Page 3 of 5 FirstFirst 12345 LastLast
Results 21 to 30 of 49

Thread: WIN32/Matcash problem

  1. 2007-07-04, 18:53 #21
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Looking at your log it seems Vundo has made a comeback.

    If you still have ComboFix on your computer then run it. Otherwise we need to download it again. Here are instructions.

    1. Download this file -
    combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your
    next reply along with a fresh hjt log.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause
    it to stall
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  2. 2007-07-04, 20:28 #22
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Hi again, Done that and here are the logs.

    "Andy" - 2007-07-04 19:12:29 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


    ((((((((((((((((((((((((( Files Created from 2007-06-04 to 2007-07-04 )))))))))))))))))))))))))))))))


    2007-07-04 18:45 66,112 --a------ C:\WINDOWS\system32\fjbiqmuf.dll
    2007-07-04 16:50 128,576 --a------ C:\WINDOWS\system32\ndavqoro.dll
    2007-07-03 19:15 <DIR> d-------- C:\DOCUME~1\Andy\APPLIC~1\Viewpoint
    2007-07-03 16:48 66,112 --a------ C:\WINDOWS\system32\shoinfjd.dll
    2007-07-02 23:04 189,440 --a------ C:\DOCUME~1\Andy\fset.exe
    2007-07-02 20:56 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-07-02 20:32 <DIR> d-------- C:\WINDOWS\pss
    2007-06-30 22:08 49,152 --a------ C:\WINDOWS\nircmd.exe
    2007-06-30 13:05 <DIR> dr-h----- C:\DOCUME~1\Andy\APPLIC~1\SecuROM
    2007-06-29 06:49 <DIR> d-------- C:\Program Files\Viewpoint
    2007-06-23 23:50 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
    2007-06-23 23:35 <DIR> d-------- C:\WINDOWS\.jagex_cache_34
    2007-06-21 19:14 630,432 --a------ C:\WINDOWS\system32\drivers\vetefile.sys
    2007-06-21 19:14 108,624 --a------ C:\WINDOWS\system32\drivers\veteboot.sys
    2007-06-08 20:04 106,465 --a------ C:\WINDOWS\fd.exe


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-07-04 17:58:54 384 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-00000002-00001102-00000004-20021102}.dat
    2007-07-04 17:58:54 384 ----a-w C:\WINDOWS\system32\DVCState-{00000003-00000000-00000002-00001102-00000004-20021102}.dat
    2007-07-04 16:44:03 42 ----a-w C:\WINDOWS\popcinfo.dat
    2007-07-01 15:17:04 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-06-25 11:34:25 -------- d-----w C:\Program Files\MSN Messenger
    2007-06-19 12:30:59 -------- d-----w C:\Program Files\Common Files\AOL
    2007-06-18 15:16:47 -------- d-----w C:\Program Files\Common Files\uzfq
    2007-06-16 09:56:59 684 ----a-w C:\WINDOWS\eReg.dat
    2007-05-31 12:47:06 114,448 ----a-w C:\WINDOWS\system32\drivers\KmxFw.sys
    2007-05-31 12:47:04 92,432 ----a-w C:\WINDOWS\system32\drivers\KmxStart.sys
    2007-05-31 12:47:04 256,784 ----a-w C:\WINDOWS\system32\UmxSbxw.dll
    2007-05-31 12:47:04 126,224 ----a-w C:\WINDOWS\system32\drivers\KmxCF.sys
    2007-05-31 12:47:02 117,520 ----a-w C:\WINDOWS\system32\UmxSbxExw.dll
    2007-05-30 21:53:48 -------- d-----w C:\DOCUME~1\Andy\APPLIC~1\Nokia Multimedia Player
    2007-05-29 19:27:04 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-05-28 20:09:05 -------- d-----w C:\Program Files\Common Files\Scanner
    2007-05-19 08:37:35 -------- d-----w C:\DOCUME~1\Andy\APPLIC~1\ITEDO
    2007-05-19 08:37:02 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-05-19 08:37:02 -------- d-----w C:\Program Files\InstallActiveX
    2007-05-18 13:30:00 89,096 ----a-w C:\WINDOWS\system32\drivers\KmxCfg.sys
    2007-05-18 13:30:00 79,368 ----a-w C:\WINDOWS\system32\UmxWNP.dll
    2007-05-18 13:30:00 63,496 ----a-w C:\WINDOWS\system32\drivers\KmxSbx.sys
    2007-05-18 13:30:00 61,960 ----a-w C:\WINDOWS\system32\drivers\KmxAgent.sys
    2007-05-18 13:30:00 45,064 ----a-w C:\WINDOWS\system32\drivers\KmxFile.sys
    2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-05-03 16:16:35 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
    2007-05-03 16:16:35 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
    2007-05-03 16:16:35 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
    2007-05-03 06:43:22 111,067 ----a-w C:\WINDOWS\w0.exe
    2007-05-02 20:46:30 99,904 ----a-w C:\WINDOWS\system32\isafeif.dll
    2007-05-02 20:46:30 79,424 ----a-w C:\WINDOWS\system32\vetredir.dll
    2007-05-02 20:46:30 75,280 ----a-w C:\WINDOWS\system32\isafprod.dll
    2007-04-29 13:23:12 4,096 ----a-w C:\WINDOWS\d3dx.dat
    2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
    2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
    2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-04-16 21:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-04-16 21:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=d:\utility programs\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 13:02]
    {16664845-0E00-11D2-8059-000000000000}=C:\Program Files\Common Files\ReGet Shared\Catcher.dll [2004-04-08 14:48]
    {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}=C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 13:50]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTHelper"="CTHELPER.EXE" [2003-06-20 04:55 C:\WINDOWS\system32\CTHELPER.EXE]
    "AsioReg"="REGSVR32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\regsvr32.exe]
    "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06]
    "PtiuPbmd"="ptipbm.dll" [2003-01-15 12:41 C:\WINDOWS\system32\ptipbm.dll]
    "Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 15:50]
    "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 16:24]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-19 11:04]
    "nwiz"="nwiz.exe" [2003-09-24 12:32 C:\WINDOWS\system32\nwiz.exe]
    "CTSysVol"="D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe" [2003-07-02 10:03]
    "CTDVDDET"="D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE" [2003-06-18 01:00]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-09 23:12]
    "SunJavaUpdateSched"="D:\Utility Programs\Java\bin\jusched.exe" [2005-08-26 18:14]
    "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2005-04-08 14:09]
    "GSICONEXE"="gsicon.exe" [2003-05-14 21:26 C:\WINDOWS\system32\gsicon.exe]
    "%FP%Friendly fts.exe"="C:\Program Files\VoyagerTest\fts.exe" [2003-05-06 10:28]
    "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2007-01-10 12:06]
    "cctray"="D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-07 08:58]
    "CAVRID"="D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-02 21:46]
    "HostManager"="C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe" [2006-11-17 14:21]
    "PCSuiteTrayApplication"="D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 12:59]
    "DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 12:14]
    "cafwc"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2007-06-01 14:14]
    "capfasem"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2007-06-01 14:14]
    "capfupgrade"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2007-06-01 14:07]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
    "RemoteCenter"="D:\Utility Programs\Creative\RemoteControl\RCMan.EXE" [2003-06-12 09:47]
    "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
    "PcSync"="D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 12:29]
    "H/PC Connection Agent"="D:\Road Angel\Active Sync\wcescomm.exe" [2006-06-26 16:13]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Protection\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 13:29]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
    UmxWnp.Dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]


    Contents of the 'Scheduled Tasks' folder
    2007-06-27 17:09:07 C:\WINDOWS\tasks\CAAntiSpywareScan_Daily as Andy at 10 17.job
    2007-07-04 18:01:08 C:\WINDOWS\tasks\RegCure Program Check.job
    2007-02-20 17:52:54 C:\WINDOWS\tasks\RegCure.job
    2006-06-19 18:33:54 C:\WINDOWS\tasks\XoftSpy.job

    **************************************************************************

    catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-04 19:15:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-07-04 19:16:51
    C:\ComboFix-quarantined-files.txt ... 2007-07-04 19:16
    C:\ComboFix2.txt ... 2007-06-30 22:16

