Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Zlob.Downloader, BackDoor-CVT and more.. Help~

  1. 2006-07-06, 19:03 #1
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default Zlob.Downloader, BackDoor-CVT and more.. Help~

    Hi, I am facing a problem now. My mcafee keep on poping out and alert me that they detected trojan named Zlob.Downloader, BackDoor-CVT and i cannot remove it.. Here is my Hijacklogfile

    Logfile of HijackThis v1.99.1
    Scan saved at 12:34:47 AM, on 7/7/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Sammi\Desktop\HijackThis.exe

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\j6451022.exe
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
    O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [f2223Sam] "C:\WINDOWS\system32\s6345\zh591382484y.exe"
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: MsgPlusLoader.dll
    O20 - Winlogon Notify: winjvd32 - C:\WINDOWS\SYSTEM32\winjvd32.dll
    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)

    Anyone can help? Thanks.. I'm irritated with it now... aAhaha..
  2. 2006-07-06, 19:11 #2
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default

    And this is my panda online scan report

    Incident Status Location

    Adware:Adware/SecurityError Not disinfected C:\WINDOWS\system32\atmclk.exe
    Adware:Adware/Mytoolbar Not disinfected C:\Program Files\ToolBar888\MyToolBar.dll
    Adware:adware/emediacodec Not disinfected c:\windows\system32\atmclk.exe
    Adware:adware/xpasswordmanager Not disinfected c:\windows\system32\ld100.tmp
    Adware:adware/securityerror Not disinfected c:\windows\system32\ot.ico
    Adware:adware/spywarequake Not disinfected c:\windows\system32\1024\ld5377.tmp
    Adware:adware/maxifiles Not disinfected c:\program files\ToolBar888
    Adware:adware/sidesearch Not disinfected Windows Registry
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.atdmt.com/]
    Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.statcounter.com/]
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.doubleclick.net/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.casalemedia.com/]
    Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[ad.yieldmanager.com/]
    Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.azjmp.com/]
    Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.zedo.com/]
    Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.tribalfusion.com/]
    Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.revenue.net/]
    Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.go.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.ehg-dig.hitbox.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.hitbox.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.ehg-dig.hitbox.com/]
    Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.bluestreak.com/]
    Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.ads.pointroll.com/]
    Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.2o7.net/]
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt[.mediaplex.com/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Sammi\Cookies\sammi@atdmt[2].txt
  3. 2006-07-07, 03:45 #3
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default ewido anti sypware report

    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 9:06:27 AM 7/7/2006

    + Scan result:



    C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined).
    C:\Program Files\ToolBar888\MyToolBar.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\Documents and Settings\Sammi\Local Settings\Temporary Internet Files\Content.IE5\GH2FK9QR\sharp[1].htm -> Downloader.IstBar.ai : Cleaned with backup (quarantined).
    :mozilla.148:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Sammi\Local Settings\Temp\Cookies\sammi@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Sammi\Local Settings\Temp\Cookies\sammi@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.49:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@site.www.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@www.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.19:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.140:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
    :mozilla.60:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.61:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.62:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    C:\Documents and Settings\Sammi\Local Settings\Temp\Cookies\sammi@as.casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.124:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
    :mozilla.125:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
    :mozilla.54:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.171:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Sammi\Local Settings\Temp\Cookies\sammi@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.56:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.57:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.58:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.59:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.128:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.129:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.130:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.131:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.132:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.133:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.134:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.135:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.136:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Sammi\Cookies\sammi@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
    :mozilla.163:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.142:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.143:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.144:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.145:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.126:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
    :mozilla.33:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.34:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.35:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.117:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.93:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.94:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Sammi\Local Settings\Temp\Cookies\sammi@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.111:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.112:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.113:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5377.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEDB8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\atmclk.exe -> Trojan.Small : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\kernel32.dll -> Trojan.Small : Cleaned with backup (quarantined).


    ::Report end
  4. 2006-07-07, 17:33 #4
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default Additional Info

    And btw, i used Mcafee Antivirus programme to scan the comp. But there's nothing... It's weird.. Does it means it's not a virus? Just malware for sure? Hope can get the advice asap.. Thanks a lot..
  5. 2006-07-08, 08:12 #5
    LonnyRJones
    LonnyRJones is offline
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Hi

    Start Hijackthis and place a check next to these items If there.
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\j6451022.exe
    O4 - HKCU\..\Run: [f2223Sam] "C:\WINDOWS\system32\s6345\zh591382484y.exe"
    O20 - Winlogon Notify: winjvd32 - C:\WINDOWS\SYSTEM32\winjvd32.dll
    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)
    ====================================
    Hit fix checked and close Hijackthis.
    Restart the PC
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Next: Fallow the instructions here
    http://forums.spybot.info/showthread.php?t=4015
    Afterwards post the Logs mentioned mentioned near the bottom
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006
  6. 2006-07-09, 17:46 #6
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default After doing the steps...

    My SmitfraudFix report :

    SmitFraudFix v2.68b

    Scan done at 21:48:51.04, Sun 07/09/2006
    Run from C:\Documents and Settings\Sammi\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    Fix ran in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End


    Ewido log

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 11:18:18 PM 7/9/2006

    + Scan result:



    :mozilla.64:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.65:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.80:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.37:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.38:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.66:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.67:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.36:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.74:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.75:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.76:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.39:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Com : Cleaned.
    :mozilla.35:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.77:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.78:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.79:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.117:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.118:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.119:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.120:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.121:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.103:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
    :mozilla.104:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
    :mozilla.148:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.149:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.63:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.165:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.166:C:\Documents and Settings\Sammi\Application Data\Mozilla\Firefox\Profiles\qyf6rknr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


    ::Report end


    HijackThis Log :

    Logfile of HijackThis v1.99.1
    Scan saved at 11:33:32 PM, on 7/9/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\ULi5287\ULi5287.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    C:\Program Files\McAfee.com\VSO\oasclnt.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
    C:\WINDOWS\vsnpstd3.exe
    C:\Program Files\Common Files\{5421EFC9-0BB7-1033-1019-050510170001}\Update.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Sammi\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
    O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

    So is it clean now? Thanks for your help!
  7. 2006-07-10, 04:56 #7
    LonnyRJones
    LonnyRJones is offline
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Start Hijackthis and place a check next to these items If there.
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    ====================================
    Hit fix checked and close Hijackthis.

    What are the contents of this folder ?
    C:\WINDOWS\system32\s6345
    Is this file present ?
    C:\WINDOWS\j6451022.exe
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006
  8. 2006-07-10, 18:57 #8
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 12:55:17 AM, on 7/11/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\ULi5287\ULi5287.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    C:\Program Files\McAfee.com\VSO\oasclnt.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    c:\program files\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
    C:\WINDOWS\vsnpstd3.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\BitComet\BitComet.exe
    C:\Documents and Settings\Sammi\Desktop\msgr8sg.exe
    C:\DOCUME~1\Sammi\LOCALS~1\Temp\GLB42.tmp
    C:\Documents and Settings\Sammi\Desktop\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
    O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6D59B4E2-2047-4ADF-9F87-0A8FBD6A202C}: NameServer = 202.188.0.133 202.188.1.5
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe



    Ermm.. Bout the file on system32 tht u asked me wat is it, i dunno bout it.. But when i go to check at the specific place, it is not there anymore.. I think has been deleted.. So how does my report looks like now? Thanks a lot for helping me.. really..
  9. 2006-07-11, 05:20 #9
    LonnyRJones
    LonnyRJones is offline
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Update suns java manualy
    Sun Java V1.5.0_07 is Available:
    http://forums.spybot.info/showpost.p...80&postcount=2
    Afterwards it's important to uninstall the old version's.


    C:\Documents and Settings\Sammi\Desktop\msgr8sg.exe

    Your were installing beta yahoo messenger ?

    Is norman antiviurs still installed ?
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006
  10. 2006-07-11, 19:05 #10
    wensher2sammi
    wensher2sammi is offline
    Junior Member
    Join Date
    Jul 2006
    Posts
    18

    Default

    Quote Originally Posted by LonnyRJones
    Update suns java manualy
    Sun Java V1.5.0_07 is Available:
    http://forums.spybot.info/showpost.p...80&postcount=2
    Afterwards it's important to uninstall the old version's.


    C:\Documents and Settings\Sammi\Desktop\msgr8sg.exe

    Your were installing beta yahoo messenger ?

    Is norman antiviurs still installed ?

    Ermm.. Yea.. I was installing yhoo messenger.. I idn use norton antivirus dy.. Using mcafee.. Btw, i can't remove the java update 6.. How? Do i still need to post hijackthis log?
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules