick\Cookies\nick@counter3.sextracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@serv.clicksor[2].txt
C:\Documents and Settings\Nick\Cookies\nick@crucial.adbureau[2].txt
C:\Documents and Settings\Nick\Cookies\nick@myroitracking[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjk4kjc5obo.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@cdn.at.atwola[1].txt
C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[1].txt
C:\Documents and Settings\Nick\Cookies\nick@statse.webtrendslive[1].txt
C:\Documents and Settings\Nick\Cookies\nick@atoc.112.2o7[2].txt
C:\Documents and Settings\Nick\Cookies\nick@hitbox[1].txt
C:\Documents and Settings\Nick\Cookies\nick@cadburyschweppesplc.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@chitika[1].txt
C:\Documents and Settings\Nick\Cookies\nick@counter8.sextracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@server.iad.liveperson[3].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmyglazsbq.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.movieweb[2].txt
C:\Documents and Settings\Nick\Cookies\nick@pregnanteen[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adultfriendfinder[2].txt
C:\Documents and Settings\Nick\Cookies\nick@carphonewarehouse.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@media303[2].txt
C:\Documents and Settings\Nick\Cookies\nick@sixapart.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.teentube4free[1].txt
C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[3].txt
C:\Documents and Settings\Nick\Cookies\nick@www.gamestracker[2].txt
C:\Documents and Settings\Nick\Cookies\nick@sales.liveperson[3].txt
C:\Documents and Settings\Nick\Cookies\nick@sexuality.about[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ad.mmoabc[1].txt
C:\Documents and Settings\Nick\Cookies\nick@precisionclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adfarm1.adition[1].txt
C:\Documents and Settings\Nick\Cookies\nick@iacas.adbureau[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ar.atwola[1].txt
C:\Documents and Settings\Nick\Cookies\nick@imrworldwide[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ylovesporn[2].txt
C:\Documents and Settings\Nick\Cookies\nick@dmtracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@porn.naughtyfiles[2].txt
C:\Documents and Settings\Nick\Cookies\nick@devart.adbureau[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ehg-rodale.hitbox[1].txt
C:\Documents and Settings\Nick\Cookies\nick@uk.sitestat[1].txt
C:\Documents and Settings\Nick\Cookies\nick@rambler[1].txt
C:\Documents and Settings\Nick\Cookies\nick@clickcash[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.versiontracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ehg-mgnlimited.hitbox[1].txt
C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[2].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkygoajglp.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.usenext[2].txt
C:\Documents and Settings\Nick\Cookies\nick@tacoda[1].txt
C:\Documents and Settings\Nick\Cookies\nick@test.coremetrics[1].txt
C:\Documents and Settings\Nick\Cookies\nick@indexstats[2].txt
C:\Documents and Settings\Nick\Cookies\nick@stats.adbrite[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.addynamix[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.aol.co[1].txt
C:\Documents and Settings\Nick\Cookies\nick@affiliates.hottopicmedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@beyondsexxy[1].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmialajgep.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adopt.specificclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@friendfinder[2].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.newgrounds[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.techguy[1].txt
C:\Documents and Settings\Nick\Cookies\nick@adserver.adtechus[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.zanox-affiliate[2].txt
C:\Documents and Settings\Nick\Cookies\nick@cgm.adbureau[1].txt
C:\Documents and Settings\Nick\Cookies\nick@sales.liveperson[1].txt
C:\Documents and Settings\Nick\Cookies\nick@azjmp[1].txt
C:\Documents and Settings\Nick\Cookies\nick@viacom.adbureau[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ar.atwola[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[6].txt
C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[2].txt
C:\Documents and Settings\Nick\Cookies\nick@www.weloveteengirls[1].txt
C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkisjc5kep.stats.esomniture[2].txt
C:\Documents and Settings\Nick\Cookies\nick@optimize.indieclick[2].txt
C:\Documents and Settings\Nick\Cookies\nick@royalmail.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ehg-logantod.hitbox[2].txt
C:\Documents and Settings\Nick\Cookies\nick@counter10.sextracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.tbnhost.co[2].txt
C:\Documents and Settings\Nick\Cookies\nick@counter12.sextracker[1].txt
C:\Documents and Settings\Nick\Cookies\nick@gettyimages.122.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@stats.manticoretechnology[1].txt
C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[1].txt
C:\Documents and Settings\Nick\Cookies\nick@network.realmedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.ak.facebook[1].txt
