View Full Version : I have Smithfraud infection
The antibiotics wont cure it......:oops: seriously this has been doing my head in!!!! A relatively fresh install - Windows XP. The machine has 3 user accounts. I get pop up after pop up coming up - & have used Search & Destroy to rid the machine of a fair amount of stuff but Smithfraud is a bit of a bugger......I had already turned off system restore (but now its back on).
Hijack as follows - virus scan in next post as it wont fit sorry.....
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:28:47, on 24/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Editor plugin - {65303C85-8DFA-4804-A796-6D4A194494A3} - surina.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9C3BEA4C-D466-4C99-9D63-C3478AA9DF68} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {F507264C-5E6B-4D1C-9351-5A2402BE4479} - C:\WINDOWS\system32\awvvt.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184710566389
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awvvt - C:\WINDOWS\system32\awvvt.dll (file missing)
O20 - Winlogon Notify: qommklk - qommklk.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, August 24, 2007 10:01:23 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 24/08/2007
Kaspersky Anti-Virus database records: 389594
Well I would have had to add 7 more posts to get all of the online virus report on, so I have uploaded it here:
http://www.zoom-in.co.uk/onlinevirus.txt
Hope thats OK - if not are 7 more postings acceptable - I will happily do that but didnt want to waster your time. :bigthumb:
Kevin
Hello charjoe and welcome to the Forums :)
You did the right thing by uploading the report.
Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
All done,
contents of hijack this and vindo log below:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:12:46, on 27/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Editor plugin - {65303C85-8DFA-4804-A796-6D4A194494A3} - surina.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9C3BEA4C-D466-4C99-9D63-C3478AA9DF68} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {F507264C-5E6B-4D1C-9351-5A2402BE4479} - C:\WINDOWS\system32\awvvt.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184710566389
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awvvt - C:\WINDOWS\system32\awvvt.dll (file missing)
O20 - Winlogon Notify: qommklk - qommklk.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
VundoFix V6.5.7
Checking Java version...
Scan started at 18:01:46 27/08/2007
Listing files found while scanning....
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\tvvwa.bak1
C:\WINDOWS\system32\tvvwa.bak2
C:\WINDOWS\system32\tvvwa.ini2
C:\WINDOWS\system32\tvvwa.tmp
Beginning removal...
Attempting to delete C:\WINDOWS\system32\tvvwa.bak1
C:\WINDOWS\system32\tvvwa.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\tvvwa.bak2
C:\WINDOWS\system32\tvvwa.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\tvvwa.ini2
C:\WINDOWS\system32\tvvwa.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\tvvwa.tmp
C:\WINDOWS\system32\tvvwa.tmp Has been deleted!
Performing Repairs to the registry.
Done!
I have rebooted & still get a pop up as soon as I open up firefox/ie7. Could it be the fact I have 3 accounts on XP???? Cheers so far!!
Kevin
Hi again, we'll continue :)
You're still infected.
You should print these instructions or save these to a text file. Follow these instructions carefully.
Download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
==================
Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.
O2 - BHO: Editor plugin - {65303C85-8DFA-4804-A796-6D4A194494A3} - surina.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9C3BEA4C-D466-4C99-9D63-C3478AA9DF68} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {F507264C-5E6B-4D1C-9351-5A2402BE4479} - C:\WINDOWS\system32\awvvt.dll (file missing)
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O20 - Winlogon Notify: awvvt - C:\WINDOWS\system32\awvvt.dll (file missing)
O20 - Winlogon Notify: qommklk - qommklk.dll (file missing)
Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Open "My Computer" and delete the following files (if present):
C:\WINDOWS\system32\dwdsregt.exe
Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Restart the computer to normal mode.
Please do an online scan with Kaspersky WebScanner (http://www.kaspersky.com/virusscanner)
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.
When you're ready, please post the following logs to here:
- Kaspersky's report
- a fresh HijackThis log
Cheers so far - all requested work done. Getting there!!!!
