PDA

View Full Version : Smitfraud f'd me!


noletubby77
2007-12-17, 06:03
KASPERSKY ONLINE SCANNER REPORTKASPERSKY ONLINE SCANNER REPORT
Monday, December 03, 2007 12:00:24 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build
2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 3/12/2007
Kaspersky Anti-Virus database records: 470966


Scan Settings
Scan using the following antivirus databaseextended
Scan Archivestrue
Scan Mail Basestrue

Scan TargetMy Computer
C:\
D:\

Scan Statistics
Total number of scanned objects37680
Number of viruses found21
Number of infected objects46
Number of suspicious objects4
Duration of the scan process01:37:36

Infected Object NameVirus NameLast Action
C:\Documents and Settings\All Users\Application
Data\McAfee\HackerWatch\data\HwLocal.xdb Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData
Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\MSC\Logs\Events.dat Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\MSC\Logs\{4CC2C92F-9814-432B-9F93-7CD6BDE71470}.log Object is
locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\MSC\Logs\{A08D8048-AA81-443E-BACA-0EA92816C167}.log Object is
locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\MSC\McUsers.dat Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\VirusScan\Data\TFR7.tmp Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\Virtumonde3.zip/avp.exe Suspicious:
Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\Virtumonde3.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\Yazzle.zip/Yazzle1162OinUninstaller.exe Suspicious:
Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search &
Destroy\Recovery\Yazzle.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\Famous James\Application Data\$_hpcst$.hpc
Object is locked skipped

C:\Documents and Settings\Famous James\Application
Data\Microsoft\Outlook\PALM CENTRO.srs Object is locked skipped

C:\Documents and Settings\Famous James\Application
Data\Microsoft\Templates\Normal.dot Object is locked skipped

C:\Documents and Settings\Famous James\Cookies\index.dat Object is locked
skipped

C:\Documents and Settings\Famous James\Local Settings\Application
Data\Microsoft\Outlook\Outlook1.pst Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Application
Data\Microsoft\Outlook\PALM CENTROHotmail-00000001.pst Object is locked
skipped

C:\Documents and Settings\Famous James\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Famous James\Local
Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Famous James\Local
Settings\History\History.IE5\MSHist012007120320071204\index.dat Object is
locked skipped

C:\Documents and Settings\Famous James\Local Settings\Temp\JVM8D.tmp
Object is locked skipped

C:\Documents and Settings\Famous James\Local
Settings\Temp\Perflib_Perfdata_2ae0.dat Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Temp\stany.exe
Infected: Trojan-Dropper.Win32.Agent.chq skipped

C:\Documents and Settings\Famous James\Local Settings\Temp\WCESLog.log
Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Temp\~DF6366.tmp
Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Tempmbroit.exe
Infected: Trojan-Downloader.Win32.Agent.fkf skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\4XKXE3GV\binter[1].exe Infected:
Trojan-Downloader.Win32.Small.ewr skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\4XKXE3GV\search1[1].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\file[1].exe Infected:
Trojan-Downloader.Win32.Agent.fkf skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\l3[1] Infected: Trojan-Downloader.JS.Psyme.ow
skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\search[1].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\search[2].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\smss[1].exe Infected:
Trojan-Downloader.Win32.Alphabet.aa skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\A1YFQZ0F\ucleaner_setup[1].exe Infected:
not-a-virus:Downloader.Win32.UltimateFix.e skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\l3[1]/packed Infected:
Trojan-Downloader.JS.Psyme.ow skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\l3[1] GZIP: infected - 1 skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\search1[1].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\search1[2].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\search[1].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\search[2].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\SmitfraudFix[1].exe/data.rar/SmitfraudFix/Reboot.exe
Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\SmitfraudFix[1].exe/data.rar Infected:
not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\SmitfraudFix[1].exe RarSFX: infected - 2
skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\tds.mxlinx[1]/packed Infected:
Trojan-Downloader.JS.Psyme.ou skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\QJ6FMVK9\tds.mxlinx[1] GZIP: infected - 1 skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\WHEP8NGZ\lc10172[1].html Infected:
Trojan-Downloader.JS.Agent.rn skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\WHEP8NGZ\load[1].exe Infected:
Trojan-Dropper.Win32.FriJoiner.bg skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\WHEP8NGZ\search1[1].htm Infected:
Trojan-Downloader.JS.Remora.w skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\WHEP8NGZ\spoolsv[1].exe Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped

C:\Documents and Settings\Famous James\Local Settings\Temporary Internet
Files\Content.IE5\WHEP8NGZ\tds.mxlinx[1] Infected:
Trojan-Downloader.JS.Psyme.ou skipped

C:\Documents and Settings\Famous James\NTUSER.DAT Object is locked skipped


C:\Documents and Settings\Famous James\ntuser.dat.LOG Object is locked
skipped

C:\Documents and Settings\Famous James\p423ck.exe Infected:
Trojan-Dropper.Win32.FriJoiner.bg skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked
skipped

C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local
Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet
Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped


C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked
skipped

C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked
skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked
skipped

C:\Program Files\ovurahgx\wlenixkr.dll Infected:
Trojan-Downloader.Win32.Zlob.enu skipped

C:\Program Files\smss.exe Infected: Trojan-Downloader.Win32.Alphabet.aa
skipped

C:\Program Files\spoolsv.exe Infected:
Trojan-Downloader.Win32.Alphabet.gen skipped

C:\Program Files\ucleaner_setup.exe Infected:
not-a-virus:Downloader.Win32.UltimateFix.e skipped

C:\Program Files\WindowsUpdate\zyrtoke.html Infected:
Trojan-Clicker.HTML.IFrame.dn skipped

C:\Program Files\Yahoo!\Messenger\logs\billing_Famous James.log Object is
locked skipped

C:\Program Files\Yahoo!\Messenger\logs\client_Famous James.log Object is
locked skipped

C:\Program Files\Yahoo!\Messenger\logs\network_Famous James.log Object is
locked skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0007945.exe
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0008918.exe
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0008947.exe
Infected: Trojan-Downloader.Win32.Alphabet.aa skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0008948.exe
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0008955.exe
Infected: not-a-virus:Downloader.Win32.UltimateFix.e skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0009976.exe
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0009987.dll
Infected: Trojan-Downloader.Win32.Small.gkh skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0010011.dll
Infected: Trojan-Downloader.Win32.Small.gkh skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP43\A0010035.exe
Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume
Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP44\change.log
Object is locked skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{72240988-DDBB-4E5C-9681-374998F3E6F5}.bin
Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked
skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\byxuurp.dll Infected:
not-a-virus:AdWare.Win32.Virtumonde.atj skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is
locked skipped

C:\WINDOWS\system32\config\systemprofile\Local
Settings\History\History.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet
Files\Content.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped

C:\WINDOWS\system32\drivers\core.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\PLSRemote.exe Infected:
not-a-virus:RemoteAdmin.Win32.PLSRemot skipped

C:\WINDOWS\system32\skjlrsjp\skjlrsjp2.exe Infected:
not-a-virus:FraudTool.Win32.UltimateDefender.v skipped

C:\WINDOWS\system32\skjlrsjp\skjlrsjp3.exe Infected:
not-a-virus:Downloader.Win32.UltimateFix.d skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked
skipped

C:\WINDOWS\system32\yayabyv.dll Infected:
not-a-virus:AdWare.Win32.Virtumonde.azt skipped

C:\WINDOWS\Temp\mcafee_2KsBrBvZKXMFUhJ Object is locked skipped

C:\WINDOWS\Temp\mcafee_aoS1CRb0D4JqZOz Object is locked skipped

C:\WINDOWS\Temp\mcafee_gGOTUJg1nITo8v7 Object is locked skipped

C:\WINDOWS\Temp\mcafee_T64GSXjkgRVTkiw Object is locked skipped

C:\WINDOWS\Temp\mcafee_wX64ZIAeU34K2uX Object is locked skipped

C:\WINDOWS\Temp\mcmsc_96lc90eij2f3pVZ Object is locked skipped

C:\WINDOWS\Temp\mcmsc_EdBAETgxQiGCDFZ Object is locked skipped

C:\WINDOWS\Temp\mcmsc_fqbk3MpQw4hMW5R Object is locked skipped

C:\WINDOWS\Temp\mcmsc_rhdDtrQfeguOqiQ Object is locked skipped

C:\WINDOWS\Temp\mcmsc_t160BMsFOJnaycW Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_7c0.dat Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
noletubby77
2007-12-17, 06:11
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:00 AM, on 12/17/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SecCenter\scprot4.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Palm\Hotsync.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Sprint music manager\MEMonitor.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [StorageGuard] "c:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [winshow] "C:\WINDOWS\winshow.exe"
O4 - HKLM\..\Run: [pcncjcnu] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\pcncjcnu.dll"
O4 - HKLM\..\Run: [revwbgby] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\revwbgby.dll"
O4 - HKLM\..\Run: [opilmzyt] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\opilmzyt.dll"
O4 - HKLM\..\Run: [fatijgji] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fatijgji.dll"
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O4 - HKLM\..\Run: [unchufcj] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\unchufcj.dll"
O4 - HKLM\..\Run: [tahavohq] rundll32.exe "C:\Program Files\ovurahgx\wlenixkr.dll",Init
O4 - HKLM\..\Run: [20e5d653] rundll32.exe "C:\WINDOWS\System32\vbkommfw.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: MEMonitor.lnk = C:\Program Files\Sprint music manager\MEMonitor.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: PLSRemote Service (PLSRemoteSvc) - Unknown owner - C:\WINDOWS\SYSTEM32\PLSRemote.exe (file missing)
O23 - Service: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)

--
End of file - 9464 bytes


Thank you so much in advance for helping. I am not super computer savvy but I can follow instructions well. With that said, I hope that I followed the first post instructions correctly!! James
Mr_JAk3
2007-12-20, 17:20
Hi and welcome to the Forums :)

You're infected.

Rename HijackThis.exe to skanneri.exe by doing the following;

Navigate here using Windows Explorer (windows button + E) or My Computer Local Disk C: C:\Program Files\Trend Micro\HijackThis
Right-click on the HijackThis.exe
Choose from the pull-down menu; "Rename"
And now Rename HijackThis.exe to skanneri.exe
When you've renamed HijackThis, open HijackThis again.
Take a fresh HijackThis log (click Do a system scan and save a log file)
Post the fresh HijackThis log here.