PDA

View Full Version : How Do I Remove VirusProtectPro?


Canic
2007-09-07, 21:15
SmitFraudFix v2.221

Scan done at 10:59:58.53, Fri 09/07/2007
Run from C:\Documents and Settings\Owner.Carl\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Video ActiveX Access\imsmain.exe
C:\Program Files\Video ActiveX Access\iesmn.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\AOL\1160497732\ee\AOLSoftware.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Video ActiveX Access\imsmn.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Video ActiveX Access\iesmin.exe
C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Paltalk Messenger\palstart.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\Allume\ZipMagic\MXTask.exe
C:\PROGRA~1\Allume\ZipMagic\mxtask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\common files\aol\1160497732\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
c:\program files\common files\aol\1160497732\ee\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\SpyNoMore\SNM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner.Carl


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner.Carl\Application Data

C:\Documents and Settings\Owner.Carl\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.7.lnk FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\OWNER~1.CAR\STARTM~1\VirusProtectPro 3.7.lnk FOUND !
C:\DOCUME~1\OWNER~1.CAR\STARTM~1\Programs\VirusProtectPro 3.7 FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\OWNER~1.CAR\FAVORI~1

C:\DOCUME~1\OWNER~1.CAR\FAVORI~1\Online Security Test.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

C:\DOCUME~1\OWNER~1.CAR\Desktop\VirusProtectPro 3.7.lnk FOUND !
C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Perfect Codec\ FOUND !
C:\Program Files\Video ActiveX Access\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://f3.yahoofs.com/users/41b1df30z9ba1b00b/5a5a/__tn_/4289.jpg?pho2DXFBy_up0htl"
"SubscribedURL"="http://f3.yahoofs.com/users/41b1df30z9ba1b00b/5a5a/__tn_/4289.jpg?pho2DXFBy_up0htl"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="http://f3.yahoofs.com/users/41b1df30z9ba1b00b/5a5a/__sr_/f7bd.jpg?pho2DXFBt9WokI6J"
"SubscribedURL"="http://f3.yahoofs.com/users/41b1df30z9ba1b00b/5a5a/__sr_/f7bd.jpg?pho2DXFBt9WokI6J"
"FriendlyName"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\2]
"Source"="http://us.a2.yahoofs.com/users/4Fo_AlrGvlod/__sr_/51f3.jpg?tkn=phcHDcFBivYonvYO&saveas=Carl@PartyII"
"SubscribedURL"="http://us.a2.yahoofs.com/users/4Fo_AlrGvlod/__sr_/51f3.jpg?tkn=phcHDcFBivYonvYO&saveas=Carl@PartyII"
"FriendlyName"=""

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"

[HKEY_CLASSES_ROOT\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]
@="C:\WINDOWS\system32\jbtazy.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]
@="C:\WINDOWS\system32\jbtazy.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6e886df7-914d-48f0-86b3-a5cf24385361}"="falsism"

[HKEY_CLASSES_ROOT\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}\InProcServer32]
@="C:\WINDOWS\system32\fwrkqfl.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}\InProcServer32]
@="C:\WINDOWS\system32\fwrkqfl.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"="cakewalks"

[HKEY_CLASSES_ROOT\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}\InProcServer32]
@="C:\WINDOWS\system32\fwjgtk.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}\InProcServer32]
@="C:\WINDOWS\system32\fwjgtk.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{de5ede53-9db0-422d-b32d-5c41c96d6f52}"="heterotroph"

[HKEY_CLASSES_ROOT\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}\InProcServer32]
@="C:\WINDOWS\system32\iklqcx.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}\InProcServer32]
@="C:\WINDOWS\system32\iklqcx.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C28F2D17-6FE1-4C90-8D79-A7B544288CCE}: DhcpNameServer=66.75.164.90 66.75.164.89
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C28F2D17-6FE1-4C90-8D79-A7B544288CCE}: DhcpNameServer=202.106.196.115
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C28F2D17-6FE1-4C90-8D79-A7B544288CCE}: DhcpNameServer=66.75.164.90 66.75.164.89
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=66.75.164.90 66.75.164.89
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=66.75.164.90 66.75.164.89


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
tashi
2007-09-07, 21:39
Hello.

Please see:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Please Post ONLY The Logs We Ask For, (http://forums.spybot.info/showthread.php?t=16806)

Copy/paste the logs requested into a new topic, I will close this one as helpers look for zero response. ;)