C:\Documents and Settings\Nick\Cookies\nick@media.medhelp[2].txt
C:\Documents and Settings\Nick\Cookies\nick@weloveteengirls[2].txt
C:\Documents and Settings\Nick\Cookies\nick@adserver1.w00tmedia[1].txt
C:\Documents and Settings\Nick\Cookies\nick@112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@medhelpinternational.112.2o7[1].txt
C:\Documents and Settings\Nick\Cookies\nick@googleadservices[1].txt
C:\Documents and Settings\Nick\Cookies\nick@ads.widgetbucks[1].txt
C:\Documents and Settings\Nick\Cookies\nick@server.iad.liveperson[1].txt
cheers
|
Senior Member
|
7. November 2008 @ 05:05 |
Link to this message
|
Hey theillusi
Thanks for following my instructions.
Originally posted by theillusi:
Thanks, I'm following your instructions as we speak, just a couple more things, if it asks me to reboot is it possible to save pictures and music with out transfering them to an external memory source?
and also, out of morbid curiousity, what is the exact nature of my problem? I'd like to know what i'm trying to kill here :P
Sorry I didn't get to answer your questions. I'll answer them now.
1. Why wouldn't it be? As in save pictures to another hard drive? Or save pictures onto the infected computer? Both are possible.
2. From your HijackThis log, I can identify a MSN trojan which is causing your problem. However, Superantispyware did not fix it, so you problem should still be there....
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
After that, post a new HijackThis log.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
theillusi
Junior Member
|
10. November 2008 @ 16:37 |
Link to this message
|
Combofix log
ComboFix 08-11-09.04 - Nick 2008-11-10 21:13:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.296 [GMT 0:00]
Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\admintxt.txt
c:\windows\service.exe
c:\windows\system32\bdbsbkuw.ini
c:\windows\system32\dpclwqtu.dll
c:\windows\system32\gjTAdMoq.ini
c:\windows\system32\gjTAdMoq.ini2
c:\windows\system32\igfpogpw.dll
c:\windows\system32\jkkJAqRK.dll
c:\windows\system32\KRqAJkkj.ini
c:\windows\system32\KRqAJkkj.ini2
c:\windows\system32\rqeidann.dll
c:\windows\system32\svtptf.dll
c:\windows\system32\utqwlcpd.ini
c:\windows\system32\wukbsbdb.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 )))))))))))))))))))))))))))))))
.
2008-11-10 19:35 . 2008-11-10 19:35 35,328 --a------ c:\windows\system32\khfdCtuT.dll
2008-11-10 19:35 . 2008-11-10 19:35 35,328 --a------ c:\windows\system32\awtttQHx.dll
2008-11-10 19:08 . 2008-11-10 19:08 35,328 --a------ c:\windows\system32\wvUnKAqn.dll
2008-11-10 19:08 . 2008-11-10 19:08 35,328 --a------ c:\windows\system32\tuvuTNee.dll
2008-11-10 18:58 . 2008-11-10 18:58 85,504 --a------ c:\windows\system32\dxjaisaa.dll
2008-11-10 18:52 . 2008-11-10 18:52 35,328 --a------ c:\windows\system32\opnomjgH.dll
2008-11-10 18:52 . 2008-11-10 18:52 35,328 --a------ c:\windows\system32\iifdayWp.dll
2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites
2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro
2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe
2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker
2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica
2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll
2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4
2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica
2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects
2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-10 21:25 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar
2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire
2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent
2008-11-08 20:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2
2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-08 20:42 --------- d-----w c:\program files\Kontiki
2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam
2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse
2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-14 13:54 --------- d-----w c:\program files\InterActual
2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer
2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI
2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 09:57 2,185,984 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:18 2,062,976 ----a-w c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24990BFC-C554-403B-A22D-40A8ED1828F8}]
2008-11-10 21:26 246272 --a------ c:\windows\system32\geBuVPhF.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}]
2008-11-10 18:52 35328 --a------ c:\windows\system32\opnomjgH.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}]
2008-11-10 18:58 85504 --a------ c:\windows\system32\dxjaisaa.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}"= "c:\windows\system32\opnomjgH.dll" [2008-11-10 35328]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomjgH]
2008-11-10 18:52 35328 c:\windows\system32\opnomjgH.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\geBuVPhF
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
--a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040]
R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032]
S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312]
.
Contents of the 'Scheduled Tasks' folder
2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-11-10 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []
2008-11-10 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
2008-05-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
- - - - ORPHANS REMOVED - - - -
BHO-{7815e68c-fd92-4671-b192-398b5e4ce4f7} - c:\windows\system32\svtptf.dll
BHO-{94F82254-ABD1-4448-A5C4-B634D24972E6} - c:\windows\system32\jkkJAqRK.dll
BHO-{DCEDD09A-E6BA-4375-A650-2C08F7FD5CFC} - c:\windows\system32\qoMdATjg.dll
HKLM-Run-b8dcc183 - c:\windows\system32\wukbsbdb.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\yl7j4ywh.default\
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 21:21:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\system32\winlogon.exe
-> c:\windows\system32\opnomjgH.dll
PROCESS: c:\windows\explorer.exe
-> c:\windows\system32\xhegypyu.dll
-> c:\windows\system32\geBuVPhF.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Kontiki\KService.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-11-10 21:30:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-10 21:30:25
Pre-Run: 4,389,306,368 bytes free
Post-Run: 6,036,250,624 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
224 --- E O F --- 2008-11-10 08:56:02
and hijack log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:11, on 10/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: qjtdar.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 6914 bytes
Cheers for all your help so far, there's n way i could have worked this all out myself
ive done everything you said so far, since the virus i've been having pop-ups like crazy on IE 7, and still am up to thise point
|
Senior Member
|
11. November 2008 @ 04:04 |
Link to this message
|
Hey theillusi
I'm kinda shocked here, that ComboFix managed to delete so many trojans that full-fledged antimalware like AVG and Superantispyware did not even detect...
You are still infected though; let's complete it!
1.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
Open Notepad and copy/paste the text in the code box below into it:
File::
C:\windows\system32\geBuVPhF.dll
C:\windows\system32\opnomjgH.dll
C:\windows\system32\dxjaisaa.dll
c:\windows\system32\khfdCtuT.dll
C:\windows\system32\awtttQHx.dll
C:\windows\system32\wvUnKAqn.dll
C:\windows\system32\tuvuTNee.dll
C:\windows\system32\dxjaisaa.dll
C:\windows\system32\opnomjgH.dll
C:\windows\system32\iifdayWp.dll
Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomjgH]
? Save this as CFScript.txt in the same folder as ComboFix.
? Then drag the CFScript.txt into Combo-Fix.exe.
? This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt).
Do not click on the ComoboFix window, as it may cause it to stall.
2.
Please run HijackThis.
? Click on the button which says Main Menu, then Do a system scan only.
? Please wait for the scan to be completed.
? After the scan has completed, check the following entries.
O20 - AppInit_DLLs: qjtdar.dll
Click on the button Fix checked
NOTE:: Close all browsers before fixing anything.
After that, reboot.
Tell me how your computer fares.
