Results 1 to 6 of 6

Thread: AGOBOT-KU, et. al

  1. #1
    Member
    Join Date
    Oct 2005
    Location
    USA
    Posts
    50

    Default AGOBOT-KU, et. al

    Part 24
    Service (registry key): WebClient
    Display name: WebClient
    Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
    Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k LocalService
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 2
    Type: 32
    Error Control: 1
    Depends On services: MRxDAV
    Service (registry key): winachsf
    Image path: system32\DRIVERS\HSF_CNXT.sys
    Image size: 682624
    Image MD5: 2A8C145E9E9E63B0071DA4F35544AB9D
    Start: 3
    Type: 1
    Error Control: 0
    Service (registry key): winmgmt
    Display name: Windows Management Instrumentation
    Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    Object name: LocalSystem
    Image path: %systemroot%\system32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 2
    Type: 32
    Error Control: 0
    Depends On services: RPCSS
    Service (registry key): Winsock
    Start: 3
    Type: 4
    Error Control: 1
    Service (registry key): WinSock2
    Start: 0
    Type: 0
    Error Control: 0
    Service (registry key): WinTrust
    Start: 0
    Type: 0
    Error Control: 0
    Service (registry key): WmdmPmSN
    Display name: Portable Media Serial Number Service
    Description: Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.
    Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 3
    Type: 32
    Error Control: 1
    Service (registry key): WmiAcpi
    Display name: Microsoft Windows Management Interface for ACPI
    Image path: system32\DRIVERS\wmiacpi.sys
    Image size: 8832
    Image MD5: AE2C8544E747C20062DB27456EA2D67A
    Start: 1
    Type: 1
    Error Control: 1
    Service (registry key): WmiApRpl
    Start: 0
    Type: 0
    Error Control: 0
    Service (registry key): WmiApSrv
    Display name: WMI Performance Adapter
    Description: Provides performance library information from WMI HiPerf providers.
    Object name: LocalSystem
    Image path: C:\WINDOWS\system32\wbem\wmiapsrv.exe
    Image size: 126464
    Image MD5: BA8CECC3E813E1F7C441B20393D4F86C
    Start: 3
    Type: 16
    Error Control: 1
    Depends On services: RPCSS
    Service (registry key): WS2IFSL
    Start: 1
    Type: 0
    Error Control: 0
    Service (registry key): wscsvc
    Display name: Security Center
    Description: Monitors system security settings and configurations.
    Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 2
    Type: 32
    Error Control: 1
    Depends On services: RpcSs,winmgmt
    Service (registry key): wuauserv
    Display name: Automatic Updates
    Description: Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.
    Object name: LocalSystem
    Image path: %systemroot%\system32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 2
    Type: 32
    Error Control: 1
    Service (registry key): WZCSVC
    Display name: Wireless Zero Configuration
    Description: Provides automatic configuration for the 802.11 adapters
    Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 2
    Type: 32
    Error Control: 1
    Depends On services: RpcSs,Ndisuio
    Service (registry key): xmlprov
    Display name: Network Provisioning Service
    Description: Manages XML configuration files on a domain basis for automatic network provisioning.
    Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
    Image MD5: 8F078AE4ED187AAABC0A305146DE6716
    Start: 3
    Type: 32
    Error Control: 1
    Depends On services: RpcSs
    Service (registry key): {20CF04AB-5C85-4761-BF7A-D7EA76AA85DB}
    Start: 0
    Type: 0
    Error Control: 0
    Service (registry key): {CE611787-8B1F-4B07-9D6B-EADD6CFE8409}
    Start: 0
    Type: 0
    Error Control: 0

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,961

    Default

    Hello

    23 of your topics have been removed.

    Please read the thread here:
    "BEFORE you POST" -Preliminary Steps

    Copy paste a HJT log 'only' into this topic by hitting 'Post Reply' and then a helper will assist you when available.

    Thank you.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,961

    Default

    Hjt log originally posted:

    Logfile of HijackThis v1.99.1
    Scan saved at 12:38:32 AM, on 9/12/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Trend Micro\Antivirus\PCClient.EXE
    C:\Program Files\Trend Micro\Antivirus\PCCGUIDE.EXE
    C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\MEB\My Documents\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://security.kolla.de/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.kolla.de/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://security.kolla.de/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://security.kolla.de/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://security.kolla.de/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.kolla.de/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://security.kolla.de/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://security.kolla.de/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://security.kolla.de/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://security.kolla.de/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:CustomerService@OldPuebloTraders.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MaryEllen
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Antivirus\pccguide.exe"
    O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe" /run
    O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Antivirus\PCClient.exe"
    O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix /waitmore
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
    O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} (Java Plug-in) -
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in) -
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorp
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  4. #4
    Member
    Join Date
    Oct 2005
    Location
    USA
    Posts
    50

    Default Apologies for posting

    To Tashi: I offer my apologies for posting the scan results from Spybot S&D. I thought I was to post them after I sent a HJT log. Mea culpa. I apologize for causing you so much distress. The tone in the email you sent was evidence of your exasperation, and not nearly as cordial as your reply here on the forum.

    To Shelf Life: I offer my deepest and sincerest apologies for posting the scan results from Spybot S&D. Thank you for graciously sending me a PM. You sir, are a gentleman. I am sorry. I printed off a copy of Trashi's "Before you Post," commentary, and promise to follow it to the letter. :blush: Tarheel.
    Last edited by tashi; 2006-09-13 at 06:16. Reason: merged new topic

  5. #5
    Emeritus
    Join Date
    Nov 2005
    Location
    Texas
    Posts
    1,144

    Default

    Can you disable teatimer and post a new log from hijackthis.
    MS-MVP Windows Security 2006,2007,2008 & 2009
    ASAP member since 2004

  6. #6
    Emeritus
    Join Date
    Nov 2005
    Location
    Texas
    Posts
    1,144
    Last edited by little eagle; 2006-09-15 at 03:09.
    MS-MVP Windows Security 2006,2007,2008 & 2009
    ASAP member since 2004

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •