View Full Version : please help i got 134 infections
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 18, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, July 18, 2008 00:29:48
Records in database: 966622
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
Scan statistics:
Files scanned: 43432
Threat name: 23
Infected objects: 134
Suspicious objects: 0
Duration of the scan: 14:05:43
File name / Threat name / Threats count
C:\WINDOWS\system32\wvUlMDvs.dll/C:\WINDOWS\system32\wvUlMDvs.dll Infected: Trojan.Win32.Pakes.den 1
C:\WINDOWS\system32\awtTkhgD.dll/C:\WINDOWS\system32\awtTkhgD.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\cgfosvnf.dll/C:\WINDOWS\system32\cgfosvnf.dll Infected: Trojan.Win32.Monderc.gen 11
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\RAR Password cracker v4.12\rpc412_setup.exe Infected: Trojan.Win32.Monder.ahw 1
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Local Settings\Temporary Internet Files\Content.IE5\9K8MAIBY\css4[1] Infected: Trojan.Win32.Monderc.gen 1
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Local Settings\Temporary Internet Files\Content.IE5\9K8MAIBY\css4[2] Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at 1
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l 1
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af 1
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a 1
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an 1
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq 1
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh 1
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax 1
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as 1
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad 1
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i 1
C:\Program Files\Norton AntiVirus\Quarantine\031272AC Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\054A7C3B Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\17C33076.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\1B417E86.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\1CBC48B0 Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\1D2D25F6 Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\1F2467CD Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\2073632B Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\216C434A.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\259370F5 Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\264B278C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\264F5189.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\271652AD.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\275008C0.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\27EA7BC4.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\28B2575F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\28F03C5C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bkm 1
C:\Program Files\Norton AntiVirus\Quarantine\2A1A2018.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\30E153BC.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\3FEB1290.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\4669739B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\46D00C7F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\55056740.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\567C00AB.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\58EF4B8A Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\5AF9094B Infected: not-a-virus:AdWare.Win32.Virtumonde.aps 1
C:\Program Files\Norton AntiVirus\Quarantine\60A16BBB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60A415B8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60A83FB4.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60F9595A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\615246F9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\61D4566A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\61D70066.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62022237.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62054C34.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62306E05.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62331801.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\627E5DAF.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62EA4738.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6304171B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\636358B3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\636602B0.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6386268C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\638A5088.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\63C11A4B.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\64302DD1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\64727589.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\64B9113A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\651528D5.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\651852D2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\653F4AA7.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65704071.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65746A6D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65771469.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65CC580C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\660D1FC4.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\661049C1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\661473BD.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\66171DB9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\672D27C7.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\68B5546C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\6B1975BD.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6EB01C01.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\73CF3583.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\WINDOWS\system32\awtTkhgD.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\bveyoicw.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\cgfosvnf.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\diliyrxx.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\fhsacofw.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\fktwiklg.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\hbgusuqc.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\hecmvwxt.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\jfpsrylh.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\jlxyjooq.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\jsmeuomk.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\ladxxxej.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\liacevko.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\mfxsoqop.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\nnyogdou.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\nqpwtcre.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\ntsgtxus.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\odplkvwf.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\otpkru.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\qkqlnyyj.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\qumrkldt.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\quqvnttw.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\rvmdlcnp.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\rxpxrbuk.dll Infected: Trojan.Win32.Obfuscated.auw 1
C:\WINDOWS\system32\urcrvi.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\vkcsgurj.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\wkyrzw.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\wvUlMDvs.dll Infected: Trojan.Win32.Pakes.den 1
C:\WINDOWS\system32\yjyktnkj.dll Infected: Trojan.Win32.Obfuscated.auw 1
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:23 PM, on 7/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: (no name) - {0282CB01-A158-49C7-A988-A878D8730425} - C:\WINDOWS\system32\rqRJDuUK.dll (file missing)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {1334FC65-653E-4CE3-B01C-681C90809873} - C:\WINDOWS\system32\ssqQGxWq.dll (file missing)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {500DBD6E-6D95-4106-B9A2-DDDCCB2B30D1} - C:\WINDOWS\system32\wvUlMDvs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7B31466A-F4B8-45B7-B87C-F3225FBC92B1} - C:\WINDOWS\system32\awtTkhgD.dll
O2 - BHO: {9be9eefd-f1aa-b999-6224-52b98aa28dd8} - {8dd82aa8-9b25-4226-999b-aa1fdfee9eb9} - C:\WINDOWS\system32\znfxce.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [643a5099] rundll32.exe "C:\WINDOWS\system32\cgfosvnf.dll",b
O4 - HKLM\..\Run: [BM67096305] Rundll32.exe "C:\WINDOWS\system32\gvwptpfd.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingB4816] command /c del "C:\WINDOWS\system32\wvUlMDvs.dll" (User 'Administrator')
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingD8615] cmd /c del "C:\WINDOWS\system32\wvUlMDvs.dll" (User 'Administrator')
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingB2363] command /c del "C:\WINDOWS\system32\ssqQGxWq.dll_old" (User 'Administrator')
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingD5647] cmd /c del "C:\WINDOWS\system32\ssqQGxWq.dll_old" (User 'Administrator')
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingB636] command /c del "C:\WINDOWS\system32\wvUlMDvs.dll" (User 'Administrator')
O4 - HKUS\S-1-5-21-484763869-1123561945-1801674531-500\..\RunOnce: [SpybotDeletingD2314] cmd /c del "C:\WINDOWS\system32\wvUlMDvs.dll" (User 'Administrator')
O8 - Extra context menu item: &Search - ?p=ZRxdm694YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: wvUlMDvs - C:\WINDOWS\SYSTEM32\wvUlMDvs.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9836 bytes
Hi lex200
We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
**Note: It is important that it is saved directly to your desktop**
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Post:
- a fresh HijackThis log
- combofix report
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix 08-07-20.A0 - Adz 2008-07-21 22:32:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.55 [GMT 1:00]
Running from: C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\ScreenSaver\Cache\007D6B2D
C:\Program Files\FunWebProducts\ScreenSaver\Cache\files.ini
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Cache\0009BB74
C:\Program Files\MyWebSearch\bar\Cache\000A830A
C:\Program Files\MyWebSearch\bar\Cache\006DE3C6.bin
C:\Program Files\MyWebSearch\bar\Cache\006DF133.bin
C:\Program Files\MyWebSearch\bar\Cache\006DF25C.bin
C:\Program Files\MyWebSearch\bar\Cache\006DFEC0.bin
C:\Program Files\MyWebSearch\bar\Cache\006E0095.bin
C:\Program Files\MyWebSearch\bar\Cache\007C5A98
C:\Program Files\MyWebSearch\bar\Cache\007C5ECE.bin
C:\Program Files\MyWebSearch\bar\Cache\007C84C5.bin
C:\Program Files\MyWebSearch\bar\Cache\007C9743.bin
C:\Program Files\MyWebSearch\bar\Cache\007C981E.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Message\COMMON\ask_logo.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\center.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\mid_dots.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\mws_logo.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\protect.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\shocked.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\stop.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\systray.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\systrayp.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\tp_grad.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\warn.gif
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\WINDOWS\BM67096305.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awyfkkqp.ini
C:\WINDOWS\system32\bpjpbvjp.ini
C:\WINDOWS\system32\bveyoicw.dll
C:\WINDOWS\system32\covinolp.dll
C:\WINDOWS\system32\ctvfysej.ini
C:\WINDOWS\system32\DghkTtwa.ini
C:\WINDOWS\system32\DghkTtwa.ini2
C:\WINDOWS\system32\dgxeyqfh.dll
C:\WINDOWS\system32\digthfsu.ini
C:\WINDOWS\system32\diliyrxx.dll
C:\WINDOWS\system32\duvryiwr.dll
C:\WINDOWS\system32\dxplsxgc.dll
C:\WINDOWS\system32\emkecfao.dll
C:\WINDOWS\system32\fhobme.dll
C:\WINDOWS\system32\fhsacofw.dll
C:\WINDOWS\system32\fnvsofgc.ini
C:\WINDOWS\system32\glrkxhtf.ini
C:\WINDOWS\system32\hbgusuqc.dll
C:\WINDOWS\system32\hecmvwxt.dll
C:\WINDOWS\system32\hmhnlmnn.ini
C:\WINDOWS\system32\inlgpuem.dll
C:\WINDOWS\system32\jesyfvtc.dll
C:\WINDOWS\system32\jlxyjooq.dll
C:\WINDOWS\system32\jsmeuomk.dll
C:\WINDOWS\system32\KkSDeMoq.ini
C:\WINDOWS\system32\KkSDeMoq.ini2
C:\WINDOWS\system32\kpcetwhg.dll
C:\WINDOWS\system32\KUuDJRqr.ini
C:\WINDOWS\system32\KUuDJRqr.ini2
C:\WINDOWS\system32\ladxxxej.dll
C:\WINDOWS\system32\liacevko.dll
C:\WINDOWS\system32\lxgfppfx.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mgfqwblo.dll
C:\WINDOWS\system32\mqqkyw.dll
C:\WINDOWS\system32\ncfbubkc.dll
C:\WINDOWS\system32\nnyogdou.dll
C:\WINDOWS\system32\nqpwtcre.dll
C:\WINDOWS\system32\ntsgtxus.dll
C:\WINDOWS\system32\oabggmfr.ini
C:\WINDOWS\system32\odplkvwf.dll
C:\WINDOWS\system32\oqgjfgaj.dll
C:\WINDOWS\system32\ovenhijf.dll
C:\WINDOWS\system32\pjvbpjpb.dll
C:\WINDOWS\system32\plcliw.dll
C:\WINDOWS\system32\qjkooqjm.dll
C:\WINDOWS\system32\qkqlnyyj.dll
C:\WINDOWS\system32\qumrkldt.dll
C:\WINDOWS\system32\quqvnttw.dll
C:\WINDOWS\system32\qWxGQqss.ini
C:\WINDOWS\system32\qWxGQqss.ini2
C:\WINDOWS\system32\rgpmpeai.ini
C:\WINDOWS\system32\rvmdlcnp.dll
C:\WINDOWS\system32\rxpxrbuk.dll
C:\WINDOWS\system32\sgtghdxm.ini
C:\WINDOWS\system32\sjfmaquq.ini
C:\WINDOWS\system32\tdeovfjp.ini
C:\WINDOWS\system32\ttgxhjlf.dll
C:\WINDOWS\system32\ufdqgrkw.ini
C:\WINDOWS\system32\urcrvi.dll
C:\WINDOWS\system32\vbchondq.ini
C:\WINDOWS\system32\wvUlMDvs.dll
C:\WINDOWS\system32\yewsfdnf.dll
C:\WINDOWS\system32\yjyktnkj.dll
C:\WINDOWS\system32\ysnbsg.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 )))))))))))))))))))))))))))))))
.
2008-07-21 17:50 . 2008-07-21 17:50 245,760 --a------ C:\WINDOWS\system32\qoMeDSkK.dll
2008-07-18 15:57 . 2008-07-18 15:57 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-17 22:32 . 2008-07-17 22:32 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-17 22:30 . 2004-08-03 23:14 52,736 --a------ C:\WINDOWS\system32\drivers\i8042prt.sys
2008-07-17 21:34 . 2008-07-18 00:24 784 --a------ C:\WINDOWS\wininit.ini
2008-07-17 20:04 . 2008-07-17 20:05 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-17 20:04 . 2008-07-17 20:14 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-07-07 12:02 . 2008-07-08 21:05 774 --ahs---- C:\WINDOWS\system32\bftdaosn.ini
2008-07-05 22:44 . 2008-07-07 11:55 534 --ahs---- C:\WINDOWS\system32\bfvaoddc.ini
2008-07-04 16:31 . 2008-07-05 22:38 414 --ahs---- C:\WINDOWS\system32\ohqfkuhv.ini
2008-07-03 16:28 . 2008-07-04 16:29 1,778 --ahs---- C:\WINDOWS\system32\roruqakt.ini
2008-07-01 22:29 . 2008-07-03 16:21 1,598 --ahs---- C:\WINDOWS\system32\ehrsyctq.ini
2008-06-30 20:37 . 2008-06-30 20:37 1,713,582 --ahs---- C:\WINDOWS\system32\nypsnlcf.ini
2008-06-29 01:19 . 2008-07-21 17:46 110,419 --a------ C:\WINDOWS\BM67096305.xml
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-21 19:29 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-07-21 19:07 --------- d-----w C:\Program Files\Java
2008-07-21 19:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-17 18:51 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\U3
2008-07-13 20:17 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\uTorrent
2008-07-09 21:37 --------- d-----w C:\Program Files\LimeWire
2008-07-07 15:02 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\SiteAdvisor
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 09:10 --------- d-----w C:\Program Files\Symantec
2008-05-31 09:09 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 09:09 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 09:09 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-23 19:38 --------- d-----w C:\Program Files\SiteAdvisor
2008-05-23 19:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SiteAdvisor
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2D107C6-DFD0-4122-8E45-226899FFA602}]
2008-07-21 17:50 245760 --a------ C:\WINDOWS\system32\qoMeDSkK.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 11:00 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 22:39 136768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 22:03 36640]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12 2658304]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-17 23:36]
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 14:28]
*Newly Created Service* - COMHOST
.
- - - - ORPHANS REMOVED - - - -
BHO-{0282CB01-A158-49C7-A988-A878D8730425} - C:\WINDOWS\system32\rqRJDuUK.dll
BHO-{1334FC65-653E-4CE3-B01C-681C90809873} - C:\WINDOWS\system32\ssqQGxWq.dll
BHO-{48FB0FD4-1DE9-4810-BB25-529473E8853C} - C:\WINDOWS\system32\awtTkhgD.dll
HKLM-Run-643a5099 - C:\WINDOWS\system32\pjvbpjpb.dll
HKLM-Run-BM67096305 - C:\WINDOWS\system32\ovenhijf.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.co.uk/
R0 -: HKCU-Main,SearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRxdm694YYGB&fl=0&ptb=6UC12vZE24_rnTGfnfWmNg&url=http://www.uk.ask.com/web&q={searchTerms}&l=zr&o=sb
O8 -: &Search - ?p=ZRxdm694YYGB
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:54:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\McAfee\Common Framework\Mctray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
.
**************************************************************************
.
Completion time: 2008-07-21 23:05:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-21 22:05:47
Pre-Run: 71,488,942,080 bytes free
Post-Run: 71,378,137,088 bytes free
293 --- E O F --- 2008-06-21 16:27:33
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:41 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B2D107C6-DFD0-4122-8E45-226899FFA602} - C:\WINDOWS\system32\qoMeDSkK.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O8 - Extra context menu item: &Search - ?p=ZRxdm694YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7595 bytes
Hi
Much better :)
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\system32\qoMeDSkK.dll
C:\WINDOWS\system32\bftdaosn.ini
C:\WINDOWS\system32\bfvaoddc.ini
C:\WINDOWS\system32\ohqfkuhv.ini
C:\WINDOWS\system32\roruqakt.ini
C:\WINDOWS\system32\ehrsyctq.ini
C:\WINDOWS\system32\nypsnlcf.ini
C:\WINDOWS\BM67096305.xml
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2D107C6-DFD0-4122-8E45-226899FFA602}]
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
hi
do u think i need the recovery console installed if yes could you help me with that please.
the logs you asked for:
ComboFix 08-07-20.A0 - Adz 2008-07-22 22:36:44.2 - NTFSx86
Running from: C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\BM67096305.xml
C:\WINDOWS\system32\bftdaosn.ini
C:\WINDOWS\system32\bfvaoddc.ini
C:\WINDOWS\system32\ehrsyctq.ini
C:\WINDOWS\system32\nypsnlcf.ini
C:\WINDOWS\system32\ohqfkuhv.ini
C:\WINDOWS\system32\qoMeDSkK.dll
C:\WINDOWS\system32\roruqakt.ini
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM67096305.xml
C:\WINDOWS\system32\bftdaosn.ini
C:\WINDOWS\system32\bfvaoddc.ini
C:\WINDOWS\system32\ehrsyctq.ini
C:\WINDOWS\system32\nypsnlcf.ini
C:\WINDOWS\system32\ohqfkuhv.ini
C:\WINDOWS\system32\qoMeDSkK.dll
C:\WINDOWS\system32\roruqakt.ini
.
((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.
2008-07-18 15:57 . 2008-07-18 15:57 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-17 22:32 . 2008-07-17 22:32 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-17 22:30 . 2004-08-03 23:14 52,736 --a------ C:\WINDOWS\system32\drivers\i8042prt.sys
2008-07-17 21:34 . 2008-07-18 00:24 784 --a------ C:\WINDOWS\wininit.ini
2008-07-17 20:04 . 2008-07-17 20:05 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-17 20:04 . 2008-07-17 20:14 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 18:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-07-21 19:07 --------- d-----w C:\Program Files\Java
2008-07-21 19:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-17 18:51 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\U3
2008-07-13 20:17 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\uTorrent
2008-07-09 21:37 --------- d-----w C:\Program Files\LimeWire
2008-07-07 15:02 --------- d-----w C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Application Data\SiteAdvisor
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 09:10 --------- d-----w C:\Program Files\Symantec
2008-05-31 09:09 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 09:09 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-31 09:09 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 09:09 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-23 19:38 --------- d-----w C:\Program Files\SiteAdvisor
2008-05-23 19:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SiteAdvisor
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 11:00 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 22:39 136768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 22:03 36640]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12 2658304]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-17 23:36]
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 14:28]
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 22:40:24
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-22 22:45:15
ComboFix-quarantined-files.txt 2008-07-22 21:44:52
ComboFix2.txt 2008-07-21 22:06:05
Pre-Run: 73,362,100,224 bytes free
Post-Run: 73,356,300,288 bytes free
113 --- E O F --- 2008-06-21 16:27:33
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:24 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O8 - Extra context menu item: &Search - ?p=ZRxdm694YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7445 bytes
Hi
No need :)
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
hi
thanks for your help the pc is running great, much beta than before. could you tell me how i can stop this kind of thing happening in the future.
the logs:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, July 24, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, July 23, 2008 17:53:13
Records in database: 998522
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
Scan statistics:
Files scanned: 45228
Threat name: 26
Infected objects: 128
Suspicious objects: 0
Duration of the scan: 13:59:31
File name / Threat name / Threats count
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\RAR Password cracker v4.12\rpc412_setup.exe Infected: Trojan.Win32.Monder.ahw 1
C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\Program Files\Norton AntiVirus\Quarantine\031272AC Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\054A7C3B Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\17C33076.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\1B417E86.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\1CBC48B0 Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\1D2D25F6 Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\1F2467CD Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\2073632B Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\216C434A.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\259370F5 Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\264B278C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\264F5189.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\271652AD.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\275008C0.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\27EA7BC4.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\28B2575F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\28F03C5C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bkm 1
C:\Program Files\Norton AntiVirus\Quarantine\2A1A2018.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\30E153BC.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\3FEB1290.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\4669739B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\46D00C7F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\55056740.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\567C00AB.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\58EF4B8A Infected: Trojan-Downloader.Win32.ConHook.hl 1
C:\Program Files\Norton AntiVirus\Quarantine\5AF9094B Infected: not-a-virus:AdWare.Win32.Virtumonde.aps 1
C:\Program Files\Norton AntiVirus\Quarantine\60A16BBB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60A415B8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60A83FB4.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\60F9595A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\615246F9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\61D4566A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\61D70066.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62022237.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62054C34.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62306E05.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62331801.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\627E5DAF.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\62EA4738.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6304171B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\636358B3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\636602B0.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6386268C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\638A5088.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\63C11A4B.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\64302DD1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\64727589.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\64B9113A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\651528D5.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\651852D2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\653F4AA7.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65704071.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65746A6D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65771469.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\65CC580C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\660D1FC4.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\661049C1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\661473BD.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\66171DB9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\672D27C7.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\68B5546C.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton AntiVirus\Quarantine\6B1975BD.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\6EB01C01.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\Program Files\Norton AntiVirus\Quarantine\73CF3583.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.at 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.l 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.af 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.a 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.an 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.as 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.i 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bveyoicw.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\covinolp.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.cbd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dgxeyqfh.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\diliyrxx.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\duvryiwr.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\dxplsxgc.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.cbd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\emkecfao.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fhobme.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fhsacofw.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hbgusuqc.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hecmvwxt.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\inlgpuem.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jesyfvtc.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jlxyjooq.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jsmeuomk.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\kpcetwhg.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.cbd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ladxxxej.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\liacevko.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mgfqwblo.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ncfbubkc.dll.vir Infected: Trojan.Win32.Pakes.jwb 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nnyogdou.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\nqpwtcre.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ntsgtxus.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\odplkvwf.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\oqgjfgaj.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ovenhijf.dll.vir Infected: Trojan.Win32.Pakes.jwb 1
C:\QooBox\Quarantine\C\WINDOWS\system32\pjvbpjpb.dll.vir Infected: Trojan.Win32.Pakes.jwa 1
C:\QooBox\Quarantine\C\WINDOWS\system32\plcliw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qjkooqjm.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qkqlnyyj.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qumrkldt.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\quqvnttw.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rvmdlcnp.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rxpxrbuk.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\urcrvi.dll.vir Infected: Trojan.Win32.Monderc.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wvUlMDvs.dll.vir Infected: Trojan.Win32.Pakes.den 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yewsfdnf.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
C:\QooBox\Quarantine\C\WINDOWS\system32\yjyktnkj.dll.vir Infected: Trojan.Win32.Obfuscated.auw 1
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:51 PM, on 7/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O8 - Extra context menu item: &Search - ?p=ZRxdm694YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7565 bytes
Hi
Reason why you got infected is right here:
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\RAR Password cracker v4.12\rpc412_setup.exe Infected: Trojan.Win32.Monder.ahw 1
So watch what you download:
Empty these folders:
C:\Program Files\Norton AntiVirus\Quarantine\
C:\QooBox\Quarantine
Delete these:
C:\Documents and Settings\Adz.ADZ-5B47B3FE482\Desktop\RAR Password cracker v4.12
C:\Program Files\MSN Messenger\msimg32.dll
C:\Program Files\MSN Messenger\riched20.dll
Empty Recycle Bin.
Still problems?
hi
i have deleted everything you have said but the
C:/qoobox/quarantine folder.
it will not allow me to delete the contents of this folder
a message cames up saying:
cannot delete urcrvi.dll.vir: cannot find the specified file. make sure you specify the correct path and file name.
also my norton 360 has had 10 virus attacks from trojan vundo.
Hi
"
i have deleted everything you have said but the
C:/qoobox/quarantine folder.
it will not allow me to delete the contents of this folder
a message cames up saying:
cannot delete urcrvi.dll.vir: cannot find the specified file. make sure you specify the correct path and file name."
Please empty then it in safe mode :)
"also my norton 360 has had 10 virus attacks from trojan vundo. "
Can you give any details?
i was able to delete the folder without going into safe mode.
also i am unable to give more details on the virus attacks
Hi
No worries, that folder will get deleted during final cleanup anyway :)
When have those attacks happened?
hi
the attacks happened when i tried to delete the qoobox file every time i clicked on it
Hi
Ah, so they are normal as qoobox contains backups from bad files which combofix deleted.
Other issues left?
hi
i wud js like to say thank you again, i dnt think that they are any other issues.
Then you're clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1644)
Malwarebytes' Anti-Malware Scanning Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1645)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://castlecops.com/postlite7736-.html)
Happy surfing and stay clean! :bigthumb:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.