Page 1 of 2 12 LastLast
Results 1 to 10 of 19

Thread: Help - Smitfraud wont go away

  1. 2008-01-03, 09:49 #1
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default Help - Smitfraud wont go away

    I've tried to follow some instructions iv'e been given, like running Spybot S&D while in safe mode but that hasn't worked.

    HJT log
    --

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 12:37:03 AM, on 1/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Bernard\Desktop\HiJackThis_v2.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: LiveSearchClubToolbarBhoApp Class - {3D266504-0FBC-4d3f-9E7C-4077A77C7DC4} - C:\Program

    Files\Live Search Club Toolbar\LiveSearchClubToolbarBho.dll
    O2 - BHO: (no name) - {45C3A61C-67DD-4E77-A749-1AE33997FF95} - C:\WINDOWS\system32\ddyiac.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

    Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {EDEF7D46-B4E3-4888-9214-ACE7357D825B} - C:\Program

    Files\MSN\hokemoz24418.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: Live Search Club Toolbar - {719D74AB-1AF9-43a1-8C62-D8750628D93E} - C:\Program

    Files\Live Search Club Toolbar\Toolbar.dll
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe"

    silentrun
    O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and

    Settings\Bernard\Application Data\cin.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Policies\Explorer\Run: [{B8B493E5-0BBE-1033-0218-050202050001}] "C:\Program

    Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe" mc-110-12-0000140
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL

    SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK

    SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default

    user')
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel -

    res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and

    Settings\Bernard\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network

    Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program

    Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -

    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} -

    C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon -

    {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

    Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile

    Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -

    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -

    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program

    Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 6693 bytes
  2. 2008-01-03, 17:23 #2
    pskelley
    pskelley is offline
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
    "BEFORE you POST" (READ this Procedure before Requesting Assistance)
    http://forums.spybot.info/showthread.php?t=288
    All advice given is taken at your own risk.
    Please make sure you have read this information so we are on the same page.

    Start by reading the directions, which are posted above and pinned to the top of this forum, then post the correct HJT log, version 2.0.2 with "Word Wrap" turned off as instructed and the Kaspersky scan results that is required, and I will be glad to take a look.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006
  3. 2008-01-06, 00:50 #3
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    Sorry about that.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:44:55 PM, on 1/5/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: LiveSearchClubToolbarBhoApp Class - {3D266504-0FBC-4d3f-9E7C-4077A77C7DC4} - C:\Program Files\Live Search Club Toolbar\LiveSearchClubToolbarBho.dll
    O2 - BHO: (no name) - {45C3A61C-67DD-4E77-A749-1AE33997FF95} - C:\WINDOWS\system32\ddyiac.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {EDEF7D46-B4E3-4888-9214-ACE7357D825B} - C:\Program Files\MSN\hokemoz24418.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: Live Search Club Toolbar - {719D74AB-1AF9-43a1-8C62-D8750628D93E} - C:\Program Files\Live Search Club Toolbar\Toolbar.dll
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Bernard\Application Data\cin.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{B8B493E5-0BBE-1033-0218-050202050001}] "C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe" mc-110-12-0000140
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bernard\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 5718 bytes
  4. 2008-01-06, 00:51 #4
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Saturday, January 05, 2008 1:17:54 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 5/01/2008
    Kaspersky Anti-Virus database records: 502797
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 112820
    Number of viruses found: 14
    Number of infected objects: 30
    Number of suspicious objects: 0
    Duration of the scan process: 02:42:26

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip/install.exe Infected: Trojan-Dropper.Win32.Agent.bfr skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Bernard\Application Data\acccore\nss\cert8.db Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\acccore\nss\key3.db Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\history.dat Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\key3.db Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Bernard\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\AOL OCP\AIM\Storage\data\paremelo\localStorage\common.cls Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Application Data\Mozilla\Firefox\Profiles\27thu17q.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Temp\b143.exe Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Temp\b151.exe Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Bernard\Local Settings\Temporary Internet Files\Content.IE5\QHGDM581\149[1].net Infected: Trojan-Dropper.Win32.Agent.ctu skipped
    C:\Documents and Settings\Bernard\Local Settings\Temporary Internet Files\Content.IE5\QHGDM581\2900229[1].htm Object is locked skipped
    C:\Documents and Settings\Bernard\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Bernard\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Warren\Local Settings\Temp\198170_4064_2044_228_63.41.tmp1 Infected: Trojan.Win32.EliteBar.a skipped
    C:\Documents and Settings\Warren\Local Settings\Temp\458954_2924_676_2944_63.41.tmp1 Infected: Trojan.Win32.EliteBar.a skipped
    C:\Program Files\Common Files\sеcurity\cmd.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
    C:\Program Files\Common Files\{B8B493E5-0BBF-1033-0218-050202050001}\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
    C:\Program Files\Common Files\{B8B493E5-0BBF-1033-0218-050202050001}\Update.exe Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
    C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP798\A0254091.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP798\A0254091.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP798\A0254091.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP798\A0254091.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP798\A0254091.exe NSIS: infected - 4 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP831\A0255645.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP831\A0255647.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP832\A0255717.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP832\A0255717.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP832\A0255717.exe RarSFX: infected - 2 skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP832\A0255723.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP833\A0255779.dll Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP837\A0256004.dll Infected: not-a-virus:AdWare.Win32.AdBand.e skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP837\A0256007.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP837\A0256011.exe Infected: not-a-virus:AdWare.Win32.Agent.vu skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0256025.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0256027.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0256029.bat Infected: Trojan.BAT.DelFiles.be skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0257139.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0257140.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP838\A0257141.sys Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP846\A0258346.exe Object is locked skipped
    C:\System Volume Information\_restore{CCEB12D6-04B7-47CF-9986-65894874A813}\RP846\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{B498A7C0-ED23-4EF3-B13F-0800200E3C2B}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\ddyiac.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
    C:\WINDOWS\system32\drivers\core.sys Object is locked skipped
    C:\WINDOWS\system32\eqnp3res.exe Infected: Packed.Win32.NSAnti.r skipped
    C:\WINDOWS\system32\ggg.bat Infected: Trojan.BAT.DelFiles.be skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\install.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
    C:\WINDOWS\system32\jdkfjdskfjkdsjf.bat Infected: Trojan.BAT.DelFiles.be skipped
    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
  5. 2008-01-06, 01:10 #5
    pskelley
    pskelley is offline
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Thanks for returning your information, you have a real collections of nasty junk. Start with this:

    http://forums.spybot.info/showpost.p...80&postcount=2
    C:\Program Files\Java\jre1.5.0_04\ <<< Java is out of date and likely the reason you are infected. Download the newest version and then uninstall all old versions in Add Remove programs.

    If you have either of these tools, delete them and download then new from the links I provide. Read and follow the directions carefully, the tools will not work if you don't.

    1) Thanks to Atribune and any others who helped with this fix.

    http://vundofix.atribune.org/ <<< tutorial

    "Download VundoFix" to your Desktop

    http://www.atribune.org/ccount/click.php?id=4

    Double-click VundoFix.exe to run it.
    When VundoFix opens, click the Scan for Vundo button.
    Once it's done scanning, click the Remove Vundo button.
    You will receive a prompt asking if you want to remove the files, click YES
    Once you click yes, your desktop will go blank as it starts removing Vundo.
    When completed, it will prompt that it will reboot your computer, click OK.
    Note: It is possible that VundoFix encountered a file it could not remove.
    In this case, VundoFix will attempt run on reboot, simply follow the above instructions starting from "Click
    the Scan for Vundo button." when VundoFix appears at reboot. Vundofix.txt will be on the C:\
    (wait until you finish to post reports and logs)

    2) Thanks to sUBs and anyone else who helped with this fix.

    Download ComboFix from Here or Here to your Desktop
    • Double click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Post the Vundofix.txt, combofix log and a new HJT log.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006
  6. 2008-01-06, 04:06 #6
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    VundoFix V6.7.7

    Checking Java version...

    Java version is 1.5.0.3
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.4
    Old versions of java are exploitable and should be removed.

    Scan started at 4:57:16 PM 1/5/2008

    Listing files found while scanning....

    No infected files were found.


    Beginning removal...

    VundoFix V6.7.7

    Checking Java version...

    Java version is 1.5.0.3
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.4
    Old versions of java are exploitable and should be removed.

    Scan started at 5:45:30 PM 1/5/2008

    Listing files found while scanning....

    No infected files were found.


    Beginning removal...
  7. 2008-01-06, 04:07 #7
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    ComboFix 08-01-04.1 - Bernard 2008-01-05 18:10:47.1 - NTFSx86
    Running from: C:\Documents and Settings\Bernard\Desktop\ComboFix(2).exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\Common Files\{38B49~1
    C:\Program Files\Common Files\{B8B49~1
    C:\Program Files\Common Files\{B8B49~1\system.dll
    C:\Program Files\Common Files\{B8B49~1\Update.exe
    C:\Program Files\Common Files\{B8B49~2
    C:\Program Files\Common Files\{B8B49~2\system.dll
    C:\Program Files\Common Files\{B8B49~2\Update.exe
    C:\Program Files\Common Files\scurit~1
    C:\Program Files\Common Files\scurit~1\cmd.exe
    C:\Program Files\Common Files\smbols~1
    C:\Program Files\Common Files\smbols~1\s?mbols\
    C:\Program Files\Insider
    C:\Program Files\Insider\Insider.exe
    C:\Program Files\Insider\UnInstall.exe
    C:\Program Files\winupdates
    C:\Program Files\winupdates\a.zip
    C:\temp\tn3
    C:\WINDOWS\system32\bszip.dll
    C:\WINDOWS\system32\cmd.com
    C:\WINDOWS\system32\install.exe
    C:\WINDOWS\system32\ping.com
    C:\WINDOWS\system32\tasklist.com
    C:\WINDOWS\system32\tracert.com
    C:\WINDOWS\system32\winnb58.dll
    C:\WINDOWS\system32\wintisv32.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_COM+_MESSAGES
    -------\LEGACY_CORE
    -------\core


    ((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
    .

    2008-01-05 18:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-05 16:57 . 2008-01-05 16:57 <DIR> d-------- C:\VundoFix Backups
    2008-01-05 16:46 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-05 16:45 . 2008-01-05 16:45 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-04 23:42 . 2008-01-04 23:42 <DIR> d-------- C:\Program Files\Trend Micro
    2008-01-04 22:21 . 2008-01-04 22:21 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-01-04 22:21 . 2008-01-04 22:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2007-12-22 21:03 . 2007-12-22 21:03 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2007-12-22 21:03 . 2007-12-22 21:03 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
    2007-12-22 21:01 . 2007-12-22 21:05 <DIR> d-------- C:\Program Files\Zune
    2007-12-21 13:31 . 2007-12-21 13:31 1,393 --a------ C:\WINDOWS\imsins.BAK

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-06 00:46 --------- d-----w C:\Program Files\Java
    2008-01-03 07:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-01-03 07:50 --------- d-----w C:\Documents and Settings\Bernard\Application Data\AVG7
    2007-12-26 05:23 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Azureus
    2007-12-18 05:45 --------- d-----w C:\Program Files\Viewpoint
    2007-12-16 07:10 --------- d-----w C:\Program Files\HackCleaner
    2007-12-16 06:26 --------- d-----w C:\Program Files\Image-Line
    2007-12-16 06:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
    2007-12-10 08:10 --------- d-----w C:\Program Files\Azureus
    2007-11-18 09:23 --------- d-----w C:\Program Files\Neoretix
    2007-11-16 05:38 40,832 ----a-w C:\WINDOWS\system32\drivers\zumbus.sys
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-11-12 23:33 --------- d-----w C:\Program Files\Codemasters
    2007-11-12 22:02 --------- d-----w C:\Program Files\Guitar Pro 5
    2007-11-12 05:05 --------- d-----w C:\Program Files\AIM6
    2007-11-10 09:15 --------- d-----w C:\Program Files\Red Kawa
    2007-11-09 04:38 --------- d-----w C:\Program Files\Microsoft Xbox 360 Accessories
    2007-11-09 04:24 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
    2007-11-09 04:24 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
    2007-11-06 07:35 --------- d-----w C:\Program Files\VstPlugins
    2007-11-06 07:32 --------- d-----w C:\Program Files\ASIO4ALL v2
    2007-11-06 06:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-11-06 06:34 --------- d-----w C:\Program Files\eMusic Download Manager
    2007-11-06 06:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\InstallShield
    2007-11-03 21:18 142 ----a-w C:\Program Files\page.html
    2006-11-08 02:24 195 -c--a-w C:\Program Files\2E26A5L4.bat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3D266504-0FBC-4d3f-9E7C-4077A77C7DC4}]
    2007-08-10 02:00 217088 --a------ C:\Program Files\Live Search Club Toolbar\LiveSearchClubToolbarBho.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C3A61C-67DD-4E77-A749-1AE33997FF95}]
    2007-03-19 10:30 60928 --a------ C:\WINDOWS\system32\ddyiac.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDEF7D46-B4E3-4888-9214-ACE7357D825B}]
    C:\Program Files\MSN\hokemoz24418.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {E0E899AB-F487-11D5-8D29-0050BA6940E3}
    {719D74AB-1AF9-43A1-8C62-D8750628D93E}

    [HKEY_CLASSES_ROOT\clsid\{719d74ab-1af9-43a1-8c62-d8750628d93e}]
    [HKEY_CLASSES_ROOT\LiveToolbar.LiveToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{7507B80F-C1DE-4b0a-A0BA-120C64075F11}]
    [HKEY_CLASSES_ROOT\LiveToolbar.LiveToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Aim6"="" []
    "Microsft Windows Adapter 5.1.3013"="C:\Documents and Settings\Bernard\Application Data\cin.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SiSPower"="SiSPower.dll" [2005-01-04 00:54 49152 C:\WINDOWS\system32\SiSPower.dll]
    "PCTVOICE"="pctspk.exe" [2003-12-17 21:45 180224 C:\WINDOWS\system32\pctspk.exe]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "SMSERIAL"="sm56hlpr.exe" []
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-30 21:38 219136]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2005-12-25 14:07:57]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
    "{B8B493E5-0BBE-1033-0218-050202050001}"= "C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe" mc-110-12-0000140

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
    backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bernard^Start Menu^Programs^Startup^Cyber-shot Viewer Media Check Tool.lnk]
    path=C:\Documents and Settings\Bernard\Start Menu\Programs\Startup\Cyber-shot Viewer Media Check Tool.lnk
    backup=C:\WINDOWS\pss\Cyber-shot Viewer Media Check Tool.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Warren^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
    path=C:\Documents and Settings\Warren\Start Menu\Programs\Startup\LimeWire On Startup.lnk
    backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
    C:\PROGRA~1\AIM\aim.exe -cnetwait.odl

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    C:\Program Files\AIM6\aim6.exe /d locale=en-US ee://aol/imApp

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
    C:\Program Files\Google\Google Talk\googletalk.exe /autostart

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    2006-05-09 16:24 50760 --a--c--- C:\Program Files\Common Files\AOL\1160536584\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Insider]
    C:\Program Files\Insider\Insider.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    2006-02-17 08:59 124520 --a--c--- C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
    C:\Program Files\Ipwindows\ipwins.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2007-09-26 13:42 267064 --a------ C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kzfr]
    C:\Program Files\InetGet2\stub_109_4_0_4_0.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
    C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
    2001-08-16 20:41 28738 --a--c--- C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    C:\Program Files\MSN Messenger\msnmsgr.exe /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]
    C:\Program Files\Eset\nod32kui.exe /WAITSERVICE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcBoost]
    C:\Program Files\PcBoost\PcBoost.exe /start

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    C:\Program Files\QuickTime\QTTask.exe -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /Minimized

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    c:\program files\steam\steam.exe -silent

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperRam]
    C:\Program Files\SuperRam\SuperRam.exe /start

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
    C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe /startup C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Media Connect 2]
    C:\Program Files\Windows Media Connect 2\WMCCFG.exe /StartQuiet

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]
    C:\Program Files\winupdates\winupdates.exe /auto

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2006-10-18 19:05 204288 --------- C:\Program Files\Windows Media Player\WMPNSCFG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
    2001-10-05 16:34 24576 --a--c--- C:\Program Files\Microsoft Works\wkfud.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
    c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe silentrun

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -quiet

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
    2007-11-15 21:51 166304 --a------ c:\Program Files\Zune\ZuneLauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{B8B493E5-0BBE-1033-0218-050202050001}]
    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe mc-110-12-0000140

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{B8B493E5-0BBF-1033-0218-050202050001}]
    C:\Program Files\Common Files\{B8B493E5-0BBF-1033-0218-050202050001}\Update.exe mc-110-12-0000140

    R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 10:42]
    R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 21:38]
    R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2007-11-15 21:51]
    S3 PsSdk30;PsSdk30;C:\WINDOWS\system32\Drivers\PsSdk30.drv []
    S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2005-04-21 13:33]
    S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57]
    S3 w600bus;Sony Ericsson W600 driver (WDM);C:\WINDOWS\system32\DRIVERS\w600bus.sys [2005-08-15 16:04]
    S3 w600mdfl;Sony Ericsson W600 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w600mdfl.sys [2005-08-15 16:04]
    S3 w600mdm;Sony Ericsson W600 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w600mdm.sys [2005-08-15 16:04]
    S3 w600mgmt;Sony Ericsson W600 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w600mgmt.sys [2005-08-15 16:04]
    S3 w600obex;Sony Ericsson W600 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w600obex.sys [2005-08-15 16:04]
    S3 WmaCDriverV32;WmaCDriverV32;C:\WINDOWS\system32\drivers\WmaCDriverV32.sys [2007-04-03 14:12]
    S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2007-11-15 21:51]
    S4 Moumbad;Moumbad;C:\WINDOWS\system32\drivers\usbfp_sd.sys []

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-02 03:49:35 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-05 18:32:10
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-05 18:37:11 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-01-06 02:37:07
    .
    2007-12-21 21:31:55 --- E O F ---
  8. 2008-01-06, 04:08 #8
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:05:42 PM, on 1/5/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: LiveSearchClubToolbarBhoApp Class - {3D266504-0FBC-4d3f-9E7C-4077A77C7DC4} - C:\Program Files\Live Search Club Toolbar\LiveSearchClubToolbarBho.dll
    O2 - BHO: (no name) - {45C3A61C-67DD-4E77-A749-1AE33997FF95} - C:\WINDOWS\system32\ddyiac.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {EDEF7D46-B4E3-4888-9214-ACE7357D825B} - C:\Program Files\MSN\hokemoz24418.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: Live Search Club Toolbar - {719D74AB-1AF9-43a1-8C62-D8750628D93E} - C:\Program Files\Live Search Club Toolbar\Toolbar.dll
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Bernard\Application Data\cin.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{B8B493E5-0BBE-1033-0218-050202050001}] "C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe" mc-110-12-0000140
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bernard\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 5609 bytes
  9. 2008-01-06, 14:27 #9
    pskelley
    pskelley is offline
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Thanks for returning your information, read and follow the directions carefully.

    This: O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Bernard\Application Data\cin.exe
    may be bad, do you know it? If not use one or more of these free online scans to find out and post the results for me.
    http://virusscan.jotti.org/
    http://www.kaspersky.com/scanforvirus
    http://www.virustotal.com/


    1) How to make files and folders visible:
    Click Start > Open My Computer.
    Select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm. Click OK.
    You may reverse this for safety when we are finished.

    2) Please download ATF Cleaner by Atribune
    http://www.atribune.org/content/view/25/2/
    Save it to your Desktop. We will use this later.

    3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

    (you may leave the first two if you set them that way on purpose)

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {45C3A61C-67DD-4E77-A749-1AE33997FF95} - C:\WINDOWS\system32\ddyiac.dll
    O2 - BHO: (no name) - {EDEF7D46-B4E3-4888-9214-ACE7357D825B} - C:\Program Files\MSN\hokemoz24418.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O4 - HKCU\..\Policies\Explorer\Run: [{B8B493E5-0BBE-1033-0218-050202050001}] "C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe" mc-110-12-0000140

    Close all programs but HJT and all browser windows, then click on "Fix Checked"

    4) RIGHT Click on Start then click on Explore. Locate and delete these items:

    C:\WINDOWS\system32\ddyiac.dll <<< make sure that file is gone

    C:\Program Files\Common Files\{B8B493E5-0BBE-1033-0218-050202050001}\Update.exe <<< delete that file

    5) Run ATF Cleaner
    Double-click ATF-Cleaner.exe to run the program.
    Click Select All found at the bottom of the list.
    Click the Empty Selected button.
    Click Exit on the Main menu to close the program.

    Restart and post a new HJT log, the information about cin.exe, and some feedback, how is the computer running now?

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006
  10. 2008-01-07, 03:03 #10
    BeefJerky
    BeefJerky is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    18

    Default

    i cant locate the file C:\Documents and Settings\Bernard\Application Data\cin.exe anywhere. i have all hidden files visible. any clue as to whats going on?
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules