Vundo problems

piff133 · Dec 16, 2006

Google directed me here with a fix for Vundo. I followed the instructions in this thread and I now have a HijackThis log. Hopefully someone can help me sort through it and tell me how to fix the problem. I used code tags to hopefully make it easier to read.

Logfile of HijackThis v1.99.1
Scan saved at 5:53:48 PM, on 12/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Internet Security\ISSVC.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CreataCard\Plus\FMRemind.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...=Q305&bd=presario&pf=desktop&parm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...=Q305&bd=presario&pf=desktop&parm1=seconduser
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T...=Q305&bd=presario&pf=desktop&parm1=seconduser
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: CreataCard Plus 3 Forget Me Not Reminders Tray Icon.lnk = C:\Program Files\CreataCard\Plus\FMRemind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89A8F0E1-96B8-4230-88B5-0FA00DDC4268}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Any ounce of help is appreciated. I tried running VundoFix but that yeilded no results. I keep getting various WinSoftware ads and DriveCleaner ads. I'd hate to format over malware. Thanks in advance.

pskelley · Dec 18, 2006

Welcome to the forum, while you were reading you should have read all of that information, it is there for you. Especially this one:
"BEFORE you POST" -Preliminary Steps and scanning with SPYBOT-S&D
http://forums.spybot.info/showthread.php?t=288

I see some nasty stuff in the log: O4 - HKLM\..\RunServices: [csr] csrrs.exe looks to be:
http://www.symantec.com/security_response/writeup.jsp?docid=2003-093012-5903-99
review that information and I suggest you stay offline as much as possible until you are clean.

and I need to know what this is:
C:\WINDOWS\system32\rundll32.dll
Use one or more of these free online scans and post the information for me:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/flash/index_en.html

Your Java program is out of date, see this information:
http://forums.spybot.info/showpost.php?p=12880&postcount=2
Update to the newest version and uninstall all old versions in Add Remove programs.

Move HJT from the Desktop for safety. I prefer C:\HJT\HijackThis.exe, if you need additional instructions use these: http://russelltexas.com/malware/createhjtfolder.htm
I would like to know why you think this is the Vundo trojan? I don't see any evidence of it? Vundo is a prolific popup maker and usually directs to Winfixer (rouge product) so if you are receiving those symptoms while you are moving HJT, rename it to piff133.exe or whatever you like. The next HJT log may show the infection if it is there.

Follow the instruction above and post the information from the trojan scan, the results of the online antivirus scan as described in the
"BEFORE you POST" instructions and a new HJT log.

Thanks

pskelley · Dec 18, 2006

One of our experts who creates tools for us to use would like to look at the file on your computer. If you would follow these directions, it would be appreciated.

Please download the Suspicious file Packer from Safer-Networking.Org and unzip it to your desktop.

Run SFP.exe.

Please copy the following line into the Step 1: Paste Text window:

C:\Windows\System32\csrrs.exe
C:\Windows\csrrs.exe

then click "Continue".

This will create a .cab file on your desktop named requested-files[Date/Time].cab

Next please visit SpyKillers forum here

http://www.thespykiller.co.uk/forum/index.php?board=1.0

Read the instructions for uploading files which is the first topic on the forum then start a new Topic named 'Files From Spybot's Forum' , please then post a link to this thread and upload the requested files.cab archive from your desktop

piff133 · Dec 19, 2006

I'll run Spybot again (I ran it right after posting in a mental lapse). I've been having this problem for a while now, and I've been running Spybot since.

As for why I think it's Vundo, I get pop-ups that look like windows system messages that direct me to various Winsoftare sites, so I figured they were the same. I will move Hijackthis, run Spybot, and re-run Hijackthis and re-post my log. Thanks for the help so far.

piff133 · Dec 19, 2006

I didn't see a way to edit my last post, but here is a scan on C:\WINDOWS\system32\rundll32.dll at http://www.virustotal.com/flash/index_en.html

STATUS: FINISHEDComplete scanning result of "rundll32.dll", received in VirusTotal at 12.19.2006, 01:11:04 (CET).

Antivirus Version Update Result
AntiVir 7.3.0.19 12.18.2006 no virus found
Authentium 4.93.8 12.15.2006 no virus found
Avast 4.7.892.0 12.16.2006 no virus found
AVG 386 12.18.2006 no virus found
BitDefender 7.2 12.19.2006 no virus found
CAT-QuickHeal 8.00 12.18.2006 no virus found
ClamAV devel-20060426 12.19.2006 no virus found
DrWeb 4.33 12.18.2006 no virus found
eSafe 7.0.14.0 12.17.2006 no virus found
eTrust-InoculateIT 23.73.88 12.18.2006 no virus found
eTrust-Vet 30.3.3259 12.18.2006 no virus found
Ewido 4.0 12.18.2006 no virus found
Fortinet 2.82.0.0 12.18.2006 no virus found
F-Prot 3.16f 12.15.2006 no virus found
F-Prot4 4.2.1.29 12.18.2006 no virus found
Ikarus T3.1.0.27 12.18.2006 no virus found
Kaspersky 4.0.2.24 12.19.2006 no virus found
McAfee 4921 12.18.2006 no virus found
Microsoft 1.1804 12.19.2006 no virus found
NOD32v2 1926 12.18.2006 no virus found
Norman 5.80.02 12.18.2006 no virus found
Panda 9.0.0.4 12.18.2006 no virus found
Prevx1 V2 12.19.2006 no virus found
Sophos 4.12.0 12.18.2006 no virus found
Sunbelt 2.2.907.0 12.18.2006 no virus found
TheHacker 6.0.3.134 12.18.2006 no virus found
UNA 1.83 12.18.2006 no virus found
VBA32 3.11.1 12.18.2006 no virus found
VirusBuster 4.3.19:9 12.18.2006 no virus found

Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709

pskelley · Dec 19, 2006

Thanks for your cooperation. If you will do your best to follow the instructions, if it appears we have a problem that may be Vundo, we will tackle that when we come to it. If I need to view the results of Spybot, I will ask for that, but I do need to see the results of the antivirus scan, it may show infections HJT does not.

Thanks for the information about C:\WINDOWS\system32\rundll32.dll
Looks like it's valid, was hard for me to tell from here, here is the Google on it:
http://www.google.com/search?source...rls=GGLG,GGLG:2006-16,GGLG:en&q=rundll32.dll+

Thanks

piff133 · Dec 19, 2006

The virus scan seemed to have done a lot. This isn't my computer, it's my mom's, and I guess she isn't taking care of it like I recommended. I have to leave now, but I'll post stuff when I get back. Thanks again.

piff133 · Dec 19, 2006

The problem seems to have gone away. The computer has been running online for about five hours now without a problem. Do you want me to continue with the process anyway?

pskelley · Dec 19, 2006

Let's make sure Mom's computer is clean, post the result of that virus scan I requested and a new HJT log and I will have a look.

Follow the instruction above and post the information from the trojan scan, the results of the online antivirus scan as described in the
"BEFORE you POST" instructions and a new HJT log.

Thanks

piff133 · Dec 19, 2006

Here is the log. Sorry I'm taking so long. I've been busy lately. I'm beginning to detest Christmas because of all the running around I have to do.

It turns out that the log is too long. Can I e-mail it to you? PM me with your e-mail address if yes. If no, then I'll split it up and post it.

pskelley · Dec 19, 2006

If you are talking about the antivirus scan log, edit out any cookies and make sure you delete the cookies on the computer if that is what the problem is. Then break the scan report and a new HJT log into as many pieces as need to get it posted. Describe any malware issues that are still occuring.

Thanks

piff133 · Dec 22, 2006

Sorry about the delay. Hopefuly the log fits this time. I know that it ran a lot faster the second time around.

