View Full Version : Virtumonde,Smithfraud, Zlob...Please help
Hi
Following is my HJT log, then my Kaspersky scan log,,,any help would be much appreciated!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:16 PM, on 5/19/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OW3B7DIL\HiJackThis[1].exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safewebnavigate2008.com/index.php?sid=0&pn=0&aid=725&said=7&pid=0
O2 - BHO: BurstWriting module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\BurstWriting\BurstWriting.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BB90EAF5-B809-4C3C-A5B5-51550128F647} - C:\WINNT\system32\ddcArQkL.dll
O2 - BHO: (no name) - {CFC19E37-2C37-42BF-9DA6-71116F1A6E2C} - C:\WINNT\system32\awttutQh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKLM\..\RunOnce: [SpybotDeletingA9360] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3095] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4782] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3739] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6880] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9338] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1226] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9122] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1771] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9811] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8311] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2920] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1235] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2401] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4659] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9395] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4982] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2537] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9575] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2252] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3019] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8879] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8554] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7217] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA478] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2097] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1675] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC975] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\Run: [e©ùýùñûïèóÎ×øøÕøôþÊýÛñûëÞó] C:\Program Files\XP Antivirus\xpa.exe
O4 - HKCU\..\Run: [InetChk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe work
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\Antivirus 2008\Antvrs.exe
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB5492] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4371] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB459] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6469] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3884] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6547] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9930] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD443] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8417] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD226] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7226] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7088] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB412] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1603] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6411] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD710] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1993] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7288] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3450] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6035] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7293] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD314] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8023] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2841] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7969] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1787] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9827] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9387] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9901] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7516] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4943] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9678] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {3BA4271E-5C1E-48E2-B432-D8BF420DD31D} - http://antivirus-scanner.com/AntvrsInstall.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O20 - Winlogon Notify: awttutQh - C:\WINNT\SYSTEM32\awttutQh.dll
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 9513 bytes
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, May 17, 2008 3:59:50 PM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 17/05/2008
Kaspersky Anti-Virus database records: 779981
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
Scan Statistics:
Total number of scanned objects: 12925
Number of viruses found: 9
Number of infected objects: 14
Number of suspicious objects: 0
Duration of the scan process: 01:07:24
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\Privacy Protector.url Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD1.tmp\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\ms1210301710.exe Infected: Trojan-Dropper.Win32.Agent.rky skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\printsrv32.exe Infected: Trojan.Win32.Agent.lsr skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\setup_526_1_.exe Infected: Trojan-Downloader.Win32.FraudLoad.ym skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\vifmykoc.exe Infected: Trojan.Win32.Agent.gmn skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\RECYCLER\S-1-5-21-1454471165-1563985344-1060284298-500\Dc49\Antvrs.exe Infected: not-a-virus:FraudTool.Win32.AntiVirus2008.w skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\Debug\ipsecpa.log Object is locked skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\Downloaded Program Files\antvrs.exe Infected: not-a-virus:FraudTool.Win32.AntiVirus2008.w skipped
C:\WINNT\Downloaded Program Files\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\WINNT\Downloaded Program Files\CONFLICT.1\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\WINNT\knxsrgte.exe Infected: Trojan.Win32.Vapsup.eyk skipped
C:\WINNT\ModemLog_Lucent Win Modem.txt Object is locked skipped
C:\WINNT\qvlbodmnqse.dll Infected: Trojan.Win32.Vapsup.eyk skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\Download\c3e13424b5ca403dd00c8550d4b5fddd\BITC.tmp Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\system32\awttutQh.dll Infected: Trojan.Win32.Monder.gen skipped
C:\WINNT\system32\CatRoot\SYSMAST.cbd Object is locked skipped
C:\WINNT\system32\CatRoot\SYSMAST.cbk Object is locked skipped
C:\WINNT\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATMAST.cbd Object is locked skipped
C:\WINNT\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATMAST.cbk Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped
C:\WINNT\system32\ddcArQkL.dll Infected: Trojan.Win32.Zapchast.gr skipped
C:\WINNT\system32\ias\dnary.ldb Object is locked skipped
C:\WINNT\system32\ias\ias.ldb Object is locked skipped
C:\WINNT\system32\ias\ias.mdb Object is locked skipped
C:\WINNT\tdomgafw.dll Infected: Trojan.Win32.Vapsup.eyk skipped
C:\WINNT\Temp\JET6DEA.tmp Object is locked skipped
C:\WINNT\Temp\JETA816.tmp Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
Scan process completed.
