View Full Version : Making sure I'm clear
I contracted virtumonde (like everybody else here), but I believe I have cleared it. After restarting, spybody does not detect it. After unsuccesful steps, and research, I took these steps:
-combofix
-deleted several files combofix found that were recently created and were posted as malicious on forums (I can give details if requested)
-ran spybot (clear)
-ran AVG virus scanner (clear)
-reboot again, run spybot (still clear)
I've posted my HJT log below. Please let me know if it sounds like I'm all clear. I'm nervous!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:38:54 AM, on 6/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG7\avgamsvr.exe
C:\PROGRA~1\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\rpcnet.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG7\avgcc.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\hijackthis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {9F8C0D5D-333B-402A-9036-74FF2BBF977D} - C:\WINDOWS\system32\efcBuvUk.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CE60C15D-4E86-4204-8E23-C46B66A81254} - C:\WINDOWS\system32\opnonnKA.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe
--
End of file - 6146 bytes
pskelley
2008-06-20, 21:17
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.
C:\PROGRA~1\AVG7\ <<< unless you are running a version of Grisoft's AVG I am not aware of, in which case you should make me aware before doing anything, this version is out of date as of 5/31/2008. If this is the free version, you can update to AVG 8 free here:
http://free.grisoft.com/ww.download-avg-anti-virus-free-edition
If you run the free version, careful to stay with it and avoid trials, etc.
Once you have it downloaded, installed and updated, run a complete system scan. Save the report and post it here so I can have a look. I suggest you quarantine (virus vault) what it finds for a week or two to make sure the new program removed nothing it should not have.
Post also a new HJT log at that time, there is a little debris to remove.
Thanks
I installed AVG8. 7 was still supported, so I did have up to date virus libraries. The AVG log is pretty empty:
"Scan ""Scan whole computer"" was finished."
"Infections found:;""0"""
"Infected objects removed or healed;""0"""
"Not removed or healed.;""0"""
"Spyware found:;""0"""
"Spyware removed:;""0"""
"Not removed:;""0"""
"Warnings count:;""0"""
"Information count:;""0"""
"Scan started:;""Friday, June 20, 2008, 3:43:58 PM"""
"Total object scanned:;""713058"""
"Time needed:;""2 hour(s) 19 minute(s) 36 second(s) """
"Errors encountered:;""0"""
Warnings
"File;""Infection"";""Result"""
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0EDC6C20-A31C-11DB-8AB9-0800200C9A66};""Found Adware.RogueSuspect"";""Moved to Virus Vault"""
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3AAC4C68-AFC8-11DB-80EF-8AF955D89593};""Found Adware.RogueSuspect"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@247realmedia[1].txt:\247realmedia.com.855b46d;""Found Tracking cookie.247realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@247realmedia[1].txt;""Found Tracking cookie.247realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.1a1b1110;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.e5501fdb;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.282ff3c0;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.3c7d847a;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.ba00a41a;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.484dbb69;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.cc0fa545;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.1a6a6c0d;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.8fadee39;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.7078103f;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.31fc71e6;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.1d3c9edc;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.84ac890f;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.f57f2f12;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.30fddb9f;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt:\2o7.net.924c1ef3;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@2o7[1].txt;""Found Tracking cookie.2o7"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt:\adopt.euroclick.com.891542da;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt:\adopt.euroclick.com.ffe11db7;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt:\adopt.euroclick.com.6d7740f7;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt:\adopt.euroclick.com.17044b51;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt:\adopt.euroclick.com.8b1bd7bc;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@adopt.euroclick[1].txt;""Found Tracking cookie.Euroclick"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.203aa218;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.525a5fb9;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.b624fa46;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.f62113d5;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.1820df7a;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.38fed9d8;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.31a19bfc;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt:\advertising.com.e70a1678;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@advertising[2].txt;""Found Tracking cookie.Advertising"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@atdmt[2].txt:\atdmt.com.b3e33b5f;""Found Tracking cookie.Atdmt"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@atdmt[2].txt;""Found Tracking cookie.Atdmt"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@bs.serving-sys[1].txt:\bs.serving-sys.com.5bf1f00f;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@bs.serving-sys[1].txt;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@m.webtrends[2].txt:\m.webtrends.com.b4ca7df0;""Found Tracking cookie.Webtrends"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@m.webtrends[2].txt;""Found Tracking cookie.Webtrends"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@perf.overture[1].txt:\perf.overture.com.610ef18d;""Found Tracking cookie.Overture"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@perf.overture[1].txt;""Found Tracking cookie.Overture"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@questionmarket[1].txt:\questionmarket.com.3eb5a9f1;""Found Tracking cookie.Questionmarket"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@questionmarket[1].txt:\questionmarket.com.4dd5e426;""Found Tracking cookie.Questionmarket"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@questionmarket[1].txt;""Found Tracking cookie.Questionmarket"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@realmedia[2].txt:\realmedia.com.68087763;""Found Tracking cookie.Realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@realmedia[2].txt:\realmedia.com.ef906bac;""Found Tracking cookie.Realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@realmedia[2].txt:\realmedia.com.125a868c;""Found Tracking cookie.Realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@realmedia[2].txt:\realmedia.com.e14be39e;""Found Tracking cookie.Realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@realmedia[2].txt;""Found Tracking cookie.Realmedia"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt:\revsci.net.44927ec;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt:\revsci.net.ca709b7a;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt:\revsci.net.6215368c;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt:\revsci.net.e9dbeb91;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt:\revsci.net.2df99d79;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@revsci[1].txt;""Found Tracking cookie.Revsci"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.c9034af6;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.606c3d3b;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.4b416ef8;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.255d6f2f;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.6a1cf9e8;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt:\serving-sys.com.400f83f;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@serving-sys[1].txt;""Found Tracking cookie.Serving-sys"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.c4fe2ebb;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.d323296e;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.5935e89;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.27341d57;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.e9f57f8;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.a3218a37;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.ed9c50d1;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt:\tacoda.net.cd7ce44f;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tacoda[2].txt;""Found Tracking cookie.Tacoda"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt:\trafficmp.com.e2e71e33;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt:\trafficmp.com.37644bdb;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt:\trafficmp.com.ae53b8b;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt:\trafficmp.com.a00e30b4;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt:\trafficmp.com.f3e5803e;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@trafficmp[1].txt;""Found Tracking cookie.Trafficmp"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tribalfusion[2].txt:\tribalfusion.com.dcc03271;""Found Tracking cookie.Tribalfusion"";""Moved to Virus Vault"""
"C:\Documents and Settings\Daniel Reeves\Cookies\daniel_reeves@tribalfusion[2].txt;""Found Tracking cookie.Tribalfusion"";""Moved to Virus Vault"""
And here's the HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:39:46 PM, on 6/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\rpcnet.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\hijackthis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {9F8C0D5D-333B-402A-9036-74FF2BBF977D} - C:\WINDOWS\system32\efcBuvUk.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {CE60C15D-4E86-4204-8E23-C46B66A81254} - C:\WINDOWS\system32\opnonnKA.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe
--
End of file - 6168 bytes
Thanks!
pskelley
2008-06-23, 03:12
1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.
2) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
O2 - BHO: (no name) - {9F8C0D5D-333B-402A-9036-74FF2BBF977D} - C:\WINDOWS\system32\efcBuvUk.dll (file missing)
O2 - BHO: (no name) - {CE60C15D-4E86-4204-8E23-C46B66A81254} - C:\WINDOWS\system32\opnonnKA.dll (file missing)
Close all programs but HJT and all browser windows, then click on "Fix Checked"
3) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.
4) Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe
* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.
Are you having any malware issues at all?
Thanks
So, I'm not having any issues anymore, at all. Are you sure I should bother continuing with all these steps? I could remove those two objects via HJT, but I can assume I"m clear of virtuomonde, right? It doesn't lurk and hide out after SpyBot and everybody doesn't find it anymore, right?
thanks for all your help!
pskelley
2008-06-23, 12:28
That is totally up to you, I am trying to be sure you are clean of some rather nasty adware, and these are steps I use to do this. If you have no wish to continue, I will wish you safe surfing.
Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx
Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml
http://www.malwarecomplaints.info/
Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.
Okay, thanks for being thorough. I took a look at some of those links, pretty informative. Here're the two logs.
Malwarebytes' Anti-Malware 1.18
Database version: 882
9:42:10 AM 6/23/2008
mbam-log-6-23-2008 (09-42-10).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 205212
Time elapsed: 1 hour(s), 13 minute(s), 1 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 11
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\QooBox\Quarantine\C\WINDOWS\system32\urqNHYOF.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vrjjmlbx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\yspjnvyd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP59\A0012057.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP59\A0012073.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP59\A0012074.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP59\A0012146.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP59\A0012165.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP60\A0012201.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C3B4580B-3416-4BC0-9D70-FB0C1BBAFBDC}\RP60\A0012202.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:46:43 AM, on 6/23/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\rpcnet.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\hijackthis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe
--
End of file - 5846 bytes
pskelley
2008-06-23, 17:37
C:\QooBox\Quarantine\ <<< that is where combofix put the junk it removes, delete it from your computer. Delete combofix also unless you have already done do.
The rest are infected System Restore files which are protected and MBAM might think it can move them but it cannot. Clean System Restore like this:
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot
Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
Your HJT log looks fine.
Thanks
Thanks for helping me get the last remnants! You've been very helpful.