View Full Version : Pls Help !!!
angel84cecil
2007-05-22, 05:36
Logfile of HijackThis v1.99.1
Scan saved at 11:33:27 AM, on 22/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iuqcqwosrvc.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: e1.dll
O20 - Winlogon Notify: appmgr - appmgr32.dll (file missing)
O20 - Winlogon Notify: atmmgr - atmmgr32.dll (file missing)
O20 - Winlogon Notify: clicsaml - C:\WINDOWS\system32\clicsaml.dll (file missing)
O20 - Winlogon Notify: sfcfdmsc - C:\WINDOWS\system32\sfcfdmsc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wmadmsst - C:\WINDOWS\system32\wmadmsst.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Hi and welcome to the Board
I'm Blade and I am going to try to help you with your problem. Please take a note of five things.
I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451)
When Should I Format, How Should I Reinstall (http://www.dslreports.com/faq/10063)
However, if you do not have the resources to reinstall your computer and would like me to attempt to clean it, I will be happy to do so.
Should you have any questions, please feel free to ask.
Please let us know what you have decided to do in your next post.
angel84cecil
2007-05-23, 02:03
Dear Brad,
Thanks for the reply first of all. I would just like to clean it. Do Help.
Thanks, Cecilia.
angel84cecil
2007-05-23, 02:09
:oops: BLADE i meant...
Dear Brad,
Thanks for the reply first of all. I would just like to clean it. Do Help.
Thanks, Cecilia.
Okay, let's start. :)
Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Upload this file to Virustotal (http://www.virustotal.com) and post the results:
c:\windows\system32\iuqcqwosrvc.dll
1. Download this file -
combofix.exe (http://download.bleepingcomputer.com/sUBs/combofix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your
next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause
it to stall
Generate startuplist log
-----------------------
*Open HijackThis.
*Click on "Open Misc Tools Section"
*Make sure that both boxes beside "Generate StartupList Log" are checked:
List all minor sections(Full)
and
List Empty Sections(Complete)
Click "Generate StartupList Log".
Click "Yes" at the prompt.
It will produce a log in Notepad. I need you to copy the entire contents of that Notepad and paste it here.
Post:
-a fresh hjt log
-combofix log
-startuplist log and
-Virustotal results concerning of c:\windows\system32\iuqcqwosrvc.dll file.
angel84cecil
2007-05-24, 02:18
STATUS: SCANNINGFile "iuqcqwosrvc.dll" received on 05.24.2007 at 02:11:31 (CET) is being scanned by VirusTotal in this moment. Results will be shown as they're generated.
Antivirus Version Update Result
AhnLab-V3 2007.5.24.0 05.23.2007 Win-Trojan/Xema.21504.C
AntiVir 7.4.0.27 05.23.2007 TR/Vqten.A.2
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.22.2007 Win32:Agent-GPJ
AVG 7.5.0.467 05.23.2007 Generic3.VAZ
BitDefender 7.2 05.24.2007 Trojan.Vqten.A
CAT-QuickHeal 9.00 05.23.2007 Trojan.Agent.afg
ClamAV devel-20070416 05.23.2007 no virus found
DrWeb 4.33 05.23.2007 Trojan.Vqten
eSafe 7.0.15.0 05.21.2007 Win32.Agent.afg
eTrust-Vet 30.7.3658 05.24.2007 Win32/Netvq!generic
Ewido 4.0 05.23.2007 Trojan.Vqten
FileAdvisor 1 05.24.2007 no virus found
Fortinet 2.85.0.0 05.23.2007 W32/Agent.AFG!tr
F-Prot 4.3.2.48 05.23.2007 no virus found
Aditional Information
File size: 21504 bytes
MD5: 9d6736be110d48223d606988a3fed3a9
SHA1: e03cace136d6423c27c722cafff495546283eec1
VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
angel84cecil
2007-05-24, 03:47
"Cecilia" - 2007-05-24 8:18:56 Service Pack 2
ComboFix 07-05.21.6.V - Running from: "C:\"
Rootkit driver pe386 is present. A rootkit scan is required
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\wpcjmd.log
C:\WINDOWS\system32\nvstatld.dll
C:\WINDOWS\system32\iuqcqwosrvc.dll
C:\WINDOWS\system32\sgl.dll
C:\cp1469.nls
Infected copy of C:\WINDOWS\system32\drivers\ndis.sys was found & disinfected
Restored copy from - "c:\I386\NDIS.SY_"
((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_NTLDR.SYS
-------\ntldr.sys
((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-24 ))))))))))))))))))))))))))))))))))
2007-05-24 08:13 1,092,328 --a------ C:\ComboFix.exe
2007-05-22 11:32 218,112 --a------ C:\HijackThis.exe
2007-05-22 08:14 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2007-05-11 16:13 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-11 14:57 53,248 --ah----- C:\WINDOWS\system32\confnss.dll
2007-05-11 14:57 45,056 --ah----- C:\WINDOWS\system32\nssprf32.dll
2007-05-11 14:57 40,960 --ah----- C:\WINDOWS\system32\nssperf.exe
2007-04-25 16:10 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-04-25 14:10 1,413,120 --a------ C:\WinsockFix.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-05-15 06:54:31 -------- d-----w C:\DOCUME~1\Cecilia\APPLIC~1\Skype
2007-05-11 07:45:15 4 ----a-w C:\WINDOWS\system32\sfcfdmsc.dat
2007-04-26 03:31:04 -------- d-----w C:\Program Files\PC Tools AntiVirus
2007-04-25 08:10:32 -------- d-----w C:\Program Files\Skype
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 01:20:45 74,752 ----a-w C:\WINDOWS\in32.exe