Hi lawnguy
You are running HijackThis from temp folder so that is the first thing to correct:
Click here (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
and I am getting a pop-up error message that reads "Program error" at the top, then" HijackThis.exe has generated errors and will be closed by Windows. You will need to restat the program." Below that it reads, "An error log is being created."
My only option then is to click, "OK". I was able to just run it successfully from the temp folder. Below is new scan I just ran...Any suggestions?
here is the hjt log I ran todayLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:55:02 PM, on 5/20/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OW3B7DIL\HiJackThis[1].exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Outlook Express\MSIMN.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.safewebnavigate2008.com/index.php?sid=0&pn=0&aid=725&said=7&pid=0
O2 - BHO: BurstWriting module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\BurstWriting\BurstWriting.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BB90EAF5-B809-4C3C-A5B5-51550128F647} - C:\WINNT\system32\ddcArQkL.dll
O2 - BHO: (no name) - {CFC19E37-2C37-42BF-9DA6-71116F1A6E2C} - C:\WINNT\system32\awttutQh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKLM\..\RunOnce: [SpybotDeletingA9360] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3095] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4782] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3739] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6880] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9338] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1226] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9122] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1771] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9811] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8311] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2920] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1235] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2401] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4659] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9395] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4982] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2537] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9575] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2252] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3019] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8879] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8554] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7217] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA478] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2097] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1675] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC975] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\Run: [e©ùýùñûïèóÎ×øøÕøôþÊýÛñûëÞó] C:\Program Files\XP Antivirus\xpa.exe
O4 - HKCU\..\Run: [InetChk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe work
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\Antivirus 2008\Antvrs.exe
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB5492] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4371] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB459] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6469] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3884] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6547] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9930] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD443] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8417] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD226] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7226] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7088] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB412] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1603] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6411] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD710] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1993] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7288] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3450] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6035] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7293] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD314] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8023] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2841] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7969] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1787] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9827] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9387] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9901] command /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7516] cmd /c del "C:\WINNT\system32\awttutQh.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4943] command /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9678] cmd /c del "C:\WINNT\system32\ddcArQkL.dll"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {3BA4271E-5C1E-48E2-B432-D8BF420DD31D} - http://antivirus-scanner.com/AntvrsInstall.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O20 - Winlogon Notify: awttutQh - C:\WINNT\SYSTEM32\awttutQh.dll
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 9588 bytes
Hi
Just follow my previous instructions exactly and tell me if it was now successful :)
Desktop is not the only place, you can install it to any folder as long as it's not a temp folder.
Thanks so much for all of your help. I followed the instructions to the letter, and restarted in safe mode. I do have the HJTinstall.exe icon on my desktop, but it will not run from there-I keep getting the error message I mentioned previously.
I also cannot install it anywhere else. I get the same error message.
Hi
Thanks for the info.
Then we use this instead:
Download Deckard's System Scanner (DSS) (http://www.techsupportforum.com/sectools/Deckard/dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges.
Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post.
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-05-21 13:07:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Backed up registry hives.
Performed disk cleanup.
Percentage of Memory in Use: 94% (more than 75%).
Total Physical Memory: 128 MiB (256 MiB recommended).
-- HijackThis (run as Administrator.exe) ---------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:13:57 PM, on 5/21/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\WINNT\System32\svchost.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\svchost.exe
C:\PROGRA~1\TRENDM~1\Administrator.exe
C:\WINNT\system32\wuauclt.exe
O2 - BHO: DVA First - {1D33427A-2A9F-48DA-B4CC-819902B6A2C2} - C:\WINNT\qvlbodmnqse.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {CFC19E37-2C37-42BF-9DA6-71116F1A6E2C} - C:\WINNT\system32\awttutQh.dll
O2 - BHO: (no name) - {E10F13D1-3BE7-490E-A864-5FFFBA2C6CB0} - C:\WINNT\system32\ddcArQkL.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe work
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O20 - Winlogon Notify: awttutQh - C:\WINNT\SYSTEM32\awttutQh.dll
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 3409 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
All drivers whitelisted.
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2008-05-04 11:46:02 268 --a------ C:\WINNT\Tasks\Disk Cleanup.job
-- Files created between 2008-04-21 and 2008-05-21 -----------------------------
2008-05-21 11:17:17 396288 --a------ C:\WINNT\HijackThis.exe <HIJACK~1.EXE> <Not Verified; Trend Micro Inc.; HijackThis>
2008-05-19 16:27:19 0 d-------- C:\Program Files\Trend Micro
2008-05-19 16:12:33 614672 --a------ C:\WINNT\system32\mswstr10.dll <Not Verified; Microsoft Corporation; Microsoft (R) Jet>
2008-05-15 20:30:32 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_290.dat
2008-05-15 15:11:53 0 d--h----- C:\WINNT\PIF
2008-05-13 21:45:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-13 18:01:46 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_2d8.dat
2008-05-10 14:02:57 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_2e4.dat
2008-05-10 14:01:32 0 d-------- C:\Documents and Settings\Administrator\Application Data\Antivirus
2008-05-10 09:53:00 0 d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons
2008-05-10 09:13:38 804498 --ahs---- C:\WINNT\system32\LkQrAcdd.ini2
2008-05-10 09:10:05 277504 -----n--- C:\WINNT\system32\ddcArQkL.dll
2008-05-08 21:55:18 1 --a------ C:\WINNT\system32\kr_done1de
2008-05-08 21:54:58 44032 -----n--- C:\WINNT\system32\awttutQh.dll
2008-05-08 21:54:55 196608 --a------ C:\WINNT\tdomgafw.dll
2008-05-08 21:54:55 274432 --a------ C:\WINNT\qvlbodmnqse.dll
2008-05-08 21:54:55 90112 --a------ C:\WINNT\knxsrgte.exe
2008-04-24 21:41:40 0 d-------- C:\windows
-- Find3M Report ---------------------------------------------------------------
2008-05-21 09:58:00 0 d-------- C:\Program Files\Accessories
2008-05-10 13:09:16 6892 --a------ C:\Documents and Settings\Administrator\Application Data\update.log
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D33427A-2A9F-48DA-B4CC-819902B6A2C2}]
05/08/08 02:21p 274432 --a------ C:\WINNT\qvlbodmnqse.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CFC19E37-2C37-42BF-9DA6-71116F1A6E2C}]
05/08/08 09:54p 44032 --------- C:\WINNT\system32\awttutQh.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E10F13D1-3BE7-490E-A864-5FFFBA2C6CB0}]
05/10/08 09:10a 277504 --------- C:\WINNT\system32\ddcArQkL.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe" [11/30/99 06:40p C:\WINNT\system32\tp4mon.exe]
"Synchronization Manager"="mobsync.exe" [06/19/03 02:05p C:\WINNT\system32\mobsync.exe]
"6ce633bc"="C:\WINNT\system32\whnbucpy.dll" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InetChk"="C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe" []
"MalWarrior"="C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/08 11:43a]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 3:05:56 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{CFC19E37-2C37-42BF-9DA6-71116F1A6E2C}"= C:\WINNT\system32\awttutQh.dll [05/08/08 09:54p 44032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wetkadmr"= {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll [ ]
"tdomgafw"= {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll [05/08/08 02:20p 196608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awttutQh]
awttutQh.dll 05/08/08 09:54p 44032 C:\WINNT\system32\awttutQh.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINNT\system32\ddcArQkL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-05-21 13:15:15 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows 2000 Professional (build 2195) SP 4.0
Architecture: X86; Language: English
CPU 0: Intel Pentium III processor
Percentage of Memory in Use: 88%
Physical Memory (total/avail): 127.48 MiB / 14.6 MiB
Pagefile Memory (total/avail): 207.11 MiB / 51.7 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1947.21 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 6.04 GiB total, 4.7 GiB free.
D: is CDROM (No Media)
\\.\PHYSICALDRIVE0 - IBM-DADA-26480 - 6.04 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 6.04 GiB - C:
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Administrator\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=USER-0CEMP1TJ0U
ComSpec=C:\WINNT\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\
LOGONSERVER=\\USER-0CEMP1TJ0U
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Os2LibPath=C:\WINNT\system32\os2\dll;
Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SystemDrive=C:
SystemRoot=C:\WINNT
TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
USERDOMAIN=USER-0CEMP1TJ0U
USERNAME=Administrator
USERPROFILE=C:\Documents and Settings\Administrator
windir=C:\WINNT
-- User Profiles ---------------------------------------------------------------
Administrator [I](admin)
-- Add/Remove Programs ---------------------------------------------------------
Adobe Flash Player ActiveX --> C:\WINNT\System32\Macromed\Flash\uninstall_activeX.exe
Microsoft Office 2000 Professional --> MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Windows Media Player 7.1 --> C:\Program Files\Windows Media Player\setup_wm.exe /Uninstall
-- Application Event Log -------------------------------------------------------
Event Record #/Type311 / Error
Event Submitted/Written: 05/21/2008 00:39:55 PM
Event ID/Source: 2001 / rasctrs
Event Description:
Event Record #/Type310 / Error
Event Submitted/Written: 05/21/2008 00:39:51 PM
Event ID/Source: 1000 / PerfDisk
Event Description:
Unable to open the Disk performance object. Status code returned is
data DWORD 0.
Event Record #/Type309 / Error
Event Submitted/Written: 05/21/2008 00:16:18 PM
Event ID/Source: 2001 / rasctrs
Event Description:
Event Record #/Type308 / Error
Event Submitted/Written: 05/21/2008 00:16:13 PM
Event ID/Source: 1000 / PerfDisk
Event Description:
Unable to open the Disk performance object. Status code returned is
data DWORD 0.
Event Record #/Type307 / Error
Event Submitted/Written: 05/21/2008 11:59:10 AM
Event ID/Source: 2001 / rasctrs
Event Description:
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type1283 / Warning
Event Submitted/Written: 05/21/2008 01:06:27 PM
Event ID/Source: 20192 / RemoteAccess
Event Description:
A certificate could not be found. Connections that use the L2TP protocol over IPSec
require the installation of a machine certificate, also known as a computer
certificate. No L2TP calls will be accepted.
Event Record #/Type1282 / Warning
Event Submitted/Written: 05/21/2008 01:06:20 PM
Event ID/Source: 20169 / RemoteAccess
Event Description:
Unable to contact a DHCP server. The Automatic Private IP Address 169.254.16.95 will be
assigned to dial-in clients. Clients may be unable to access resources on
the network.
Event Record #/Type1281 / Warning
Event Submitted/Written: 05/21/2008 01:06:20 PM
Event ID/Source: 20169 / RemoteAccess
Event Description:
Unable to contact a DHCP server. The Automatic Private IP Address 169.254.48.199 will be
assigned to dial-in clients. Clients may be unable to access resources on
the network.
Event Record #/Type1276 / Error
Event Submitted/Written: 05/21/2008 01:02:50 PM
Event ID/Source: 10010 / DCOM
Event Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.
Event Record #/Type1272 / Error
Event Submitted/Written: 05/21/2008 00:59:06 PM
Event ID/Source: 7001 / Service Control Manager
Event Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
%%1077
-- End of Deckard's System Scanner: finished at 2008-05-21 13:15:15 ------------
Hi
We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
**Note: It is important that it is saved directly to your desktop**
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Post:
- a fresh HijackThis log (use HijackThis located here: C:\PROGRA~1\TRENDM~1\)
- combofix report
Hi
Below is a new HJT log. I ran Combofix twice, and neither time produced a log. The first error message read, " temp07, Combofix cannot find the specified file, Access is denied." The second error message just read, "access is denied." The window closed on its own both times without directing me to a log. I will try one more time--any suggestions?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:26, on 2008-05-22
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: DVA First - {1D33427A-2A9F-48DA-B4CC-819902B6A2C2} - C:\WINNT\qvlbodmnqse.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 3239 bytes
It appears to run fine, gets to the end, says "preparing log report. do not run any programs until combofix has finished." Then it reads, "Access is denied ," and the window closes. I will re-install and try one more time...it is saved to my desktop, and I followed all instructions.
Thanks again!
The system has rebooted each time. Last pop-up error message I get before combofix window closes reads, "RUNDLL/Eror loading c:\WINNT\system32\whnbucpy.dll. The specified module could not be found." After I click ok on this, the access denied message appears, and the window closes.
Hi
TeaTimer is still enabled. Please disable it as instructed next or it will make combofix run more difficult.
Check after that if this file exists: C:\ComboFix.txt.
If not, please run combofix next in safe mode :)
HI
I disabled tea timer, c:/combofix.txt is on my system but I still can not produce a combofix log, even in safe mode. I get the same "access denied" message. Following is latest HJT log. ANy ideas?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:09, on 2008-05-25
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: DVA First - {1D33427A-2A9F-48DA-B4CC-819902B6A2C2} - C:\WINNT\qvlbodmnqse.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 3064 bytes
Hi
Let's try this way:
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_FF.gif
http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_rename.gif
--------------------------------------------------------------------
Double click on Combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
I can't uninstall it. When I type Combofix /u, it pulls up the applcation and all associated files, with no uninstall option.
Hi
OK, then just skip that step and move on, please :)
I can't re-install Combofix. I am not getting an option to rename it; it appears o save it to my desktop, but it's just an icon and nothing more :sad:
Hi
OK, then we remove malware by other means.
For that I need a fresh dss log so please re-run dss and post back a fresh dss log :)
I was able to install combofix and rename it, it deleted additional files, but same end result. Here is new dss log:
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-05-26 02:42:15
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 128 MiB (256 MiB recommended).
-- HijackThis (run as Administrator.exe) ---------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:42, on 2008-05-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\DOCUME~1\ADMINI~1\Desktop\Administrator.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
--
End of file - 3153 bytes
-- Files created between 2008-04-26 and 2008-05-26 -----------------------------
2008-05-26 01:02:33 0 d-------- C:\Combo-Fix
2008-05-25 23:56:17 0 --a------ C:\WINNT\nsreg.dat
2008-05-25 23:56:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-05-22 10:07:46 53248 --a------ C:\WINNT\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-05-22 10:01:09 68096 --a------ C:\WINNT\zip.exe
2008-05-22 10:01:09 49152 --a------ C:\WINNT\VFind.exe
2008-05-22 10:01:09 212480 --a------ C:\WINNT\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-05-22 10:01:09 136704 --a------ C:\WINNT\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-05-22 10:01:09 161792 --a------ C:\WINNT\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-05-22 10:01:09 98816 --a------ C:\WINNT\sed.exe
2008-05-22 10:01:09 80412 --a------ C:\WINNT\grep.exe
2008-05-22 10:01:09 89504 --a------ C:\WINNT\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-05-22 09:15:55 1204514 ---h----- C:\WINNT\ShellIconCache
2008-05-21 11:17:17 396288 --a------ C:\WINNT\HijackThis.exe <HIJACK~1.EXE> <Not Verified; Trend Micro Inc.; HijackThis>
2008-05-19 16:27:19 0 d-------- C:\Program Files\Trend Micro
2008-05-19 16:12:33 614672 --a------ C:\WINNT\system32\mswstr10.dll <Not Verified; Microsoft Corporation; Microsoft (R) Jet>
2008-05-15 15:11:53 0 d--h----- C:\WINNT\PIF
2008-05-13 21:45:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 09:53:00 0 d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons
2008-05-08 21:55:18 1 --a------ C:\WINNT\system32\kr_done1de
2008-05-08 21:54:55 90112 --a------ C:\WINNT\knxsrgte.exe
-- Find3M Report ---------------------------------------------------------------
2008-05-21 09:58:00 0 d-------- C:\Program Files\Accessories
2008-05-10 13:09:16 6892 --a------ C:\Documents and Settings\Administrator\Application Data\update.log
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe" [99-11-30 18:40 C:\WINNT\system32\tp4mon.exe]
"Synchronization Manager"="mobsync.exe" [03-06-19 14:05 C:\WINNT\system32\mobsync.exe]
"6ce633bc"="C:\WINNT\system32\whnbucpy.dll" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalWarrior"="C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" []
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINNT\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wetkadmr"= {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll [ ]
"tdomgafw"= {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll [ ]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-05-26 02:43:09 ------------
Hi
Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
IMPORTANT: Do NOT run any other options until you are asked to do so!
**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.
Hi
No problems with the smitfraud fix. Following is that log and a new dss. Thanks!!!!
SmitFraudFix v2.323
Scan done at 21:24:14.00, Mon 2008-05-26
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Policies.exe
C:\WINNT\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINNT\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINNT\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-05-26 21:29:05
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 128 MiB (256 MiB recommended).
-- HijackThis (run as Administrator.exe) ---------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:29:32, on 2008-05-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Policies.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\DOCUME~1\ADMINI~1\Desktop\ADMINI~1.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
--
End of file - 3321 bytes
-- Files created between 2008-04-26 and 2008-05-26 -----------------------------
2008-05-26 21:24:19 1382 --a------ C:\WINNT\system32\tmp.reg
2008-05-26 21:23:45 25600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-05-26 21:23:45 289144 --a------ C:\WINNT\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-26 21:23:45 86528 --a------ C:\WINNT\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-26 21:23:45 288417 --a------ C:\WINNT\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-26 21:23:45 53248 --a------ C:\WINNT\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-05-26 21:23:45 82944 --a------ C:\WINNT\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-26 21:23:45 51200 --a------ C:\WINNT\system32\dumphive.exe
2008-05-26 21:23:45 82944 --a------ C:\WINNT\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-26 01:02:33 0 d-------- C:\Combo-Fix
2008-05-25 23:56:17 0 --a------ C:\WINNT\nsreg.dat
2008-05-25 23:56:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-05-22 10:07:46 53248 --a------ C:\WINNT\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-05-22 10:01:09 68096 --a------ C:\WINNT\zip.exe
2008-05-22 10:01:09 49152 --a------ C:\WINNT\VFind.exe
2008-05-22 10:01:09 212480 --a------ C:\WINNT\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-05-22 10:01:09 136704 --a------ C:\WINNT\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-05-22 10:01:09 161792 --a------ C:\WINNT\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-05-22 10:01:09 98816 --a------ C:\WINNT\sed.exe
2008-05-22 10:01:09 80412 --a------ C:\WINNT\grep.exe
2008-05-22 10:01:09 89504 --a------ C:\WINNT\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-05-22 09:15:55 1204514 ---h----- C:\WINNT\ShellIconCache
2008-05-21 11:17:17 396288 --a------ C:\WINNT\HijackThis.exe <HIJACK~1.EXE> <Not Verified; Trend Micro Inc.; HijackThis>
2008-05-19 16:27:19 0 d-------- C:\Program Files\Trend Micro
2008-05-19 16:12:33 614672 --a------ C:\WINNT\system32\mswstr10.dll <Not Verified; Microsoft Corporation; Microsoft (R) Jet>
2008-05-15 15:11:53 0 d--h----- C:\WINNT\PIF
2008-05-13 21:45:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 09:53:00 0 d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons
2008-05-08 21:55:18 1 --a------ C:\WINNT\system32\kr_done1de
2008-05-08 21:54:55 90112 --a------ C:\WINNT\knxsrgte.exe
-- Find3M Report ---------------------------------------------------------------
2008-05-21 09:58:00 0 d-------- C:\Program Files\Accessories
2008-05-10 13:09:16 6892 --a------ C:\Documents and Settings\Administrator\Application Data\update.log
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe" [99-11-30 18:40 C:\WINNT\system32\tp4mon.exe]
"Synchronization Manager"="mobsync.exe" [03-06-19 14:05 C:\WINNT\system32\mobsync.exe]
"6ce633bc"="C:\WINNT\system32\whnbucpy.dll" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalWarrior"="C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" []
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINNT\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wetkadmr"= {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll [ ]
"tdomgafw"= {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll [ ]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-05-26 21:30:20 ------------
Hi
OK, I looks that there are only leftovers which is good.
Open HijackThis, click do a system scan only and checkmark these:
O3 - Toolbar: mkrndofl - {4F6DD2F9-A353-484A-B35E-C4ED0211097F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\mkrndofl.dll (file missing)
O4 - HKLM\..\Run: [6ce633bc] rundll32.exe "C:\WINNT\system32\whnbucpy.dll",b
O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O21 - SSODL: wetkadmr - {686CD3DA-14C3-44F9-A3B5-97CDD73B06EA} - C:\WINNT\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {B66100BA-AA83-44C1-8586-D79BA1852430} - C:\WINNT\tdomgafw.dll (file missing)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
Close all windows including browser and press fix checked.
Reboot.
Delete these:
C:\WINNT\system32\kr_done1de
C:\WINNT\knxsrgte.exe
Empty Recycle Bin.
Re-run dss.
Post a fresh dss log.
HI
Looks better! Thanks so much for all your help...
Deckard's System Scanner v20071014.68
Run by Administrator on 2008-05-27 22:50:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 128 MiB (256 MiB recommended).
-- HijackThis (run as Administrator.exe) ---------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:55, on 2008-05-27
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\DOCUME~1\ADMINI~1\Desktop\ADMINI~1.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 2245 bytes
-- Files created between 2008-04-27 and 2008-05-27 -----------------------------
2008-05-26 21:24:19 1382 --a------ C:\WINNT\system32\tmp.reg
2008-05-26 21:23:45 25600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-05-26 21:23:45 289144 --a------ C:\WINNT\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-26 21:23:45 86528 --a------ C:\WINNT\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-26 21:23:45 288417 --a------ C:\WINNT\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-26 21:23:45 53248 --a------ C:\WINNT\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-05-26 21:23:45 82944 --a------ C:\WINNT\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-26 21:23:45 51200 --a------ C:\WINNT\system32\dumphive.exe
2008-05-26 21:23:45 82944 --a------ C:\WINNT\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-26 01:02:33 0 d-------- C:\Combo-Fix
2008-05-25 23:56:17 0 --a------ C:\WINNT\nsreg.dat
2008-05-25 23:56:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-05-22 10:07:46 53248 --a------ C:\WINNT\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-05-22 10:01:09 68096 --a------ C:\WINNT\zip.exe
2008-05-22 10:01:09 49152 --a------ C:\WINNT\VFind.exe
2008-05-22 10:01:09 212480 --a------ C:\WINNT\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-05-22 10:01:09 136704 --a------ C:\WINNT\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-05-22 10:01:09 161792 --a------ C:\WINNT\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-05-22 10:01:09 98816 --a------ C:\WINNT\sed.exe
2008-05-22 10:01:09 80412 --a------ C:\WINNT\grep.exe
2008-05-22 10:01:09 89504 --a------ C:\WINNT\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-05-22 09:15:55 1205012 ---h----- C:\WINNT\ShellIconCache
2008-05-21 11:17:17 396288 --a------ C:\WINNT\HijackThis.exe <HIJACK~1.EXE> <Not Verified; Trend Micro Inc.; HijackThis>
2008-05-19 16:27:19 0 d-------- C:\Program Files\Trend Micro
2008-05-19 16:12:33 614672 --a------ C:\WINNT\system32\mswstr10.dll <Not Verified; Microsoft Corporation; Microsoft (R) Jet>
2008-05-15 15:11:53 0 d--h----- C:\WINNT\PIF
2008-05-13 21:45:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 09:53:00 0 d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons
-- Find3M Report ---------------------------------------------------------------
2008-05-21 09:58:00 0 d-------- C:\Program Files\Accessories
2008-05-10 13:09:16 6892 --a------ C:\Documents and Settings\Administrator\Application Data\update.log
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe" [99-11-30 18:40 C:\WINNT\system32\tp4mon.exe]
"Synchronization Manager"="mobsync.exe" [03-06-19 14:05 C:\WINNT\system32\mobsync.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-05-27 22:51:28 ------------
Hi
Looking over your log, it seems you don't have any evidence of an anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:
1) Antivir PersonalEdition Classic (http://www.free-av.com/)- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition (http://www.avast.com/eng/avast_4_home.html) - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition (http://free.grisoft.com/ww.homepage) - Free edition of the AVG anti-virus program for Windows.
It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.
Post back a fresh HijackThis log :)
Hi
Following is HJT log....any cause for concern?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03:06, on 2008-05-28
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 2255 bytes
Hi
You didn't install any antivirus.
Please install one, post back a fresh HijackThis log and we'll continue after that :)
Actually, I did install Antivir..I just haven't re-booted. Why wouldn't it show up?
Hi
Well that is then a reason :)
Reboot and post back a fresh HijackThis log, please.
ok..here we go
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:34, on 2008-05-28
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 2803 bytes
Hi
Please do an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner). You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database:
+ Extended (If available otherwise Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
Click the Save Report As... button (see red arrow below)
http://img.photobucket.com/albums/v666/sUBs/Kas-SaveReport-1.gif
In the Save as... prompt, select Desktop
In the File name box, name the file KasScan-ddmmyy (or similar)
In the Save as type prompt, select Text file (see below)
http://img.photobucket.com/albums/v666/sUBs/Kas-Savetxt.gif
Now click on the Save as Text button
Savethe file to your desktop.
Copy and paste that information in your next post.
Note: This scanner will work with Internet Explorer Only! Keep ALL other programs closed during the scan
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
Post:
- a fresh HijackThis log
- kaspersky report
Hi
Following are both requested posts...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:45, on 2008-05-30
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\tp4mon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203851135588
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
--
End of file - 3055 bytes
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-05-30 13:32:34
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/05/2008
Kaspersky Anti-Virus database records: 813686
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
Scan Statistics:
Total number of scanned objects: 13883
Number of viruses found: 11
Number of infected objects: 18
Number of suspicious objects: 0
Duration of the scan process: 06:32:54
Infected Object Name / Virus Name / Last Action
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICD1.tmp\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ms1210301710.exe Infected: Trojan-Dropper.Win32.Agent.rky skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\printsrv32.exe Infected: Trojan.Win32.Agent.lsr skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\setup_526_1_.exe Infected: Trojan-Downloader.Win32.FraudLoad.ym skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vifmykoc.exe Infected: Trojan.Win32.Agent.gmn skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zhm14q9o.dat/stream/Script Infected: Trojan.Win32.Vapsup.epc skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zhm14q9o.dat/stream Infected: Trojan.Win32.Vapsup.epc skipped
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zhm14q9o.dat NSIS: infected - 2 skipped
C:\Deckard\System Scanner\20080526024213\backup\WINNT\Downloaded Program Files\antvrs.exe Infected: not-a-virus:FraudTool.Win32.AntiVirus2008.w skipped
C:\Deckard\System Scanner\20080526024213\backup\WINNT\Downloaded Program Files\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RAR: infected - 1 skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\QooBox\Quarantine\C\WINNT\qvlbodmnqse.dll.vir Infected: Trojan.Win32.Vapsup.eyk skipped
C:\QooBox\Quarantine\C\WINNT\system32\awttutQh.dll.vir Infected: Trojan.Win32.Monder.gen skipped
C:\QooBox\Quarantine\C\WINNT\system32\pimixscc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.trs skipped
C:\QooBox\Quarantine\C\WINNT\tdomgafw.dll.vir Infected: Trojan.Win32.Vapsup.eyk skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\Debug\ipsecpa.log Object is locked skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\Downloaded Program Files\CONFLICT.1\AntvrsInstall.exe Infected: not-a-virus:Downloader.Win32.FraudLoad.ar skipped
C:\WINNT\SoftwareDistribution\EventCache\{C9C74884-2B68-4225-9BD7-A6305815CD04}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\system32\CatRoot\SYSMAST.cbd Object is locked skipped
C:\WINNT\system32\CatRoot\SYSMAST.cbk Object is locked skipped
C:\WINNT\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATMAST.cbd Object is locked skipped
C:\WINNT\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATMAST.cbk Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped
C:\WINNT\Tasks\Disk Cleanup.job Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
Scan process completed.
Hi
Empty these folders:
C:\QooBox\Quarantine\
C:\Deckard\System Scanner\20080526024213\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
Delete these:
C:\Deckard\System Scanner\20080526024213\backup\WINNT\Downloaded Program Files\antvrs.exe
C:\Deckard\System Scanner\20080526024213\backup\WINNT\Downloaded Program Files\AntvrsInstall.exe
C:\WINNT\Downloaded Program Files\CONFLICT.1
Empty Recycle Bin.
Still problems?
Hi
I think it's running better...been afraid to try, really. I still have a "backups" file on my desk top that I didn't create and that appeared in the last week. May I post another Kaspersky scan?
Hi
That is HijackThis backup folder.
You can delete it a bit later.
Any other concerns?
:)Everything lokks much better!
Hi
Then you're clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Looking over your log, it seems you don't have any evidence of a third party firewall.
As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:
1) Comodo (http://www.personalfirewall.comodo.com/)
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
4) Agnitum (http://www.agnitum.com/products/outpostfree/download.php)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)
If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://bfccomputers.com/index.php?showtopic=1644)
Malwarebytes' Anti-Malware Scanning Guide (http://bfccomputers.com/index.php?showtopic=1645)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar (http://toolbar.google.com/) <= Get the free google toolbar to help stop pop up windows.
Comodo BOCLEAN (http://www.comodo.com/boclean/boclean.html) <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://castlecops.com/postlite7736-.html)
Happy surfing and stay clean! :bigthumb:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.