Code:

Incident                                                                        Status                        Location                                                                                                                                                                                                                                                        

Adware:adware/dollarrevenue                                                     Not disinfected               c:\windows\keyboard1.dat                                                                                                                                                                                                                                        
Adware:adware/commad                                                            Not disinfected               Windows Registry                                                                                                                                                                                                                                                
Potentially unwanted tool:application/zango                                     Not disinfected               HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{99410cde-6f16-42ce-9d49-3807f78f0287}                                                                                                                                            
Adware:adware/searchexe                                                         Not disinfected               Windows Registry                                                                                                                                                                                                                                                
Spyware:Cookie/RealMedia                                                        Not disinfected               C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\x6l1wql4.default\cookies.txt[.realmedia.com/]                                                                                                                                  
Spyware:Cookie/Traffic Marketplace                                              Not disinfected               C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\x6l1wql4.default\cookies.txt[.trafficmp.com/]                                                                                                                                  
Spyware:Cookie/YieldManager                                                     Not disinfected               C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\x6l1wql4.default\cookies.txt[ad.yieldmanager.com/]                                                                                                                             
Spyware:Cookie/PointRoll                                                        Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@ads.pointroll[2].txt                                                                                                                                                                                
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@as-eu.falkag[2].txt                                                                                                                                                                                 
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@as-us.falkag[2].txt                                                                                                                                                                                 
Spyware:Cookie/Atwola                                                           Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@atwola[1].txt                                                                                                                                                                                       
Spyware:Cookie/nCase                                                            Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@banners.searchingbooth[1].txt                                                                                                                                                                       
Spyware:Cookie/Go                                                               Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@go[2].txt                                                                                                                                                                                           
Spyware:Cookie/WUpd                                                             Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@revenue[2].txt                                                                                                                                                                                      
Spyware:Cookie/Searchportal                                                     Not disinfected               C:\Documents and Settings\Compaq_Owner\Cookies\compaq_owner@searchportal.information[2].txt                                                                                                                                                                     
Adware:Adware/PurityScan                                                        Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\!update.exe                                                                                                                                                                                          
Spyware:Cookie/2o7                                                              Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@2o7[2].txt                                                                                                                                                                      
Spyware:Cookie/YieldManager                                                     Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@ad.yieldmanager[1].txt                                                                                                                                                          
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@adrevolver[1].txt                                                                                                                                                               
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@adrevolver[3].txt                                                                                                                                                               
Spyware:Cookie/PointRoll                                                        Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@ads.pointroll[2].txt                                                                                                                                                            
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@as-eu.falkag[2].txt                                                                                                                                                             
Spyware:Cookie/Atwola                                                           Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@atwola[1].txt                                                                                                                                                                   
Spyware:Cookie/BurstNet                                                         Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@burstnet[1].txt                                                                                                                                                                 
Spyware:Cookie/Com.com                                                          Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@com[2].txt                                                                                                                                                                      
Spyware:Cookie/Maxserving                                                       Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@maxserving[1].txt                                                                                                                                                               
Spyware:Cookie/Overture                                                         Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@overture[1].txt                                                                                                                                                                 
Spyware:Cookie/QuestionMarket                                                   Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@questionmarket[1].txt                                                                                                                                                           
Spyware:Cookie/Statcounter                                                      Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@statcounter[1].txt                                                                                                                                                              
Spyware:Cookie/Traffic Marketplace                                              Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@trafficmp[2].txt                                                                                                                                                                
Spyware:Cookie/Tribalfusion                                                     Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@tribalfusion[1].txt                                                                                                                                                             
Spyware:Cookie/BurstBeacon                                                      Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@www.burstbeacon[2].txt                                                                                                                                                          
Spyware:Cookie/Zedo                                                             Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\Cookies\compaq_owner@zedo[1].txt                                                                                                                                                                     
Spyware:Spyware/Conducent-Timesink                                              Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\temp.fr2F78\AdGateway\TSAdBot.exe                                                                                                                                                                    
Adware:Adware/PurityScan                                                        Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\temp.fr4C09                                                                                                                                                                                          
Adware:Adware/Gmter                                                             Not disinfected               C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\CW0AK4IP\popup[1].htm                                                                                                                                                
Spyware:Cookie/Hbmediapro                                                       Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.adopt.hbmediapro.com/]                                                                                                                                 
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.adrevolver.com/]                                                                                                                                       
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.as-us.falkag.net/]                                                                                                                                     
Spyware:Cookie/BurstNet                                                         Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.burstnet.com/]                                                                                                                                         
Spyware:Cookie/WUpd                                                             Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.revenue.net/]

piff133 · Dec 22, 2006

Part 2 (this is of the PandaScan log):

Code:

Spyware:Cookie/Traffic Marketplace                                              Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.trafficmp.com/]                                                                                                                                        
Spyware:Cookie/Tribalfusion                                                     Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.tribalfusion.com/]                                                                                                                                     
Spyware:Cookie/Zedo                                                             Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[.zedo.com/]                                                                                                                                             
Spyware:Cookie/YieldManager                                                     Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[ad.yieldmanager.com/]                                                                                                                                   
Spyware:Cookie/BurstBeacon                                                      Not disinfected               C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\g8owct1m.default\cookies.txt[www.burstbeacon.com/]                                                                                                                                   
Spyware:Cookie/2o7                                                              Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@2o7[2].txt                                                                                                                                                                                                      
Spyware:Cookie/888                                                              Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@888[2].txt                                                                                                                                                                                                      
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@a.as-us.falkag[1].txt                                                                                                                                                                                           
Spyware:Cookie/Hbmediapro                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adopt.hbmediapro[2].txt                                                                                                                                                                                         
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adrevolver[2].txt                                                                                                                                                                                               
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adrevolver[3].txt                                                                                                                                                                                               
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adrevolver[4].txt                                                                                                                                                                                               
Spyware:Cookie/AdDynamix                                                        Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@ads.addynamix[2].txt                                                                                                                                                                                            
Spyware:Cookie/PointRoll                                                        Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@ads.pointroll[1].txt                                                                                                                                                                                            
Spyware:Cookie/Adtech                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adtech[2].txt                                                                                                                                                                                                   
Spyware:Cookie/adultfriendfinder                                                Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@adultfriendfinder[2].txt                                                                                                                                                                                        
Spyware:Cookie/Apmebf                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@apmebf[2].txt                                                                                                                                                                                                   
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@as-eu.falkag[1].txt                                                                                                                                                                                             
Spyware:Cookie/Falkag                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@as-us.falkag[2].txt                                                                                                                                                                                             
Spyware:Cookie/Atwola                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@atwola[1].txt                                                                                                                                                                                                   
Spyware:Cookie/Azjmp                                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@azjmp[2].txt                                                                                                                                                                                                    
Spyware:Cookie/nCase                                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@banners.searchingbooth[1].txt                                                                                                                                                                                   
Spyware:Cookie/Belnk                                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@belnk[1].txt                                                                                                                                                                                                    
Spyware:Cookie/Bluestreak                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@bluestreak[2].txt                                                                                                                                                                                               
Spyware:Cookie/bravenetA                                                        Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@bravenet[1].txt                                                                                                                                                                                                 
Spyware:Cookie/BurstNet                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@burstnet[1].txt                                                                                                                                                                                                 
Spyware:Cookie/Enhance                                                          Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@c.enhance[1].txt                                                                                                                                                                                                
Spyware:Cookie/Zedo                                                             Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@c5.zedo[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Cassava                                                          Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@cassava[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Cgi-bin                                                          Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@cgi-bin[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Com.com                                                          Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@com[1].txt                                                                                                                                                                                                      
Spyware:Cookie/DelfinMedia                                                      Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@delfinproject[2].txt

piff133 · Dec 22, 2006

Part 3. I do want you to know that I deleted cookies and temp files just before running the scan.

Code:

Spyware:Cookie/did-it                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@did-it[1].txt                                                                                                                                                                                                   
Spyware:Cookie/Belnk                                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@dist.belnk[2].txt                                                                                                                                                                                               
Spyware:Cookie/DriveCleaner                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@drivecleaner[2].txt                                                                                                                                                                                             
Spyware:Cookie/Findwhat                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@findwhat[1].txt                                                                                                                                                                                                 
Spyware:Cookie/FortuneCity                                                      Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@fortunecity[2].txt                                                                                                                                                                                              
Spyware:Cookie/Go                                                               Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@go[2].txt                                                                                                                                                                                                       
Spyware:Cookie/Humanclick                                                       Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@hc2.humanclick[1].txt                                                                                                                                                                                           
Spyware:Cookie/Screensavers                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@i.screensavers[2].txt                                                                                                                                                                                           
Spyware:Cookie/Overture                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@overture[1].txt                                                                                                                                                                                                 
Spyware:Cookie/Overture                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@perf.overture[1].txt                                                                                                                                                                                            
Spyware:Cookie/QkSrv                                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@qksrv[2].txt                                                                                                                                                                                                    
Spyware:Cookie/QuestionMarket                                                   Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@questionmarket[1].txt                                                                                                                                                                                           
Spyware:Cookie/RealMedia                                                        Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@realmedia[1].txt                                                                                                                                                                                                
Spyware:Cookie/WUpd                                                             Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@revenue[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Searchportal                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@searchportal.information[2].txt                                                                                                                                                                                 
Spyware:Cookie/Server.iad.Liveperson                                            Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@server.iad.liveperson[2].txt                                                                                                                                                                                    
Spyware:Cookie/SpyLog                                                           Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@spylog[2].txt                                                                                                                                                                                                   
Spyware:Cookie/Statcounter                                                      Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@statcounter[1].txt                                                                                                                                                                                              
Spyware:Cookie/DriveCleaner                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@stats.drivecleaner[2].txt                                                                                                                                                                                       
Spyware:Cookie/Reliablestats                                                    Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@stats1.reliablestats[1].txt                                                                                                                                                                                     
Spyware:Cookie/Toplist                                                          Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@toplist[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Tradedoubler                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@tradedoubler[1].txt                                                                                                                                                                                             
Spyware:Cookie/Traffic Marketplace                                              Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@trafficmp[2].txt                                                                                                                                                                                                
Spyware:Cookie/Tribalfusion                                                     Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@tribalfusion[2].txt                                                                                                                                                                                             
Spyware:Cookie/WebPower                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@webpower[2].txt                                                                                                                                                                                                 
Spyware:Cookie/BurstBeacon                                                      Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@www.burstbeacon[2].txt                                                                                                                                                                                          
Spyware:Cookie/myaffiliateprogram                                               Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@www.myaffiliateprogram[2].txt                                                                                                                                                                                   
Spyware:Cookie/Seeq                                                             Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@www48.seeq[1].txt                                                                                                                                                                                               
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@xiti[1].txt                                                                                                                                                                                                     
Spyware:Cookie/Adserver                                                         Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@z1.adserver[1].txt                                                                                                                                                                                              
Spyware:Cookie/Zedo                                                             Not disinfected               C:\Documents and Settings\Justin\Cookies\justin@zedo[1].txt                                                                                                                                                                                                     
Adware:Adware/Gmter                                                             Not disinfected               C:\Documents and Settings\Justin\Local Settings\Temporary Internet Files\Content.IE5\MQYQ5QLZ\popup[1].htm                                                                                                                                                      
Potentially unwanted tool:Application/DriveCleaner                              Not disinfected               C:\Documents and Settings\Justin\Local Settings\Temporary Internet Files\Content.IE5\OL8VG7SZ\installdrivecleanerstart[1].cab[UDC6_0001_D19M1908NetInstaller.exe]                                                                                               
Adware:Adware/Trymedia                                                          Not disinfected               C:\Downloads\AntWar_Setup-dm[1].exe                                                                                                                                                                                                                             
Potentially unwanted tool:Application/KillApp.B                                 Not disinfected               C:\hp\bin\KillIt.exe                                                                                                                                                                                                                                            
Possible Virus.                                                                 Not disinfected               C:\Program Files\MultiplayUNO\dtzip.dll                                                                                                                                                                                                                         
Adware:Adware/PurityScan                                                        Not disinfected               C:\Program Files\?icrosoft.NET\alg.exe

piff133 · Dec 22, 2006

HTJ log:

Code:

Logfile of HijackThis v1.99.1
Scan saved at 11:06:52 PM, on 12/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Internet Security\ISSVC.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CreataCard\Plus\FMRemind.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation 
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [pas_check] C:\Program Files\SystemDoctor 2006 Free\pasmon.exe
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Egmqsel] C:\DOCUME~1\COMPAQ~1\MYDOCU~1\PPPATC~1\OOLSV~1.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CreataCard Plus 3 Forget Me Not Reminders Tray Icon.lnk = C:\Program Files\CreataCard\Plus\FMRemind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89A8F0E1-96B8-4230-88B5-0FA00DDC4268}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:  C:\WINDOWS\system32\rundll32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

piff133 · Dec 22, 2006

I don't know if you do this as a volunteer or if you get paid, so if you work for free, you deserve a paycheck, and if you get paid, you deserve a raise for just dealing with me, and even more for being so helpful.

pskelley · Dec 22, 2006

What you could do is reread this information:
"BEFORE you POST" -Preliminary Steps
http://forums.spybot.info/showthread.php?t=288

All logs should be copy/pasted into topic and not attached unless requested by helper in that format.
Thank you for your understanding.

Please do not quote or code your information, post it using copy/paste as instructed. It is harder for me work with, thanks.
________________________________________________

I am having a difficult time looking at the PandaScan log with all of the cookies, you said:

Part 3. I do want you to know that I deleted cookies and temp files just before running the scan.

I will post information about how to delete cookies, look where these are and who they belong to:
C:\Documents and Settings\Justin\Cookies\justin@bluestreak[2].txt
C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\]Profiles\g8owct1m.default\cookies.txt[.trafficmp.com/]

C:\Documents and Settings\Compaq\Temp\Cookies\compaq_owner@2o7[2].txt

http://www.personal-computer-tutor.com/deletingtempfiles.htm
http://safecomputing.umn.edu/guides/tempdirectories.html

* Clean your Cache and Cookies in IE:

Close all instances of Outlook Express and Internet Explorer
Go to Control Panel > Internet Options > General tab
Click the "Delete Cookies" button
Next to it, Click the "Delete Files" button
When prompted, place a check in: "Delete all offline content", click OK

* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):

Go to Tools > Options.
Click Privacy in the menu on the left side of the Options window.
Click the Clear button located to the right of each option (History, Cookies, Cache).
Click OK to close the Options window
Alternatively, you can clear all information stored while browsing by clicking Clear All.
A confirmation dialog box will be shown before clearing the information.

* Clean other Temporary files + Recycle bin

Go to start > run and type: cleanmgr and click ok.
Let it scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
Press OK to remove them.

_____________________________________________________

Here is information that will help you control these cookies:
http://www.mvps.org/winhelp2002/cookies.htm
http://www.microsoft.com/windows/ie/using/howto/privacy/config.mspx
Firefox: may vary in Firefox 2.0
http://privacy.getnetwise.org/browsing/tools/firefox1/ffdisablecookies
http://www.mozilla.org/projects/security/pki/psm/help_21/using_priv_help.html

_______________________________________________________

1) Second time I have posted this information?
Your Java program is out of date, see this information:
http://forums.spybot.info/showpost.p...80&postcount=2
Update to the newest version and uninstall all old versions in Add Remove programs.

2) http://www.bleepingcomputer.com/forums/topic58656.html <<< see this information, you have a rouge product and may need that information to remove it?
We will see what happens with the rest of the fix and the next HJT log?

3) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

4) Please download ATF Cleaner by Atribune
http://www.atribune.org/content/view/25/2/
Save it to your Desktop. We will use this later.

5) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
(Google toolbar is damaged with the (file missing) Download it again when we are finished if you use it)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [pas_check] C:\Program Files\SystemDoctor 2006 Free\pasmon.exe
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O4 - HKCU\..\Run: [Egmqsel] C:\DOCUME~1\COMPAQ~1\MYDOCU~1\PPPATC~1\OOLSV~1.EXE
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe

Close all programs but HJT and all browser windows, then click on "Fix Checked"

RIGHT Click on Start then click on Explore. Locate and delete these items:

csrrs.exe <<< search for that files and delete it if there. That is a trojan worm!!!

C:\Program Files\SystemDoctor 2006 Free\ <<< delete that folder

C:\DOCUMENTS & SETTINGS~1\COMPAQ~1\MYDOCUMENYS~1\PPPATC~1\ <<< delete that folder

Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post a new HJT log using the copy and paste method.
Thanks

Vundo problems

piff133

New member

pskelley

In Memoriam -Always in our heart

pskelley

In Memoriam -Always in our heart

piff133

New member

piff133

New member

pskelley

In Memoriam -Always in our heart

piff133

New member

piff133

New member

pskelley

In Memoriam -Always in our heart

piff133

New member

pskelley

In Memoriam -Always in our heart

piff133

New member

piff133

New member

piff133

New member

piff133

New member

piff133

New member

pskelley

In Memoriam -Always in our heart