2007-04-16 08:33:19 0 ----a-w C:\WINDOWS\cdi1okj.dll
2007-04-11 00:59:12 0 ----a-w C:\WINDOWS\tcsrahrk2.reg
2007-04-03 04:10:18 -------- d-----w C:\Program Files\AgentRansack
2007-03-29 05:07:04 0 ----a-w C:\WINDOWS\x0h7bh.reg
2007-03-22 05:29:00 110,592 ----a-w C:\WINDOWS\system32\3T387.dll
2007-03-21 09:39:50 114,688 ----a-w C:\WINDOWS\system32\IoCNAW2v.dll
2007-03-21 07:29:06 114,688 ----a-w C:\WINDOWS\system32\i2VKVg.dll
2007-03-21 07:08:52 0 ----a-w C:\WINDOWS\r81j7l4g.pif
2007-03-21 07:00:35 0 ----a-w C:\WINDOWS\9ergx.dat
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-14 07:26:24 -------- d-----w C:\Program Files\Charm Tale
2007-03-14 07:24:48 -------- d-----w C:\Program Files\ReflexiveArcade
2007-03-14 06:41:59 -------- d-----w C:\DOCUME~1\Cecilia\APPLIC~1\AdobeUM
2007-03-14 05:58:01 0 ----a-w C:\WINDOWS\adc.dat
2007-03-12 11:04:19 -------- d-----w C:\Program Files\DesignPro
2007-03-12 11:02:18 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
2007-03-06 08:18:11 -------- d-----w C:\Program Files\MSN Messenger
2007-03-06 06:26:01 -------- d-----w C:\Program Files\Windows Defender
2007-03-06 02:08:52 -------- d-----w C:\DOCUME~1\Cecilia\APPLIC~1\Reallusion
2007-02-27 07:36:31 0 ----a-w C:\WINDOWS\odfvf.dat
2007-02-14 06:22:33 16 ----a-w C:\WINDOWS\sqhos32.dat
2007-02-05 20:17:02 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2005-05-27 10:01 C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" []
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-14 05:34 C:\WINDOWS\system32\ico.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-13 20:20]
"LorraineSpy"="C:\WINDOWS\LorraineSpyingOnCecilia.vbs" [2006-11-02 17:55]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-21 21:07]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" []
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{C7F76815-E647-4BCE-B21A-600CE626E5D8}"="C:\WINDOWS\system32\nvstatld.dll" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\appmgr]
appmgr32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmmgr]
atmmgr32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\clicsaml]
C:\WINDOWS\system32\clicsaml.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sfcfdmsc]
C:\WINDOWS\system32\sfcfdmsc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wmadmsst]
C:\WINDOWS\system32\wmadmsst.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=e1.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages scecli pwdmon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\appdiag]
Contents of the 'Scheduled Tasks' folder
2007-05-24 00:01:24 C:\WINDOWS\tasks\MP Scheduled Scan.job
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-24 08:32:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
********************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pe386]
"ImagePath"="\??\C:\WINDOWS\system32:lzx32.sys"
Completion time: 2007-05-24 8:35:28 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-24 08:35
--- E O F ---
angel84cecil
2007-05-24, 03:57
My connection deleted after running combofix. why it happen?
I'm truly sorry. :oops: I should have instructed you to use lspfix first.
You'll need a computer with internet connection to download Lspfix (http://www.cexx.org/lspfix.zip). Save the file to diskette or memory stick and copy it then to infected computer. Extract(unzip) file to its own folder. Disconnect from the internet, and close all browser windows. Run LSPFix. Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of iuqcqwosrvc.dll (and nothing else), move them to the "Remove" pane and by clicking the >> button. Click Finish. Reboot to complete the process.
After that we can start cleaning process.
1. Download - rustbfix.exe (http://www.uploads.ejvindh.net/rustbfix.exe) ...and save it to your desktop.
2. Double click on rustbfix.exe to run the tool.
1. If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically.
2. After the reboot 2 logfiles will open (%root%\avenger.txt & %root%\rustbfix\pelog.txt). If needed (still infected), post the content of these logfiles along with a new HijackThis log.
angel84cecil
2007-05-25, 05:23
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tuiaqwvh
*******************
Script file located at: \??\C:\WINDOWS\rygvpbwb.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.
Completed script processing.
*******************
Finished! Terminate.//////////////////////////////////////////
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tuiaqwvh
*******************
Script file located at: \??\C:\WINDOWS\rygvpbwb.txt
Script file not found! Error
Could not open script file! Status: 0xc0000034 Abort!
//////////////////////////////////////////
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tuiaqwvh
*******************
Script file located at: \??\C:\WINDOWS\rygvpbwb.txt
Script file not found! Error
Could not open script file! Status: 0xc0000034 Abort!
//////////////////////////////////////////
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tuiaqwvh
*******************
Script file located at: \??\C:\WINDOWS\rygvpbwb.txt
Script file not found! Error
Could not open script file! Status: 0xc0000034 Abort!
//////////////////////////////////////////
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tuiaqwvh
*******************
Script file located at: \??\C:\WINDOWS\rygvpbwb.txt
Script file not found! Error
Could not open script file! Status: 0xc0000034 Abort!
angel84cecil
2007-05-25, 05:32
************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
25/05/2007 11:29:05.81
No Rustock.b-rootkits found
******************************* End of Logfile ********************************
angel84cecil
2007-05-25, 05:38
Logfile of HijackThis v1.99.1
Scan saved at 11:37:00 AM, on 25/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\jbiqcwkxunjhb.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: e1.dll
O20 - Winlogon Notify: appmgr - appmgr32.dll (file missing)
O20 - Winlogon Notify: atmmgr - atmmgr32.dll (file missing)
O20 - Winlogon Notify: clicsaml - C:\WINDOWS\system32\clicsaml.dll (file missing)
O20 - Winlogon Notify: sfcfdmsc - C:\WINDOWS\system32\sfcfdmsc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wmadmsst - C:\WINDOWS\system32\wmadmsst.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Okay, let's continue cleaning. I recommend printing/saving following instructions 'cos these are quite long.
Scan following file at Virustotal (http://www.virustotal.com) and post the results:
C:\WINDOWS\in32.exe
Disable Windows Defender's realtime protection.
Open Windows Defender
Click on
Tools
Click on
General Settings
Scroll down to
Real-time protection options
Uncheck
Turn on Real-time protection (recommended)
Click
Save
Exit the program.
Start hjt, click do a system scan only, check:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Close browsers and other windows. Click fix checked.
Download ERUNT (http://www.softpedia.com/get/Tweak/Registry-Tweak/Erunt-g.shtml)
Save it to your desktop. Run and install this program.
In the box that opens ONLY choose
System registry.
Then click OK.
Click save and then go to File > Exit.
This is so the registry can be restored to this point if we need it. It may take a minute. Just let it go until it's done.
Save text below as fix.reg on Notepad (save it as all files (*.*)) on the Desktop.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{C7F76815-E647-4BCE-B21A-600CE626E5D8}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\appmgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\atmmgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\clicsaml]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sfcfdmsc]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wmadmsst]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\appdiag]
It should look like this -> http://users.telenet.be/bluepatchy/miekiemoes/images/reg.gif
Doubleclick fix.reg, press Yes and ok.
(In case you are unsure how to create a reg file, take a look here (http://www.nellie2.co.uk/file.htm#How_to_Make_a_.Reg_File_) with screenshots.)
Please download the Killbox (http://www.downloads.subratam.org/KillBox.zip) © Option^Explicit.
Unzip it to the desktop but do NOT run it yet.
Copy the text to a Notepad file and save it to your desktop! We will need the file later.
Run LSPFix (download it here (http://www.cexx.org/lspfix.zip) again if needed). Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of iuqcqwosrvc.dll (and nothing else), move them to the "Remove" pane and by clicking the >> button. Click Finish.
Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.
Once in Safe Mode, please run Killbox.
Select "Delete on Reboot".
Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\system32\confnss.dll
C:\WINDOWS\system32\nssprf32.dll
C:\WINDOWS\system32\nssperf.exe
C:\WINDOWS\cdi1okj.dll
C:\WINDOWS\tcsrahrk2.reg
C:\WINDOWS\x0h7bh.reg
C:\WINDOWS\system32\3T387.dll
C:\WINDOWS\system32\IoCNAW2v.dll
C:\WINDOWS\system32\i2VKVg.dll
C:\WINDOWS\r81j7l4g.pif
C:\WINDOWS\9ergx.dat
C:\WINDOWS\odfvf.dat
C:\WINDOWS\sqhos32.dat
C:\WINDOWS\adc.dat
C:\WINDOWS\system32\sfcfdmsc.dat
c:\windows\system32\jbiqcwkxunjhb.dll
C:\WINDOWS\system32\e1.dll
C:\WINDOWS\system32\appmgr32.dll
C:\WINDOWS\system32\atmmgr32.dll
C:\WINDOWS\system32\clicsaml.dll
C:\WINDOWS\system32\sfcfdmsc.dll
C:\WINDOWS\system32\wmadmsst.dll
Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here (http://www.eudaemonia.me.uk/downloads/Files/missingfilesetup.exe) to download and run missingfilesetup.exe. Then try TheKillbox again..
Run combofix again and post its log. Post also a fresh hjt log and results from Virustotal concerning C:\WINDOWS\in32.exe file
angel84cecil
2007-05-26, 16:47
Thank i'll be able to run it on Monday... i will post it asap... thanks for the guidance.... :bigthumb:
Okay, thanks for letting us know :)
angel84cecil
2007-05-28, 03:32
STATUS: FINISHEDComplete scanning result of "in32.exe", received in VirusTotal at 05.28.2007, 03:22:28 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.24.0 05.25.2007 no virus found
AntiVir 7.4.0.27 05.27.2007 no virus found
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.27.2007 no virus found
AVG 7.5.0.467 05.27.2007 no virus found
BitDefender 7.2 05.28.2007 no virus found
CAT-QuickHeal 9.00 05.26.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.28.2007 no virus found
DrWeb 4.33 05.27.2007 no virus found
eSafe 7.0.15.0 05.27.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3665 05.26.2007 no virus found
Ewido 4.0 05.27.2007 no virus found
FileAdvisor 1 05.28.2007 no virus found
Fortinet 2.85.0.0 05.28.2007 suspicious
F-Prot 4.3.2.48 05.25.2007 no virus found
F-Secure 6.70.13030.0 05.28.2007 no virus found
Ikarus T3.1.1.8 05.27.2007 no virus found
Kaspersky 4.0.2.24 05.28.2007 no virus found
McAfee 5039 05.25.2007 no virus found
Microsoft 1.2503 05.28.2007 no virus found
NOD32v2 2293 05.27.2007 no virus found
Norman 5.80.02 05.25.2007 no virus found
Panda 9.0.0.4 05.27.2007 Suspicious file
Prevx1 V2 05.28.2007 no virus found
Sophos 4.18.0 05.25.2007 no virus found
Sunbelt 2.2.907.0 05.26.2007 no virus found
Symantec 10 05.28.2007 Backdoor.Rustock.B
TheHacker 6.1.6.123 05.25.2007 no virus found
VBA32 3.12.0 05.26.2007 no virus found
VirusBuster 4.3.23:9 05.27.2007 no virus found
Webwasher-Gateway 6.0.1 05.27.2007 Win32.Malware.gen!84 (suspicious)
Aditional Information
File size: 74752 bytes
MD5: 090812ff94855c14d741f31c4bead5af
SHA1: 926a97909ad79227574ff429992012d38d734b69
VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
Hi
Could you post also a fresh Combofix log and hjt log, please? :)
angel84cecil
2007-05-28, 06:45
Can I run Killbox in Normal Mode instead of Safe Mode?
If you can't run it in safe mode then you can try to run it in normal mode. But if possible run in safe mode.
angel84cecil
2007-05-28, 09:10
hi,
I got problem where i cannot surf the internet after running killbox...do help?:sad:i restore my computer again....
Kindly explain:
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
angel84cecil
2007-05-28, 09:22
STATUS: FINISHEDComplete scanning result of "in32.exe", received in VirusTotal at 05.28.2007, 09:11:36 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.24.0 05.28.2007 no virus found
AntiVir 7.4.0.27 05.27.2007 no virus found
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.27.2007 no virus found
AVG 7.5.0.467 05.27.2007 no virus found
BitDefender 7.2 05.28.2007 no virus found
CAT-QuickHeal 9.00 05.26.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.28.2007 no virus found
DrWeb 4.33 05.28.2007 no virus found
eSafe 7.0.15.0 05.27.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3670 05.28.2007 no virus found
Ewido 4.0 05.27.2007 no virus found
FileAdvisor 1 05.28.2007 no virus found
Fortinet 2.85.0.0 05.28.2007 suspicious
F-Prot 4.3.2.48 05.25.2007 no virus found
F-Secure 6.70.13030.0 05.28.2007 no virus found
Ikarus T3.1.1.8 05.28.2007 no virus found
Kaspersky 4.0.2.24 05.28.2007 no virus found
McAfee 5039 05.25.2007 no virus found
Microsoft 1.2503 05.28.2007 no virus found
NOD32v2 2293 05.27.2007 no virus found
Norman 5.80.02 05.25.2007 no virus found
Panda 9.0.0.4 05.27.2007 Suspicious file
Prevx1 V2 05.28.2007 no virus found
Sophos 4.18.0 05.25.2007 no virus found
Sunbelt 2.2.907.0 05.26.2007 no virus found
Symantec 10 05.28.2007 Backdoor.Rustock.B
TheHacker 6.1.6.123 05.25.2007 no virus found
VBA32 3.12.0 05.26.2007 no virus found
VirusBuster 4.3.23:9 05.27.2007 no virus found
Webwasher-Gateway 6.0.1 05.28.2007 Win32.Malware.gen!84 (suspicious)
angel84cecil
2007-05-28, 09:43
Hi Blade,
I redo the whole steps again...now i stuck at killbox method....
I got problem where i cannot surf the internet after running killbox...do help?
Hi
Did you run LSPFix before Killbox as instructed? Killbox removes this file c:\windows\system32\jbiqcwkxunjhb.dll and if lspfix hasn't been run before it then loss of internet connection may be followed. So, if you lose internet connection after killbox then you need to run LSPFix (download it here (http://www.cexx.org/lspfix.zip) if needed). Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of iuqcqwosrvc.dll (and nothing else), move them to the "Remove" pane and by clicking the >> button. Click Finish.
angel84cecil
2007-05-28, 12:07
LSP-FIX shown at Keep Panel:
mswsock.dll
winrnr.dll
nwprovau.dll
jbiqcwkxunjhb.dll
rsvpsp.dll
Don't have "iuqcqwosrvc.dll "... i think because in previous post you have ask mi to remove it....
:oops: I meant this jbiqcwkxunjhb.dll. Please post those fresh Combofix log and hjt log after you're ready. :)
angel84cecil
2007-05-29, 02:54
hI bLADE,
1. Killbox: Do i "Delete File" on a Single File or All File?
2. ComboFix: Again my internet icon lost after running it.
angel84cecil
2007-05-29, 07:33
I am gonna redo the steps again...I'll stop until KillBox....(pls guide mi thru from KillBox)
STATUS: FINISHEDComplete scanning result of "in32.exe", received in VirusTotal at 05.29.2007, 07:25:47 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.29.0 05.28.2007 no virus found
AntiVir 7.4.0.27 05.28.2007 no virus found
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.28.2007 no virus found
AVG 7.5.0.467 05.28.2007 no virus found
BitDefender 7.2 05.29.2007 no virus found
CAT-QuickHeal 9.00 05.28.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.29.2007 no virus found
DrWeb 4.33 05.28.2007 no virus found
eSafe 7.0.15.0 05.28.2007 Win32.Rustock.B
eTrust-Vet 30.7.3670 05.28.2007 no virus found
Ewido 4.0 05.28.2007 no virus found
FileAdvisor 1 05.29.2007 no virus found
Fortinet 2.85.0.0 05.29.2007 suspicious
F-Prot 4.3.2.48 05.25.2007 no virus found
F-Secure 6.70.13030.0 05.29.2007 no virus found
Ikarus T3.1.1.8 05.29.2007 no virus found
Kaspersky 4.0.2.24 05.29.2007 no virus found
McAfee 5040 05.28.2007 no virus found
Microsoft 1.2503 05.29.2007 no virus found
NOD32v2 2294 05.28.2007 no virus found
Norman 5.80.02 05.28.2007 no virus found
Panda 9.0.0.4 05.28.2007 Suspicious file
Prevx1 V2 05.29.2007 no virus found
Sophos 4.18.0 05.28.2007 no virus found
Sunbelt 2.2.907.0 05.26.2007 no virus found
Symantec 10 05.29.2007 Backdoor.Rustock.B
TheHacker 6.1.6.124 05.28.2007 no virus found
VBA32 3.12.0 05.28.2007 no virus found
VirusBuster 4.3.23:9 05.28.2007 no virus found
Webwasher-Gateway 6.0.1 05.29.2007 Win32.Malware.gen!84 (suspicious)
1. Killbox: Do i "Delete File" on a Single File or All File?
Choose all files.
2. ComboFix: Again my internet icon lost after running it.
If you lose Internet connection run LSPFix. Then Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of iuqcqwosrvc.dll look-alikes and nothing else (it isn't necessarily exactly same name but is almost same length and is randomly named.), move them to the "Remove" pane and by clicking the >> button. Click Finish.
PS. You don't need to do that upload to Virustotal anymore since you've already done it. :)
angel84cecil
2007-05-29, 10:29
"Cecilia" - 2007-05-29 15:30:44 Service Pack 2
ComboFix 07-05.27.V - Running from: "C:\Documents and Settings\Cecilia\Desktop\"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
"C:\WINDOWS\system32\nvstatld.dll"
"C:\WINDOWS\system32\iuqcqwosrvc.dll"
"C:\WINDOWS\system32\praosyavj.dll"
"C:\WINDOWS\system32\sgl.dll"
"C:\cp2282.nls"
Infected copy of C:\WINDOWS\system32\drivers\ndis.sys was found & disinfected
Restored copy from - "c:\I386\NDIS.SY_"
((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_NTLDR.SYS
((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-29 ))))))))))))))))))))))))))))))))))
2007-05-28 14:42 <DIR> d-------- C:\!KillBox
2007-05-28 10:10 <DIR> d-------- C:\WINDOWS\ERDNT(2)
2007-05-25 11:35 <DIR> d-------- C:\HijackThis
2007-05-22 08:14 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2007-05-11 16:13 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-05-15 06:54:31 -------- d-----w C:\DOCUME~1\Cecilia\APPLIC~1\Skype
2007-04-26 03:31:04 -------- d-----w C:\Program Files\PC Tools AntiVirus
2007-04-25 08:10:32 -------- d-----w C:\Program Files\Skype
2007-04-25 08:10:32 -------- d-----w C:\Program Files\Common Files\Skype
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 01:20:45 74,752 ----a-w C:\WINDOWS\in32.exe
2007-04-03 04:10:18 -------- d-----w C:\Program Files\AgentRansack
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
2004-08-04 12:00:00 88,868 --sh--r C:\WINDOWS\system32\cmdctunj.exe
2004-08-04 12:00:00 88,868 --sh--r C:\WINDOWS\system32\autodmwl.exe
2004-08-04 12:00:00 88,431 --sh--r C:\WINDOWS\system32\dllqepfe.exe
2004-08-04 12:00:00 88,281 --sh--r C:\WINDOWS\system32\regegygj.exe
2004-08-04 12:00:00 88,281 --sh--r C:\WINDOWS\system32\fxsxyfhp.exe
2004-08-04 12:00:00 88,281 --sh--r C:\WINDOWS\system32\clitbdeu.exe
2004-08-04 12:00:00 75,302 --sh--r C:\WINDOWS\system32\wsmmlog.exe
2004-08-04 12:00:00 72,957 --sh--r C:\WINDOWS\system32\smcntlwio.exe
2004-08-04 12:00:00 72,844 --sh--r C:\WINDOWS\system32\plsitctl.exe
2004-08-04 12:00:00 71,420 --sh--r C:\WINDOWS\system32\sdservss.exe
2004-08-04 12:00:00 71,004 --sh--r C:\WINDOWS\system32\osskhbd.exe
2004-08-04 12:00:00 44,804 --sh--r C:\WINDOWS\system32\netbikfo.exe
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2005-05-27 10:01 C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" []
"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-14 05:34 C:\WINDOWS\system32\ico.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-13 20:20]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-21 21:07]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" []
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages scecli pwdmon
Contents of the 'Scheduled Tasks' folder
2007-05-29 06:37:09 C:\WINDOWS\tasks\MP Scheduled Scan.job
********************************************************************
catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-29 15:37:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
********************************************************************
Completion time: 2007-05-29 15:38:42 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-29 15:38
C:\ComboFix2.txt ... 2007-05-29 08:27
--- E O F ---
angel84cecil
2007-05-29, 11:24
Logfile of HijackThis v1.99.1
Scan saved at 5:22:46 PM, on 29/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Hi
How's your internet connection now?