    --- E O F ---
  3. 2007-07-04, 20:29 #23
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 19:23:25, on 04/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\WINDOWS\wanmpsvc.exe
    D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\QuickTime\qttask.exe
    D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe
    D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    D:\Utility Programs\Java\bin\jusched.exe
    C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    C:\WINDOWS\system32\gsicon.exe
    C:\Program Files\VoyagerTest\fts.exe
    D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe
    D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    D:\Road Angel\Active Sync\wcescomm.exe
    D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\AOL 9.0\aoltray.exe
    D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    D:\Utility Programs\Palm\HOTSYNC.EXE
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    D:\ROADAN~1\ACTIVE~1\rapimgr.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Andy\Desktop\HJT\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\utility programs\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\Utility Programs\ReGetDx\iebar.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTSysVol] D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [CTDVDDET] D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Utility Programs\Java\bin\jusched.exe
    O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
    O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [cctray] "D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe"
    O4 - HKLM\..\Run: [CAVRID] "D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [cafwc] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    O4 - HKLM\..\Run: [capfasem] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    O4 - HKLM\..\Run: [capfupgrade] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RemoteCenter] D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [PcSync] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Road Angel\Active Sync\wcescomm.exe"
    O4 - Startup: HotSync Manager.lnk = D:\Utility Programs\Palm\HOTSYNC.EXE
    O4 - Global Startup: Acrobat Assistant.lnk = D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
    O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utility Programs\Java\bin\npjpi150_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utility Programs\Java\bin\npjpi150_05.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.co...s/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1158250651359
    O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab55762.cab
    O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab
    O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file:///M:/SuperCD/IntraLaunch.CAB
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/W...gPublisher.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab55579.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: CaCCProvSP - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PPCtlPriv - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    Cheers mate, happy reading!

    Andy
  4. 2007-07-04, 21:26 #24
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Couldn't find much wrong there. In previous hjt log was
    O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\ndavqoro.dll",forkonce entry but in this most present one it doesn't anymore exist.

    Anyway, delete following files (have hidden files visible):
    C:\WINDOWS\system32\fjbiqmuf.dll
    C:\WINDOWS\system32\ndavqoro.dll
    C:\WINDOWS\system32\shoinfjd.dll

    Then we should try to fix following entry with hjt:
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE


    It's a legal one but in some cases may cause troubles. Fixing it won't hurt (and we can restore it from hjt backups if needed) and may fix that issue when shutting down computer.


    You should also do Java update which I instructed in my "clean speech". Old Java versions are vulnerable to baddies like Vundo and make system easier to get re-infected.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  5. 2007-07-07, 00:23 #25
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Hi again mate, the other day I mentioned my daughters comments about random stuff popping up........I have finally caught up with her and have seen her problem.......when she is on msn she gets this web addy popping up in her chat box
    check :P hxxp://www.amazingsexy.net/photo24.com
    this is exactly how it presents
    check :P hxxp://www.amazingsexy.net/photo24.com
    in fact the one above this line of text has just appeared on it's own.

    Also when viewing web pages generally the page suddenly scrolls all the way to the bottom of the page.....

    an
    ycheck :P hxxp://www.amazingsexy.net/photo24.com
    ideas

    I just looked up and there it is again....popped up as I was typing....any ideas.

    Regards

    Andy
    Last edited by Blade81; 2007-07-08 at 00:15. Reason: Disabled links
  6. 2007-07-08, 00:31 #26
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Sounds like MSN virus to me. When that comment appears on chat window is it said in your MSN client or in other side (it's possible that other side has also got infection)? Could you post a fresh hjt log (hopefully there was some sign of it)? Just in case rename HijackThis.exe -> anything.exe before getting a new hjt log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  7. 2007-07-08, 00:36 #27
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Hi again mate, I have done the new HJT scan, here is the report.

    Logfile of HijackThis v1.99.1
    Scan saved at 23:34:42, on 07/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\QuickTime\qttask.exe
    D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe
    D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    C:\WINDOWS\system32\gsicon.exe
    C:\Program Files\VoyagerTest\fts.exe
    D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\ctfmon.exe
    D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe
    C:\Program Files\AOL 9.0\waol.exe
    D:\Road Angel\Active Sync\wcescomm.exe
    D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Program Files\AOL 9.0\aoltray.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    D:\Utility Programs\Palm\HOTSYNC.EXE
    D:\ROADAN~1\ACTIVE~1\rapimgr.exe
    C:\Program Files\AOL 9.0\shellmon.exe
    C:\Program Files\Common Files\AOL\aoltpspd.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Documents and Settings\Andy\Desktop\HJT\Anything.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\utility programs\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
    O2 - BHO: (no name) - {1682558E-8A98-40B5-A819-66DCE82788E0} - C:\WINDOWS\system32\mljgd.dll
    O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\nmgigwdg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7} - C:\WINDOWS\system32\nnnoppq.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\Utility Programs\ReGetDx\iebar.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTSysVol] D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [CTDVDDET] D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
    O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [cctray] "D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe"
    O4 - HKLM\..\Run: [CAVRID] "D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [cafwc] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    O4 - HKLM\..\Run: [capfasem] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    O4 - HKLM\..\Run: [capfupgrade] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\yyesvskq.dll",forkonce
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RemoteCenter] D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [PcSync] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Road Angel\Active Sync\wcescomm.exe"
    O4 - Startup: HotSync Manager.lnk = D:\Utility Programs\Palm\HOTSYNC.EXE
    O4 - Global Startup: Acrobat Assistant.lnk = D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
    O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.co...s/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1158250651359
    O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab55762.cab
    O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab
    O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file:///M:/SuperCD/IntraLaunch.CAB
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/W...gPublisher.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab55579.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8E40CB52-ED91-4443-8F60-C88AC0799F8A}: NameServer = 205.188.146.145
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: mljgd - C:\WINDOWS\system32\mljgd.dll
    O20 - Winlogon Notify: nnnoppq - C:\WINDOWS\SYSTEM32\nnnoppq.dll
    O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: CaCCProvSP - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PPCtlPriv - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  8. 2007-07-08, 12:41 #28
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Download MsnCleaner_eng.zip and extract it to your desktop, but don't use it yet.
    • Now reboot into Safe Mode
    • Double-click MsnCleaner_eng.exe to run it.
    • Click the Analyze button.
    • A report will be created once after you finish scan.
    • If it finds an infection, click the Deleted button.
    • Now, please reboot back to normal mode.



    It seems that Vundo has also come back. Run ComboFix (combofix.exe in case you had deleted it) and post its log with a fresh hjt log and the contents of C:\MsnCleaner.txt file.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  9. 2007-07-09, 12:44 #29
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Hi again mate, this is proving to be a stubborn little devil isn't it. A quick question, is vundo normally this hard to kill off?

    Here are the log files as requested. The MsnCleaner run gave me a simple report of <<<<<<< no files found >>>>>>>

    "Andy" - 2007-07-04 19:12:29 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


    ((((((((((((((((((((((((( Files Created from 2007-06-04 to 2007-07-04 )))))))))))))))))))))))))))))))


    2007-07-04 18:45 66,112 --a------ C:\WINDOWS\system32\fjbiqmuf.dll
    2007-07-04 16:50 128,576 --a------ C:\WINDOWS\system32\ndavqoro.dll
    2007-07-03 19:15 <DIR> d-------- C:\DOCUME~1\Andy\APPLIC~1\Viewpoint
    2007-07-03 16:48 66,112 --a------ C:\WINDOWS\system32\shoinfjd.dll
    2007-07-02 23:04 189,440 --a------ C:\DOCUME~1\Andy\fset.exe
    2007-07-02 20:56 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-07-02 20:32 <DIR> d-------- C:\WINDOWS\pss
    2007-06-30 22:08 49,152 --a------ C:\WINDOWS\nircmd.exe
    2007-06-30 13:05 <DIR> dr-h----- C:\DOCUME~1\Andy\APPLIC~1\SecuROM
    2007-06-29 06:49 <DIR> d-------- C:\Program Files\Viewpoint
    2007-06-23 23:50 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
    2007-06-23 23:35 <DIR> d-------- C:\WINDOWS\.jagex_cache_34
    2007-06-21 19:14 630,432 --a------ C:\WINDOWS\system32\drivers\vetefile.sys
    2007-06-21 19:14 108,624 --a------ C:\WINDOWS\system32\drivers\veteboot.sys
    2007-06-08 20:04 106,465 --a------ C:\WINDOWS\fd.exe


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-07-04 17:58:54 384 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-00000002-00001102-00000004-20021102}.dat
    2007-07-04 17:58:54 384 ----a-w C:\WINDOWS\system32\DVCState-{00000003-00000000-00000002-00001102-00000004-20021102}.dat
    2007-07-04 16:44:03 42 ----a-w C:\WINDOWS\popcinfo.dat
    2007-07-01 15:17:04 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-06-25 11:34:25 -------- d-----w C:\Program Files\MSN Messenger
    2007-06-19 12:30:59 -------- d-----w C:\Program Files\Common Files\AOL
    2007-06-18 15:16:47 -------- d-----w C:\Program Files\Common Files\uzfq
    2007-06-16 09:56:59 684 ----a-w C:\WINDOWS\eReg.dat
    2007-05-31 12:47:06 114,448 ----a-w C:\WINDOWS\system32\drivers\KmxFw.sys
    2007-05-31 12:47:04 92,432 ----a-w C:\WINDOWS\system32\drivers\KmxStart.sys
    2007-05-31 12:47:04 256,784 ----a-w C:\WINDOWS\system32\UmxSbxw.dll
    2007-05-31 12:47:04 126,224 ----a-w C:\WINDOWS\system32\drivers\KmxCF.sys
    2007-05-31 12:47:02 117,520 ----a-w C:\WINDOWS\system32\UmxSbxExw.dll
    2007-05-30 21:53:48 -------- d-----w C:\DOCUME~1\Andy\APPLIC~1\Nokia Multimedia Player
    2007-05-29 19:27:04 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-05-28 20:09:05 -------- d-----w C:\Program Files\Common Files\Scanner
    2007-05-19 08:37:35 -------- d-----w C:\DOCUME~1\Andy\APPLIC~1\ITEDO
    2007-05-19 08:37:02 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-05-19 08:37:02 -------- d-----w C:\Program Files\InstallActiveX
    2007-05-18 13:30:00 89,096 ----a-w C:\WINDOWS\system32\drivers\KmxCfg.sys
    2007-05-18 13:30:00 79,368 ----a-w C:\WINDOWS\system32\UmxWNP.dll
    2007-05-18 13:30:00 63,496 ----a-w C:\WINDOWS\system32\drivers\KmxSbx.sys
    2007-05-18 13:30:00 61,960 ----a-w C:\WINDOWS\system32\drivers\KmxAgent.sys
    2007-05-18 13:30:00 45,064 ----a-w C:\WINDOWS\system32\drivers\KmxFile.sys
    2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-05-03 16:16:35 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
    2007-05-03 16:16:35 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
    2007-05-03 16:16:35 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
    2007-05-03 06:43:22 111,067 ----a-w C:\WINDOWS\w0.exe
    2007-05-02 20:46:30 99,904 ----a-w C:\WINDOWS\system32\isafeif.dll
    2007-05-02 20:46:30 79,424 ----a-w C:\WINDOWS\system32\vetredir.dll
    2007-05-02 20:46:30 75,280 ----a-w C:\WINDOWS\system32\isafprod.dll
    2007-04-29 13:23:12 4,096 ----a-w C:\WINDOWS\d3dx.dat
    2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
    2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
    2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-04-16 21:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-04-16 21:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=d:\utility programs\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 13:02]
    {16664845-0E00-11D2-8059-000000000000}=C:\Program Files\Common Files\ReGet Shared\Catcher.dll [2004-04-08 14:48]
    {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}=C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 13:50]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTHelper"="CTHELPER.EXE" [2003-06-20 04:55 C:\WINDOWS\system32\CTHELPER.EXE]
    "AsioReg"="REGSVR32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\regsvr32.exe]
    "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06]
    "PtiuPbmd"="ptipbm.dll" [2003-01-15 12:41 C:\WINDOWS\system32\ptipbm.dll]
    "Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 15:50]
    "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 16:24]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-19 11:04]
    "nwiz"="nwiz.exe" [2003-09-24 12:32 C:\WINDOWS\system32\nwiz.exe]
    "CTSysVol"="D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe" [2003-07-02 10:03]
    "CTDVDDET"="D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE" [2003-06-18 01:00]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-09 23:12]
    "SunJavaUpdateSched"="D:\Utility Programs\Java\bin\jusched.exe" [2005-08-26 18:14]
    "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2005-04-08 14:09]
    "GSICONEXE"="gsicon.exe" [2003-05-14 21:26 C:\WINDOWS\system32\gsicon.exe]
    "%FP%Friendly fts.exe"="C:\Program Files\VoyagerTest\fts.exe" [2003-05-06 10:28]
    "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2007-01-10 12:06]
    "cctray"="D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-06-07 08:58]
    "CAVRID"="D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-02 21:46]
    "HostManager"="C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe" [2006-11-17 14:21]
    "PCSuiteTrayApplication"="D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 12:59]
    "DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 12:14]
    "cafwc"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2007-06-01 14:14]
    "capfasem"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2007-06-01 14:14]
    "capfupgrade"="D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2007-06-01 14:07]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
    "RemoteCenter"="D:\Utility Programs\Creative\RemoteControl\RCMan.EXE" [2003-06-12 09:47]
    "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
    "PcSync"="D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 12:29]
    "H/PC Connection Agent"="D:\Road Angel\Active Sync\wcescomm.exe" [2006-06-26 16:13]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Protection\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 13:29]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
    UmxWnp.Dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]


    Contents of the 'Scheduled Tasks' folder
    2007-06-27 17:09:07 C:\WINDOWS\tasks\CAAntiSpywareScan_Daily as Andy at 10 17.job
    2007-07-04 18:01:08 C:\WINDOWS\tasks\RegCure Program Check.job
    2007-02-20 17:52:54 C:\WINDOWS\tasks\RegCure.job
    2006-06-19 18:33:54 C:\WINDOWS\tasks\XoftSpy.job

    **************************************************************************

    catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-04 19:15:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-07-04 19:16:51
    C:\ComboFix-quarantined-files.txt ... 2007-07-04 19:16
    C:\ComboFix2.txt ... 2007-06-30 22:16

    --- E O F ---
  10. 2007-07-09, 12:46 #30
    andye
    andye is offline
    Member
    Join Date
    Jun 2007
    Posts
    56

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 11:39:47, on 09/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\wuauclt.exe
    D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe
    D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    C:\WINDOWS\system32\gsicon.exe
    C:\Program Files\VoyagerTest\fts.exe
    D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe
    D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe
    D:\Road Angel\Active Sync\wcescomm.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Program Files\AOL 9.0\aoltray.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    D:\Utility Programs\Palm\HOTSYNC.EXE
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    D:\ROADAN~1\ACTIVE~1\rapimgr.exe
    C:\Program Files\AOL 9.0\waol.exe
    C:\Program Files\AOL 9.0\shellmon.exe
    C:\Program Files\Common Files\AOL\aoltpspd.exe
    C:\Documents and Settings\Andy\Desktop\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\utility programs\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\Utility Programs\ReGetDx\iebar.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTSysVol] D:\Hardware Support\Creative\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [CTDVDDET] D:\Hardware Support\Creative\DVDAudio\CTDVDDET.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
    O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
    O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [cctray] "D:\Protection\CA\CA Internet Security Suite\cctray\cctray.exe"
    O4 - HKLM\..\Run: [CAVRID] "D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1171398026\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\Launch Application 2.exe -onlytray
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [cafwc] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    O4 - HKLM\..\Run: [capfasem] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    O4 - HKLM\..\Run: [capfupgrade] D:\Protection\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RemoteCenter] D:\Utility Programs\Creative\RemoteControl\RCMan.EXE
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [PcSync] D:\Utility Programs\Nokia\PC Suite\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Road Angel\Active Sync\wcescomm.exe"
    O4 - Startup: HotSync Manager.lnk = D:\Utility Programs\Palm\HOTSYNC.EXE
    O4 - Global Startup: Acrobat Assistant.lnk = D:\Utility Programs\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Utility Programs\WinDVD4\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
    O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\ROADAN~1\ACTIVE~1\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~1\MSOFFI~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.co...s/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1158250651359
    O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/sel...g/ESTPTest.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab55762.cab
    O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.co...p/DigWXMSN.cab
    O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file:///M:/SuperCD/IntraLaunch.CAB
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/W...gPublisher.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab55579.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8E40CB52-ED91-4443-8F60-C88AC0799F8A}: NameServer = 205.188.146.145
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Protection\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: CaCCProvSP - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\ccprovsp.exe
    O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PPCtlPriv - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
    O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - D:\Protection\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules