PDA

View Full Version : Popups, WinAntiVirusPro, unwanted desktop icons


NoPetrol
2006-09-10, 05:35
If I leave my computer on for half an hour, I will come back to about 20 popups. They include WinAntiVirusPro.


HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:21:36 PM, on 9/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Duce6.exe
C:\WINDOWS\sys015605023.exe
C:\WINDOWS\ms030502356.exe
C:\PROGRA~1\COMMON~1\fkfr\fkfrm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\SCURIT~1\mshta.exe
C:\WINDOWS\?ecurity\??rvices.exe
C:\PROGRA~1\COMMON~1\fkfr\fkfra.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R3 - URLSearchHook: (no name) - {DCAFCC86-0638-42D2-4708-5AF00CCA6B9F} - C:\WINDOWS\system32\ivif.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {72a564be-e845-413b-af23-586630700e67} - C:\WINDOWS\system32\cmdcom.dll
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsb97.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {DCAFCC86-0638-42D2-4708-5AF00CCA6B9F} - C:\WINDOWS\system32\ivif.dll
O2 - BHO: (no name) - {F3096934-F799-4B4E-97EF-734E965905A4} - \
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [sys015605023] C:\WINDOWS\sys015605023.exe
O4 - HKLM\..\Run: [ms030502356] C:\WINDOWS\ms030502356.exe
O4 - HKLM\..\Run: [adstart] "iexplore.exe" "http://iesettingsupdate"
O4 - HKLM\..\RunServices: [strtas] lo71.exe
O4 - HKCU\..\Run: [fkfr] C:\PROGRA~1\COMMON~1\fkfr\fkfrm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Tbsa] "C:\WINDOWS\system32\SCURIT~1\mshta.exe" -vt yazr
O4 - HKCU\..\Run: [Lfothnti] C:\WINDOWS\?ecurity\??rvices.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157748090765
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\MICHAE~1.KOS\LOCALS~1\Temp\winfix.chm::/SystemDoctor2006FreeInstall.cab
O20 - Winlogon Notify: cmdcom - C:\WINDOWS\SYSTEM32\cmdcom.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
NoPetrol
2006-09-10, 05:41
Activescan Log:


Incident Status Location

Adware:Adware/ActiveSearch Not disinfected C:\deskbar3.exe
Adware:Adware/DollarRevenue Not disinfected C:\dfndrff_15.exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@2o7[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@adrevolver[1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@ads.addynamix[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@ads.pointroll[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@adultfriendfinder[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@apmebf[2].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@as-eu.falkag[1].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@as-us.falkag[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@atwola[1].txt
Spyware:Cookie/nCase Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@banners.searchingbooth[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@belnk[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@bluestreak[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@burstnet[2].txt
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@c.enhance[1].txt
Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@c.goclick[2].txt
Spyware:Cookie/Casinotropez Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@casinotropez[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@com[1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@did-it[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@dist.belnk[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@drivecleaner[1].txt
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@findwhat[1].txt
NoPetrol
2006-09-10, 05:42
Activescan Log (continued):


Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@fortunecity[1].txt
Spyware:Cookie/Screensavers Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@i.screensavers[2].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@overture[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@perf.overture[1].txt
Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@qksrv[2].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@questionmarket[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@realmedia[1].txt
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@revenue[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@searchportal.information[2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@server.iad.liveperson[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@serving-sys[2].txt
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@stat.onestat[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@statcounter[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@stats.drivecleaner[2].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@stats1.reliablestats[1].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@target[1].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@tribalfusion[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@www.drivecleaner[1].txt
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@www.myaffiliateprogram[2].txt
Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@www48.seeq[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j. kossin@zedo[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Michael J. Kossin\Cookies\michael j[3].txt
Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\!update.exe
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\Cookies\michael j. kossin@ad.yieldmanager[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\Cookies\michael j. kossin@belnk[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\Cookies\michael j. kossin@com[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\Cookies\michael j. kossin@dist.belnk[1].txt
Spyware:Spyware/SurfSideKick Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\daB15.tmp
Spyware:Spyware/Media-motor Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\mmxsnet.exe
Spyware:Spyware/SurfSideKick Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\SskUpdater3.exe
Adware:Adware/Opensite Not disinfected C:\Documents and Settings\Michael J. Kossin\Local Settings\Temp\xload.exe
Please help me! Thank you.
LonnyRJones
2006-09-15, 17:03
Welcome NoPetrol

Unless you've posted elsewhere ? and are receiving help continue here
Post a combofix log
1. Download this file - combofix.exe
http://download.bleepingcomputer.com/sUBs/combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
If the log is large You might need to post half in one reply half in another.
NoPetrol
2006-09-16, 02:02
Thanks for your help, but I've decided to format my hard drive. Sorry to waste your time.
LonnyRJones
2006-09-16, 04:33
Thanks for letting us know