If it's working then follow these instructions otherwise please let me know.
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
Click on Change state next to Resident shield. It should now change to inactive.
Click on Change state next to Automatic updates. It should now change to inactive.
Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates (http://www.ewido.net/en/download/updates/).
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run AVG yet. Will do it a bit later.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop. Don't run ATF yet. Will do it a bit later.
Start hjt, click do a system scan only, check:
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games...ploader_v6.cab
Close all browsers and other windows. Click fix checked.
I assume you have still Killbox installation left. However, if you've removed Killbox download it here (http://www.downloads.subratam.org/KillBox.zip).
Unzip it to the desktop but do NOT run it yet.
Copy the text to a Notepad file and save it to your desktop! We will need the file later.
Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.
Running temp cleaner & AVG Anti-Spyware
---------------------------------------
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the
Save Scan Report
button before you did hit the
Apply all Actions
button.
Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
After that please run Killbox.
Select "Delete on Reboot".
Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\system32\cmdctunj.exe
C:\WINDOWS\system32\autodmwl.exe
C:\WINDOWS\system32\dllqepfe.exe
C:\WINDOWS\system32\regegygj.exe
C:\WINDOWS\system32\fxsxyfhp.exe
C:\WINDOWS\system32\clitbdeu.exe
C:\WINDOWS\system32\wsmmlog.exe
C:\WINDOWS\system32\smcntlwio.exe
C:\WINDOWS\system32\plsitctl.exe
C:\WINDOWS\system32\sdservss.exe
C:\WINDOWS\system32\osskhbd.exe
C:\WINDOWS\system32\netbikfo.exe
Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
Post AVG Anti-spyware log & a fresh hjt log.
angel84cecil
2007-05-29, 15:38
Hi Blade,
My connection is Fine..
So are there any still ALOT problem in my pc after posting the lastest HJT? so i can proceed to the next steps that you just provided? ??
Hi Cecilia
I can guarantee that your latest log looks MUCH better than the one in the beginning :) As connection works now you can safely follow my latest instructions.
angel84cecil
2007-05-30, 08:43
C:\Program Files\MSN Messenger\msnmsgr(2).exe -> Backdoor.MSNMaker.w : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dllqepfe.exe -> Backdoor.Sdbot : Cleaned with backup (quarantined).
C:\IBMTOOLS\DRIVERS\MOUSE\SP_OPT\MS98.CAB/PMUninst.exe -> Downloader.Zlob : Cleaned with backup (quarantined).
C:\WINDOWS\system32\PMUNINST.EXE -> Downloader.Zlob : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ms98.cab/PMUninst.exe -> Downloader.Zlob : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0124605.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0128633.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0128698.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0135698.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0138698.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0139698.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0154751.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0155751.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0156790.dll -> Logger.Agent.fr : Cleaned with backup (quarantined).
C:\HijackThis\backups\backup-20070530-104549-874.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0632552.sys -> Not-A-Virus.SpamTool.Win32.Agent.u : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0121599.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0123598.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0124600.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0128598.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0128695.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0130694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0135694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0138694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0139694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0143694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0151694.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0154725.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0154747.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0155746.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0155747.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0155748.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0156746.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0156747.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0156748.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0158787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0158788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0163787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0163788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0165787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0165788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0166787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0166788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0167787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0168789.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0168790.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0169788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0169789.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0170787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0170788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0173787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0173788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0175787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0175788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0176787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0178787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0182787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0184787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0184788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0186787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
angel84cecil
2007-05-30, 08:44
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0187787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0187788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0191787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0199787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0200787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0200788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0206787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0215787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0217787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0217788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0218787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0240787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0241787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0243787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0253787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0260787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0266787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0267787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0269787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0271787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0272787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0274787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0276787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0285787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0286787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0286788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0287788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0287789.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0295787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP273\A0295788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0308787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0313787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0314788.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0317787.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0324792.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0330792.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0337791.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0337792.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369123.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369127.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369129.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369131.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\WINDOWS\system32\osskhbd.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\WINDOWS\system32\plsitctl.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sdservss.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\WINDOWS\system32\smcntlwio.exe -> Proxy.Slaper.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP275\A0350792.exe -> Proxy.Slaper.u : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369125.exe -> Proxy.Slaper.u : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP266\A0082827.exe -> Trojan.Agent.afg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0085206.exe -> Trojan.Agent.afg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP269\A0101449.exe -> Trojan.Agent.afg : Cleaned with backup (quarantined).
C:\!KillBox\jbiqcwkxunjhb.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\jbiqcwkxunjhb.dll.vir -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\praosyavj.dll.vir -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\zcblo.dll.vir -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP294\A0575485.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP295\A0576508.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP297\A0583718.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP299\A0622092.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631252.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631477.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631544.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\WINDOWS\system32\u.dll -> Trojan.Agent.j : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\nvstatld.dll.vir -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0130698.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0165791.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0182791.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0259791.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP291\A0539771.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP292\A0547161.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP297\A0583716.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP299\A0621998.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631292.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\nvstatld.dll -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\iuqcqwosrvc.dll.vir -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP291\A0539772.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP292\A0547162.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP297\A0583717.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP299\A0621999.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631293.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\WINDOWS\system32\iuqcqwosrvc.dll -> Trojan.Vqten : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\sgl.dll.vir -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP291\A0539773.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP292\A0547163.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP297\A0583719.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP299\A0622000.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631294.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sgl.dll -> Trojan.Vqten.A : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066468.exe -> Worm.Limar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066643.exe -> Worm.Limar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0068096.exe -> Worm.Limar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP247\A0063488.dll -> Worm.Stration : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063635.dll -> Worm.Stration : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP247\A0063489.exe -> Worm.Stration.dn : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064614.dll -> Worm.Warezov.ai : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP260\A0066776.exe -> Worm.Warezov.cu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0073094.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
angel84cecil
2007-05-30, 08:47
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076145.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076264.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0077321.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0079402.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081407.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081451.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081457.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP266\A0082743.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0085140.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0169784.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP281\A0369215.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP281\A0369217.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP281\A0369219.dll -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\WINDOWS\system32\appperf.exe -> Worm.Warezov.dq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP232\A0061207.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP233\A0061217.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP233\A0061294.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP234\A0061399.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP235\A0061601.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP236\A0061696.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP236\A0061841.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP237\A0062051.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP241\A0062199.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP241\A0062208.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP241\A0062338.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP241\A0062401.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP242\A0062487.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP243\A0062623.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP244\A0062812.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP245\A0062836.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP245\A0063061.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP246\A0063191.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP247\A0063407.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063630.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063640.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063666.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063778.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP249\A0064011.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP249\A0064161.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP250\A0064336.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP250\A0064476.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064607.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064617.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064719.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064846.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP252\A0064865.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP253\A0065007.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP253\A0065011.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP253\A0065191.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP254\A0065371.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP255\A0065540.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP256\A0065647.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP256\A0065738.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP257\A0065942.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP257\A0066063.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP257\A0066083.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP257\A0066155.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066474.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066502.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066647.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP260\A0066780.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0066960.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0066965.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0067966.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0068089.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP261\A0068106.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP262\A0068453.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP262\A0068486.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP262\A0068651.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP264\A0068856.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0070827.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0071828.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0073083.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0073102.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076149.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076166.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076221.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076257.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076267.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0076286.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0077286.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0077304.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0077325.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0079365.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0079396.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0079406.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081440.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
angel84cecil
2007-05-30, 08:49
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081461.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081490.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0081555.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP266\A0082709.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP266\A0082846.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP266\A0082912.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP267\A0084981.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0084995.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0085211.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0085248.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0088280.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0095280.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0096336.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP268\A0097389.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP269\A0100446.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP269\A0101457.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0102457.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0111457.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0111513.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0112527.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0115547.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0115597.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0124597.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0128693.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP270\A0151724.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0154745.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP271\A0156786.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP272\A0185786.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369112.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP279\A0369117.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP281\A0369145.exe -> Worm.Warezov.ka : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP259\A0066644.dll -> Worm.Warezov.ln : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP248\A0063634.exe -> Worm.Warezov.lx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP236\A0061693.exe -> Worm.Warezov.md : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP236\A0061837.exe -> Worm.Warezov.mf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP236\A0061838.dll -> Worm.Warezov.mf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP246\A0063188.exe -> Worm.Warezov.mk : Cleaned with backup (quarantined).
C:\!KillBox\IoCNAW2v.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\!KillBox\i2VKVg.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP251\A0064713.exe -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP294\A0575482.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP294\A0575483.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP295\A0576505.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP295\A0576506.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631249.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP300\A0631250.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631474.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631475.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631541.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP301\A0631542.dll -> Worm.Warezov.mo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5D527826-05BD-4A83-8416-28ACDDA14001}\RP265\A0070824.exe -> Worm.Warezov.ne : Cleaned with backup (quarantined).
::Report end
angel84cecil
2007-05-30, 08:58
Logfile of HijackThis v1.99.1
Scan saved at 2:50:52 PM, on 30/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ailkmokisub.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Hi
Well..still something left.
Run LSPFix (http://www.cexx.org/lspfix.zip). Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of ailkmokisub.dll (and nothing else), move them to the "Remove" pane and by clicking the >> button. Click Finish.
==================
Reboot into safe mode
Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Delete following file:
c:\windows\system32\ailkmokisub.dll
Reboot back into normal mode and post a fresh hjt log.
angel84cecil
2007-05-30, 10:40
c:\windows\system32\ailkmokisub.dll <<- cannot be delete....
Double-click Killbox.exe to run it.
Select "Delete on Reboot".
Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:
c:\windows\system32\ailkmokisub.dll
Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
(In case if connection is lost run lspfix and remove all instances of ailkmokisub.dll and reboot.)
angel84cecil
2007-05-30, 11:47
Logfile of HijackThis v1.99.1
Scan saved at 5:46:12 PM, on 30/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Hi
Are you using more than one antivirus program? It's recommended to have only one antivirus (and software firewall) product active in same system.
Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis
We need to re hide system files. To do so, please follow the steps below:
Double-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab.
Put a check by
Hide file extensions for known file types.
Under the
Hidden files
folder, select
Show hidden files and folders.
Check
Hide protected operating system files.
Click Apply, and then click OK.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6u1 (http://java.sun.com/javase/downloads/index.jsp).
Scroll down to where it says
The J2SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the
Download
button to the right.
Check the box that says:
Accept License Agreement.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.
If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
Change the allow paste operations via script to Disable
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
Download Adaware
Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial (http://www.bleepingcomputer.com/forums/index.php?showtutorial=48)
The program is available for download here (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10319876.html?tag=lst-0-1)
Download Spybot
Spybot is a scanner like adaware. It scans for spyware and other malicious programs. It is important to have both Adaware and Spybot on your computer because each program provides unique detection and pretection measures. Spybot has preventitive tools that stop programs from even installing on your computer.
To see how to set this up as well as more spybot features, see here (http://www.bleepingcomputer.com/forums/index.php?showtutorial=43)
Spybot can be downloaded at this location (http://www.download.com/Spybot-Search-Destroy/3000-8022-10122137.html?part=dl-spybot&subj=dl&tag=but)
Download SpywareBlaster
Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
kill bits
in the registry, so that certain activex controls can't install.
If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.php?id=2859&file=11&evp=61b0e8ad41924a03c37615f4682b4cef)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html)
Download iespyad
It puts many bad webpages on your restricted zones list. This means that you can still view the
bad
webpages, but the webpages cannot do certain things (such as use javascripts and cookies).
If you need help understanding how it works, there is a tutorial here (http://www.bleepingcomputer.com/tutorials/tutorial53.html)
Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe)
hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system... problems etc.
Have a great day,
Blade :)
angel84cecil
2007-05-30, 15:36
Thanks alot BLADE for the Big Help....
I only got 1 antivirus software which is Ad Aware...
I'll update you tomorrow regarding my pc....
I only got 1 antivirus software which is Ad Aware...
Have you previously had Norton and PCTools Antivirus? There seems to be some entries in the log and that's why I'm asking.
Ad Aware isn't actually antivirus program. You can choose proper antivirus program here (http://www.freebyte.com/antivirus/#scanners) . Then you need also firewall. I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this (http://www.bleepingcomputer.com/forums/tutorial60.html) webpage out. See here (http://www.freebyte.com/antivirus/#firewalls) to choose one
angel84cecil
2007-05-30, 16:42
Hi Blade,
1. Need help to remove those 2 Norton & PC TOOLs (izzit at the Add n' Remove)..do recommend mi a good antivirus software.
2. As well recommendation for which firewall to use.
;)
For antivirus protection I'd recommend either Avast! (http://www.avast.com/eng/avast_4_home.html) or Antivir (http://www.free-av.com/).
For firewall Zonealarm (http://www.zonealarm.com/store/content/catalog/products/sku_list_za.jsp) is good choice. ZA is easy (maybe the easiest) firewall learn to use.
Other alternatives can be found behind the links I posted in my previous post.
I recommend having one antivirus program and one software firewall downloaded before starting removing process of Norton and PC Tools Antivirus and then turn Windows own firewall on through Security Center (can be found in control panel).
http://dn.codegear.com/article/images/32532/shot1.bmp
Remove thru add/remove programs (if found):
-all Norton instances
-PC Tools Antivirus
Start hjt, click do a system scan only, check:
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Close all browsers and other windows. Click fix checked.
Creating & executing batch file
-------------------------------
Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop. (If you are still unsure on how to do this there is a little tutorial with pictures here (http://www.nellie2.co.uk/file.htm#How_to_Make_a_.Bat_File))
@echo off
sc stop "Automatic LiveUpdate Scheduler"
sc delete "Automatic LiveUpdate Scheduler"
sc stop ccEvtMgr
sc delete ccEvtMgr
sc stop ccPwdSvc
sc delete ccPwdSvc
sc stop ccSetMgr
sc delete ccSetMgr
sc stop LiveUpdate
sc delete LiveUpdate
sc stop NPFMntor
sc delete NPFMntor
sc stop SNDSrvc
sc delete SNDSrvc
Double-click on fixes.bat file to execute it.
Reboot into safe mode and delete following folders:
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\PC Tools AntiVirus
C:\Program Files\Symantec
C:\Program Files\Norton AntiVirus
angel84cecil
2007-05-31, 08:04
Logfile of HijackThis v1.99.1
Scan saved at 2:00:06 PM, on 31/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kacup.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
angel84cecil
2007-05-31, 08:06
Hi Blade,
I think my pc need to clear Kacup.dll ritez?
Double-click Killbox.exe to run it.
Select "Delete on Reboot".
Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:
c:\windows\system32\kacup.dll
Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
(In case if connection is lost run lspfix and remove all instances of kacup.dll and reboot.)
I see you've installed Avast. Good. How about firewall?
angel84cecil
2007-05-31, 09:14
Hi Blade,
1. I'll send the HJT tomolo.
2. May I know why my LAN internet connection kept restarting by itself?
Thanks.
angel84cecil
2007-05-31, 11:05
hI Blade,
Everything seems to be running fine now :bigthumb:. My internet connection is fine as well after restoring and running Ispfix (removing kacup.dll) and installing Avira Antivirus instead of Avast! :bigthumb:.
Here's my Latest HJT :present:
Logfile of HijackThis v1.99.1
Scan saved at 4:57:27 PM, on 31/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [LorraineSpy] C:\WINDOWS\LorraineSpyingOnCecilia.vbs
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168476246375
O16 - DPF: {7238A364-D686-4A88-B1AF-1223D6E9497A} (SFClientFree Object) - https://skyfexfree.net/Client/ClientFree.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C99D4C47-DB9A-4BC0-BFA9-E6DDFDACDC62}: NameServer = 202.75.129.101,202.75.129.102
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Hi Cecilia
Good to hear that system is running ok again :) Now take good care of it ;)
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.