Also zip this folder C:\Qoobox into a zip file and upload it to http://www.uploadmalware.com/
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
This message has been edited since posting. Last time this message was edited on 11. November 2008 @ 04:11
|
|
theillusi
Junior Member
|
11. November 2008 @ 05:48 |
Link to this message
|
ComboFix 08-11-09.04 - Nick 2008-11-11 10:24:59.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.474 [GMT 0:00]
Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe
Command switches used :: c:\documents and settings\Nick\My Documents\Downloads\CFScript.txt
* Created a new restore point
FILE ::
c:\windows\system32\awtttQHx.dll
c:\windows\system32\dxjaisaa.dll
c:\windows\system32\geBuVPhF.dll
c:\windows\system32\iifdayWp.dll
c:\windows\system32\khfdCtuT.dll
c:\windows\system32\opnomjgH.dll
c:\windows\system32\tuvuTNee.dll
c:\windows\system32\wvUnKAqn.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\awtttQHx.dll
c:\windows\system32\dxjaisaa.dll
c:\windows\system32\FhPVuBeg.ini
c:\windows\system32\FhPVuBeg.ini2
c:\windows\system32\geBuVPhF.dll
c:\windows\system32\iifdayWp.dll
c:\windows\system32\iyotjvhh.dll
c:\windows\system32\khfdCtuT.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\opnomjgH.dll
c:\windows\system32\qjtdar.dll
c:\windows\system32\tuvuTNee.dll
c:\windows\system32\uypygehx.ini
c:\windows\system32\wvUnKAqn.dll
c:\windows\system32\xhegypyu.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.
2008-11-10 21:28 . 2008-11-10 21:28 85,504 --a------ c:\windows\system32\eoevpmjx.dll
2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites
2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro
2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe
2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker
2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica
2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll
2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4
2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica
2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects
2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 10:39 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2008-11-10 22:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar
2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire
2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent
2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2
2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-08 20:42 --------- d-----w c:\program files\Kontiki
2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam
2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse
2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock
2008-09-14 13:54 --------- d-----w c:\program files\InterActual
2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer
2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI
.
((((((((((((((((((((((((((((( snapshot@2008-11-10_21.28.55.23 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-10 21:20:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat
+ 2008-11-11 10:37:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}]
2008-11-10 21:28 85504 --a------ c:\windows\system32\eoevpmjx.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"b8dcc183"="c:\windows\system32\xhegypyu.dll" [BU]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=qjtdar.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
--a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040]
R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032]
S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312]
.
Contents of the 'Scheduled Tasks' folder
2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-11-11 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []
2008-11-11 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
2008-05-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
- - - - ORPHANS REMOVED - - - -
BHO-{3c978489-839e-4e9b-8d12-de0cd3383801} - c:\windows\system32\qjtdar.dll
BHO-{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2} - c:\windows\system32\opnomjgH.dll
BHO-{CDD5B88A-A304-4332-B9C3-84EBFADDAB4B} - c:\windows\system32\geBuVPhF.dll
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 10:37:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Kontiki\KService.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Completion time: 2008-11-11 10:44:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-11 10:44:49
ComboFix2.txt 2008-11-10 21:30:41
Pre-Run: 5,976,870,912 bytes free
Post-Run: 5,989,605,376 bytes free
202 --- E O F --- 2008-11-10 08:56:02
that the combo fix latest log, now doing the hijack step
|
|
theillusi
Junior Member
|
11. November 2008 @ 05:55 |
Link to this message
|
|
OK, done everything you said, what do I do with the orginal Qoobox folder? it looks like some kind of quarrantine folder or something, i dare not touch it :P
|
Senior Member
|
11. November 2008 @ 07:22 |
Link to this message
|
Now this malware is just getting on my nerves...
It's not gone yet. I'll need you to do something with Combofix, then one more scan.
1.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
Open Notepad and copy/paste the text in the code box below into it:
File::
c:\windows\system32\qjtdar.dll
c:\windows\system32\eoevpmjx.dll
c:\windows\system32\xhegypyu.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"b8dcc183"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
? Save this as CFScript.txt in the same folder as ComboFix.
? Then drag the CFScript.txt into Combo-Fix.exe.
? This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt).
Do not click on the ComoboFix window, as it may cause it to stall.
2.
Please download Malwarebytes Anti-Malware and install it. Follow the prompts and reboot if required.
Launch Malwarebytes either by running C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe or double-click the Malwarebytes' Anti-Malware shortcut on your Desktop.
Configuring Malwarebytes
? Click on the tab Settings.
? Make sure only these boxes are checked:
Terminate Internet Explorer
Automatically save and display logfile after removal
Always scan memory objects
Always scan registry objects
Always scan filesystem
Always scan extra and heuristics objects
Updating Malwarebytes
? Click on the tab Update.
? Press the button Check for Updates
? Wait for Malwarebytes to be fully updated.
Scanning Time
? Click on the tab Scanner.
? Check Perform full scan and click on Scan
? Wait for the scan to complete, and then click on Show Results.
? Make sure all items are checked, then click on Remove Selected.
**If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If you are asked to restart the computer, please do so immediately.
Post A Log
? A text box will pop up after the removal process is over. Post the contents of the text here.
? If no text box pops up, launch Malwarebytes, and click on the tab Logs.
? The logs will appear as mbam-log-*date-*time.txt. Select the latest one, and then click on Open.
? Post the log here.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
theillusi
Junior Member
|
11. November 2008 @ 16:22 |
Link to this message
|
ComboFix 08-11-10.01 - Nick 2008-11-11 21:14:05.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.500 [GMT 0:00]
Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe
Command switches used :: c:\documents and settings\Nick\My Documents\Downloads\CFScript.txt
* Created a new restore point
FILE ::
c:\windows\system32\eoevpmjx.dll
c:\windows\system32\qjtdar.dll
c:\windows\system32\xhegypyu.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\eoevpmjx.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.
2008-11-11 10:51 . 2008-11-11 10:51 3,368,675 --a------ C:\Qoobox.zip
2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites
2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com
2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro
2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe
2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker
2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica
2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll
2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4
2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica
2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects
2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 21:16 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki
2008-11-10 22:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar
2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire
2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent
2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2
2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-08 20:42 --------- d-----w c:\program files\Kontiki
2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam
2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse
2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-14 13:54 --------- d-----w c:\program files\InterActual
2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer
2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI
2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 09:57 2,185,984 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:18 2,062,976 ----a-w c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-10_21.28.55.23 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-10 21:20:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat
+ 2008-11-11 10:37:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
--a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040]
R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032]
S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312]
.
Contents of the 'Scheduled Tasks' folder
2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-11-11 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []
2008-11-11 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
2008-05-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 21:16:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-11-11 21:19:22
ComboFix-quarantined-files.txt 2008-11-11 21:18:18
ComboFix2.txt 2008-11-11 10:44:55
ComboFix3.txt 2008-11-10 21:30:41
Pre-Run: 5,970,681,856 bytes free
Post-Run: 5,966,245,888 bytes free
160 --- E O F --- 2008-11-10 08:56:02
theres the log, doing the malwarebyte thing now
|
|
theillusi
Junior Member
|
11. November 2008 @ 17:23 |
Link to this message
|
Malwarebytes' Anti-Malware 1.30
Database version: 1383
Windows 5.1.2600 Service Pack 2
11/11/2008 22:19:25
mbam-log-2008-11-11 (22-19-25).txt
Scan type: Full Scan (C:\|)
Objects scanned: 107349
Time elapsed: 49 minute(s), 36 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 20
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\dpclwqtu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\geBuVPhF.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\igfpogpw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\iyotjvhh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkJAqRK.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qjtdar.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rqeidann.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\svtptf.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wukbsbdb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\xhegypyu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570586.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570588.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570589.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570590.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570591.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570593.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572615.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572623.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572624.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572626.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
and there the malwarebytes log
Anything else? lol it must be gone by now:P
Thanks so much for your help
|
|
Advertisement
|
|
|
Senior Member
|
11. November 2008 @ 22:49 |
Link to this message
|
Hey theillusi
Yes, you're all clean now. You can delete HijackThis and Combofix (this is recommended), and also uninstall the programs we used if you wish.
Enjoy!
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