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, August 28, 2007 7:13:41 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 28/08/2007
Kaspersky Anti-Virus database records: 395243
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
Scan Statistics:
Total number of scanned objects: 27237
Number of viruses found: 1
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 00:48:05
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\01d8bfd465f2f183dbee1e5c50f63c74_91b6207f-c837-4b5a-8b8d-bac83110ca87 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0a568f6a6fecb8c97f98589a5472db93_91b6207f-c837-4b5a-8b8d-bac83110ca87 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\735114ec84b791de5046649ec0c3d3f3_91b6207f-c837-4b5a-8b8d-bac83110ca87 Object is locked skipped
C:\Documents and Settings\Chazaz\Application Data\Microsoft\Internet Explorer\UserData\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\History\History.IE5\MSHist012007082720070828\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\History\History.IE5\MSHist012007082820070829\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Temp\~DFEC6C.tmp Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Temp\~DFECA4.tmp Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Chazaz\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Chazaz\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Chazaz\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{E5BE7E74-F10A-49EA-B19F-78BAB732E902}\RP47\A0012737.sys Object is locked skipped
C:\System Volume Information\_restore{E5BE7E74-F10A-49EA-B19F-78BAB732E902}\RP50\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\KEVIN-X636578UJ.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT00849.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT0084c.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{E5BE7E74-F10A-49EA-B19F-78BAB732E902}\RP50\A0013289.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\System Volume Information\_restore{E5BE7E74-F10A-49EA-B19F-78BAB732E902}\RP50\A0013289.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
E:\System Volume Information\_restore{E5BE7E74-F10A-49EA-B19F-78BAB732E902}\RP50\A0013289.exe RarSFX: infected - 2 skipped
Scan process completed.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:15:26, on 28/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (file missing)
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184710566389
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 6408 bytes
Hello :)
Looks very good now. How is the computer running? Any issues?
Hello :)
Looks very good now. How is the computer running? Any issues?
Hello there I still get pop ups every time I open up firefox. Internet explorer seems fine though I am well pelase.
Can you provide any insight into the viruses found at the end of the kaspersky reports? My AVG does not pick these up & I cant find them to deleted them. Many thanks so far its been great!!!!
Hello there I still get pop ups every time I open up firefox. Internet explorer seems fine though I am well pelase.
Can you provide any insight into the viruses found at the end of the kaspersky reports? My AVG does not pick these up & I cant find them to deleted them. Many thanks so far its been great!!!!
Sorry m8 - internet explorer is pop up central too.....boo!!!!
Hi :)
OK in that case we'll dig a little deeper...
1. Download this file - combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Here we go!!
ComboFix 07-08-30.3 - "Chazaz" 2007-08-31 10:46:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.186 [GMT 1:00]
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\Chazaz\Desktop\internet explorer.lnk
C:\DOCUME~1\Chazaz\Desktop\internet.lnk
C:\DOCUME~1\Dad\STARTM~1\Programs\Startup\ta_start.lnk
C:\WINDOWS\system32\lutzodbqz.dat
C:\WINDOWS\system32\lutzodbqz.exe
C:\WINDOWS\system32\lutzodbqz_nav.dat
C:\WINDOWS\system32\lutzodbqz_navps.dat
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\zxdnt3d.cfg
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CORE
((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-31 )))))))))))))))))))))))))))))))
2007-08-31 10:40 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-31 10:37 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2007-08-27 23:27 <DIR> d-------- C:\Program Files\Orca
2007-08-27 18:01 <DIR> d-------- C:\VundoFix Backups
2007-08-24 22:28 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-24 18:18 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-08-24 18:18 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-08-24 18:18 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-08-24 18:18 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-24 18:18 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-24 18:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-24 18:17 5,885,984 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-24 17:57 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-08-24 17:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-08-24 17:34 <DIR> d-------- C:\Program Files\IVT Corporation
2007-08-24 17:14 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-08-24 17:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-24 07:59 <DIR> d-------- C:\Program Files\Burn4Free Toolbar
2007-08-24 07:59 <DIR> d-------- C:\Program Files\Burn4Free
2007-08-22 21:23 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\HP
2007-08-22 21:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-08-21 23:08 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\HP
2007-08-21 21:53 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2007-08-21 21:40 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-08-21 21:40 37,376 --a------ C:\WINDOWS\system32\hpz3l43a.dll
2007-08-21 21:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-08-21 21:39 77,824 -ra------ C:\WINDOWS\system32\hpzids01.dll
2007-08-21 21:30 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-08-21 21:30 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-08-21 21:30 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-08-21 21:30 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-08-21 21:30 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-08-21 21:30 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-08-21 21:28 <DIR> d-------- C:\Program Files\HP
2007-08-21 21:03 3,732 --------- C:\WINDOWS\hpfmdl09.dat
2007-08-21 21:03 104,775 --a------ C:\WINDOWS\HPFins09.dat
2007-08-21 21:00 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-08-21 21:00 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-08-19 17:59 <DIR> d-------- C:\DOCUME~1\Joe\APPLIC~1\PC Suite
2007-08-18 18:54 <DIR> d-------- C:\WINDOWS\pss
2007-08-17 19:54 <DIR> d-------- C:\DOCUME~1\Chazaz\Phone Browser
2007-08-17 19:45 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\Nokia
2007-08-17 19:38 <DIR> d-------- C:\DOCUME~1\Dad\Phone Browser
2007-08-17 19:37 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\PC Suite
2007-08-17 19:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-17 19:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia
2007-08-17 19:14 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2007-08-17 19:14 <DIR> d-------- C:\Program Files\Common Files\Nokia
2007-08-17 19:13 <DIR> d-------- C:\Program Files\DIFX
2007-08-17 19:13 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\PC Suite
2007-08-17 19:12 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-08-17 19:12 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2007-08-17 19:11 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2007-08-17 19:11 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-08-17 19:11 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2007-08-17 19:11 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2007-08-17 19:11 <DIR> d-------- C:\Program Files\Nokia
2007-08-17 19:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-15 18:19 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-08-15 18:18 <DIR> d-------- C:\Program Files\BT Voyager
2007-08-14 17:49 1 --a------ C:\WINDOWS\system32\ps.dat
2007-08-13 22:46 <DIR> d-------- C:\Program Files\eMule
2007-08-13 22:37 <DIR> d-------- C:\Program Files\BitComet
2007-08-13 22:37 <DIR> d-------- C:\Downloads
2007-08-13 21:47 753,664 --a------ C:\WINDOWS\system32\CNQA1210.DLL
2007-08-13 21:47 40,960 --a------ C:\WINDOWS\system32\CNQU85.DLL
2007-08-13 21:47 389,180 --a------ C:\WINDOWS\system32\UCS32P.DLL
2007-08-13 21:47 311,296 --a------ C:\WINDOWS\system32\CNQL1210.DLL
2007-08-13 21:47 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-08-13 21:47 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-08-13 21:47 <DIR> d--h----- C:\CanoScan
2007-08-11 15:34 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\Media Player Classic
2007-07-25 15:44 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\Skype
2007-07-25 15:43 <DIR> d-------- C:\Program Files\Skype
2007-07-25 15:43 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-07-25 15:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-24 22:40 <DIR> d-------- C:\Program Files\Realtek AC97
2007-07-23 21:12 <DIR> d-------- C:\Program Files\Setup Files
2007-07-23 21:10 <DIR> d-------- C:\Program Files\MSI
2007-07-21 07:21 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-07-21 07:16 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2007-07-21 07:16 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2007-07-21 07:16 <DIR> d-------- C:\Program Files\Cheat Engine
2007-07-20 17:23 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-07-20 17:23 165,376 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-07-20 17:19 <DIR> d-------- C:\Program Files\Glory of the Roman Empire
2007-07-19 21:47 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\WinRAR
2007-07-19 19:37 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\Real
2007-07-19 19:25 <DIR> d-------- C:\DOCUME~1\Joe\APPLIC~1\Real
2007-07-19 19:02 <DIR> d-------- C:\Program Files\IncrediMail
2007-07-19 00:11 <DIR> d-------- C:\Program Files\PowerQuest
2007-07-18 23:44 <DIR> d-------- C:\DOCUME~1\Dad\Contacts
2007-07-18 23:41 <DIR> d-------- C:\Program Files\MSN Messenger
2007-07-18 23:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-18 23:37 <DIR> d-------- C:\Program Files\Yahoo!
2007-07-18 16:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-07-18 16:07 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-07-18 16:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-07-18 08:26 1,395 --a------ C:\WINDOWS\mozver.dat
2007-07-18 08:24 <DIR> d--h----- C:\WINDOWS\$hf_mig$
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-31 10:50 72140 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-15 18:33 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-15 18:33 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-13 22:37 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll
2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-06-08 08:11 831048 --a------ C:\WINDOWS\system32\WudfUpdate_01005.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 08:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 C:\WINDOWS\soundman.exe]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 00:08]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-07-19 19:05]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-31 10:52:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-31 10:59:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-31 10:59
--- E O F ---
Ok Combo killed some infections. How is pc running now ?
Please post a one more HijackThis log :bigthumb:
Hello hello hello!!
No pop ups on Firefox or IE7!!!!!!!!!!!
Latest hijack this log:
ComboFix 07-08-30.3 - "Chazaz" 2007-08-31 10:46:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.186 [GMT 1:00]
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\Chazaz\Desktop\internet explorer.lnk
C:\DOCUME~1\Chazaz\Desktop\internet.lnk
C:\DOCUME~1\Dad\STARTM~1\Programs\Startup\ta_start.lnk
C:\WINDOWS\system32\lutzodbqz.dat
C:\WINDOWS\system32\lutzodbqz.exe
C:\WINDOWS\system32\lutzodbqz_nav.dat
C:\WINDOWS\system32\lutzodbqz_navps.dat
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\zxdnt3d.cfg
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CORE
((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-31 )))))))))))))))))))))))))))))))
2007-08-31 10:40 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-31 10:37 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2007-08-27 23:27 <DIR> d-------- C:\Program Files\Orca
2007-08-27 18:01 <DIR> d-------- C:\VundoFix Backups
2007-08-24 22:28 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-24 18:18 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-08-24 18:18 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-08-24 18:18 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-08-24 18:18 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-24 18:18 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-24 18:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-24 18:17 5,885,984 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-24 17:57 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-08-24 17:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-08-24 17:34 <DIR> d-------- C:\Program Files\IVT Corporation
2007-08-24 17:14 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-08-24 17:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-24 07:59 <DIR> d-------- C:\Program Files\Burn4Free Toolbar
2007-08-24 07:59 <DIR> d-------- C:\Program Files\Burn4Free
2007-08-22 21:23 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\HP
2007-08-22 21:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-08-21 23:08 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\HP
2007-08-21 21:53 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2007-08-21 21:40 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-08-21 21:40 37,376 --a------ C:\WINDOWS\system32\hpz3l43a.dll
2007-08-21 21:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-08-21 21:39 77,824 -ra------ C:\WINDOWS\system32\hpzids01.dll
2007-08-21 21:30 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-08-21 21:30 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-08-21 21:30 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-08-21 21:30 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-08-21 21:30 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-08-21 21:30 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-08-21 21:28 <DIR> d-------- C:\Program Files\HP
2007-08-21 21:03 3,732 --------- C:\WINDOWS\hpfmdl09.dat
2007-08-21 21:03 104,775 --a------ C:\WINDOWS\HPFins09.dat
2007-08-21 21:00 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-08-21 21:00 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-08-19 17:59 <DIR> d-------- C:\DOCUME~1\Joe\APPLIC~1\PC Suite
2007-08-18 18:54 <DIR> d-------- C:\WINDOWS\pss
2007-08-17 19:54 <DIR> d-------- C:\DOCUME~1\Chazaz\Phone Browser
2007-08-17 19:45 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\Nokia
2007-08-17 19:38 <DIR> d-------- C:\DOCUME~1\Dad\Phone Browser
2007-08-17 19:37 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\PC Suite
2007-08-17 19:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-17 19:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia
2007-08-17 19:14 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2007-08-17 19:14 <DIR> d-------- C:\Program Files\Common Files\Nokia
2007-08-17 19:13 <DIR> d-------- C:\Program Files\DIFX
2007-08-17 19:13 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\PC Suite
2007-08-17 19:12 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-08-17 19:12 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2007-08-17 19:11 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2007-08-17 19:11 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-08-17 19:11 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2007-08-17 19:11 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2007-08-17 19:11 <DIR> d-------- C:\Program Files\Nokia
2007-08-17 19:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-15 18:19 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-08-15 18:18 <DIR> d-------- C:\Program Files\BT Voyager
2007-08-14 17:49 1 --a------ C:\WINDOWS\system32\ps.dat
2007-08-13 22:46 <DIR> d-------- C:\Program Files\eMule
2007-08-13 22:37 <DIR> d-------- C:\Program Files\BitComet
2007-08-13 22:37 <DIR> d-------- C:\Downloads
2007-08-13 21:47 753,664 --a------ C:\WINDOWS\system32\CNQA1210.DLL
2007-08-13 21:47 40,960 --a------ C:\WINDOWS\system32\CNQU85.DLL
2007-08-13 21:47 389,180 --a------ C:\WINDOWS\system32\UCS32P.DLL
2007-08-13 21:47 311,296 --a------ C:\WINDOWS\system32\CNQL1210.DLL
2007-08-13 21:47 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-08-13 21:47 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-08-13 21:47 <DIR> d--h----- C:\CanoScan
2007-08-11 15:34 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\Media Player Classic
2007-07-25 15:44 <DIR> d-------- C:\DOCUME~1\Dad\APPLIC~1\Skype
2007-07-25 15:43 <DIR> d-------- C:\Program Files\Skype
2007-07-25 15:43 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-07-25 15:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-24 22:40 <DIR> d-------- C:\Program Files\Realtek AC97
2007-07-23 21:12 <DIR> d-------- C:\Program Files\Setup Files
2007-07-23 21:10 <DIR> d-------- C:\Program Files\MSI
2007-07-21 07:21 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-07-21 07:16 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2007-07-21 07:16 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2007-07-21 07:16 <DIR> d-------- C:\Program Files\Cheat Engine
2007-07-20 17:23 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-07-20 17:23 165,376 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-07-20 17:19 <DIR> d-------- C:\Program Files\Glory of the Roman Empire
2007-07-19 21:47 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\WinRAR
2007-07-19 19:37 <DIR> d-------- C:\DOCUME~1\Chazaz\APPLIC~1\Real
2007-07-19 19:25 <DIR> d-------- C:\DOCUME~1\Joe\APPLIC~1\Real
2007-07-19 19:02 <DIR> d-------- C:\Program Files\IncrediMail
2007-07-19 00:11 <DIR> d-------- C:\Program Files\PowerQuest
2007-07-18 23:44 <DIR> d-------- C:\DOCUME~1\Dad\Contacts
2007-07-18 23:41 <DIR> d-------- C:\Program Files\MSN Messenger
2007-07-18 23:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-18 23:37 <DIR> d-------- C:\Program Files\Yahoo!
2007-07-18 16:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-07-18 16:07 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-07-18 16:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-07-18 08:26 1,395 --a------ C:\WINDOWS\mozver.dat
2007-07-18 08:24 <DIR> d--h----- C:\WINDOWS\$hf_mig$
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-31 10:50 72140 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-15 18:33 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-15 18:33 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-13 22:37 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll
2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-06-08 08:11 831048 --a------ C:\WINDOWS\system32\WudfUpdate_01005.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 08:53]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 C:\WINDOWS\soundman.exe]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 00:08]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-07-19 19:05]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-31 10:52:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-31 10:59:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-31 10:59
--- E O F ---
Hi :)
You posted a ComboFix log, I'd like to see a fresh HijackThis log just to be sure :bigthumb:
der..... :spider:
hijack this report:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:48, on 02/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\INCRED~1\bin\ImNotfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-448539723-261478967-839522115-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Joe')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (file missing)
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184710566389
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 6605 bytes
cheers yet again!!!!
Hi again, it is looking clean now :)
You can remove the tools we used.
Now you can make your hidden files hidden again.
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Check "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
=============
Now that you seem to be clean, please follow these simple steps in order to keep your computer clean and secure:
Clear your system restore (http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx)
This will clear the system restore folders from possible malware that was left behind during the cleaning process.
Use ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1)
Download and install ATF Cleaner. Clean your temporary files & folders with it regularly.
Install SpywareBlaster (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
SpywareBlaster will prevent spyware from being installed.
Install MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm)
This prevents your computer from connecting to harmful sites.
Use Firefox browser (http://www.mozilla.org)
Firefox is faster and more secure browser than Internet Explorer.
Keep your systen up-to-date (http://windowsupdate.microsoft.com)
Visit Windows Update regularly. How to enable Automatic Updates? (http://www.bleepingcomputer.com/tutorials/tutorial35.html)
Keep your antivirus (http://forum.malwareremoval.com/viewtopic.php?p=53#53) and firewall (http://forum.malwareremoval.com/viewtopic.php?p=56#56) up-to-date
Scan your computer regularly with you antivirus software.
Read this article by TonyKlein (http://forums.spybot.info/showthread.php?t=279)
So how did I get infected in the first place?
Stand Up and Be Counted ! (http://www.malwarecomplaints.info/index.php)
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Stay clean and be safe ;)
Many many thanks.
Hopefully we wont meet again!!!
Kevin
You're very welcome :D:
As the problem appears to be resolved this topic has been archived.
If you need it re-opened please send a private message (pm) to a forum staff member and provide a link to the thread; this applies only to the original topic starter.
Glad we could help :2thumb: