Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 21

Thread: Pipas.a problems

  1. #11
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}785E6FC50263-C419-F5B4-7813-4891854B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F64B93D732D1-BCCB-50D4-9473-930D5EBB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C05CF6C5F748-499A-2D84-2694-E577D0F8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A77DEF9BC768-541A-A994-7006-129ADF45{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9530C92448C0-5C6B-B504-8683-F7643D2F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9A51543450EF-BFD8-8D34-A09E-1540EA23{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B75657170B2-1DDB-1E94-0684-9FD04B57{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}07CD90D9DF65-1439-4954-4DDA-D4DB1C22{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ACD326C012F7-B648-7584-1DF4-C2381C7B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B7DF9D90AE59-B5AB-D5B4-A2A9-BB10F573{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B67D78AF01B5-8E18-1C74-C77A-1C863D66{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6BB684717E46-6DA8-F0B4-32AC-B02472ED{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C4E173377806-1C5B-DC14-197A-A4DE1364{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A2804707E945-C179-EC24-481A-A783B597{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}133EDEBAC369-5698-E304-4E60-AFF39A9D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EFF101EE0B8D-1ED9-3DE4-A329-9D1F9989{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\1201
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ADFC213EDA4A-7A2B-D7F4-5321-F3A4A144{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A44109C2F569-A99B-CD94-15DA-376C18D4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}470E97010CC6-4A29-2354-EB49-2F0AA2EF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B06C4043B3F7-5458-1BF4-524C-4624516E{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9BCA0341AA81-8ED8-3344-A793-E0072E13{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}548288517889-7F7A-E554-6309-050E009F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D55FAA11099C-A5EA-2D34-2161-E80651D1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}68A7D340B521-118A-B704-A2B4-520956D4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3E6BF99505C8-BF4A-BA44-230E-F42C619A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8F41C58C7ED1-8DCA-BBD4-6341-7DC4CB24{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C735B01B0787-752A-2704-5F0B-97D5443A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AB44804F0C83-9D1A-D194-DD18-1A539ABF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}89F3E740518B-AC59-14D4-01D0-8C314447{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D18A5240CF0E-08DB-35C4-6D7F-6A6171D2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4BD8C28801DF-526B-A3F4-9855-FA6C5D8B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CED06A357030-FF9A-5424-CB19-44EB97B8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0603879E7372-C058-29A4-2D8F-5F6B8F98{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CD797502B3E0-F369-7284-7B3C-BDCF71B3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1EAC0A839990-0AC8-2614-8FDB-FA8AE0B1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}17ABC3862C7F-5959-EFD4-BD44-C725B531{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E12EEDF90F44-E72A-2544-C74B-6DFFB8F8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}308978A37E85-94A8-EA14-9EE0-718E9BF0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9A021B057732-F8DA-BFA4-E7A5-6A02B672{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D1489573682A-D528-5C14-EBDD-5D8FF1CB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E6E55851963A-0309-D784-9FDB-DA5AF16B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8EE572B2C7BE-610A-0214-35BF-B7D845CA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A7FCBD503E98-4AC8-7314-3243-E4659129{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F4D36F78ECB6-129B-3A34-DA02-E9D0823D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CB32F5483013-8FEA-F9D4-BEF4-CCE2EA71{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6FD14ED9D8F0-75FA-ADD4-B7FB-92830489{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}968A79125C90-B3D9-07A4-E44C-7E0E8F74{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}05A1F7A2CFCA-30CA-4D74-F16F-0D2D5CED{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2C1DBDF58277-C188-2E34-F234-6EDDBCC6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}480B17D47476-907A-4EE4-A390-74B8BDA2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9B153B55BF4-4CC8-2BC4-2D2A-8D6434EE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}722BAC744020-E94A-01A4-A6EB-F80008B5{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}31C6DF4D45D1-63DA-A1A4-9139-EA1F5B76{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}10D3B9E22768-149B-2B24-B791-BA289E97{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}51981551CB97-26B8-5514-4D4D-EFABD920{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}29B424FE865F-1939-4E24-F1CE-F4FF315C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\edzmd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\onisacputes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
    ...

    Random Runs removed from HKLM
    "dmzde.exe"=-
    ...
    ...

    PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

    »»»»» Searching by size/names...
    C:\WINDOWS\SYSTEM32\DMCTU.EXE
    C:\WINDOWS\SYSTEM32\DMFGG.EXE
    C:\WINDOWS\SYSTEM32\DMNQN.EXE
    C:\WINDOWS\SYSTEM32\DMZDE.EXE
    C:\WINDOWS\SYSTEM32\DMZXK.EXE
    * csr.exe C:\WINDOWS\System32\CSCBH.EXE
    * csr.exe C:\WINDOWS\System32\CSHKF.EXE

    »»»»»
    Search five digit cs, dm kd and jb files.
    This WILL/CAN also list Legit Files, Submit them at Virustotal
    C:\WINDOWS\SYSTEM32\CSCBH.EXE 51,257 2006-08-07
    C:\WINDOWS\SYSTEM32\CSHKF.EXE 51,203 2006-11-18
    C:\WINDOWS\SYSTEM32\DMCTU.EXE 44,032 2004-08-04
    C:\WINDOWS\SYSTEM32\DMFGG.EXE 44,032 2004-08-04
    C:\WINDOWS\SYSTEM32\DMNQN.EXE 44,032 2004-08-04
    C:\WINDOWS\SYSTEM32\DMYQI.EXE 44,032 2002-08-29
    C:\WINDOWS\SYSTEM32\DMZDE.EXE 44,032 2004-08-04
    C:\WINDOWS\SYSTEM32\DMZXK.EXE 44,032 2004-08-04

    Other suspects.
    C:\WINDOWS\System32\{3D29F5DA-6A58-4967-9AC6-A8229C55E646}.exe
    C:\WINDOWS\System32\{40B58FE2-D7B0-4997-8A87-30CE9BFCB145}.exe
    C:\WINDOWS\System32\{571FE379-D440-46F9-BC84-7E916FFC32CB}.exe
    C:\WINDOWS\System32\{7CAB407F-DAB8-4A75-B608-DA90AD7FEB34}.exe
    C:\WINDOWS\System32\{9156C83D-7DDE-467F-BD4F-2213A787C56A}.exe
    C:\WINDOWS\System32\{B0B3DA5A-5677-4846-93B6-543304CB95B3}.exe
    C:\WINDOWS\System32\{D2F00882-D15F-49AF-8BB9-22AF918F1A9A}.exe
    C:\WINDOWS\System32\{EB7967C9-EAAD-4137-BF80-5259F06C81BF}.exe
    C:\WINDOWS\System32\{F1759AC1-92B1-46DC-B8E6-9EAF8E884CC1}.exe

    »»»»» Misc files.

    »»»»» Checking for older varients covered by the Rem3 tool.
    ...
    Postrun check
    [HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "system"=""

    ...




    Well that is it. Thanks again for your help.

  2. #12
    Expert-Emeritus illukka's Avatar
    Join Date
    Nov 2005
    Location
    The Pits Of Hell
    Posts
    1,289

    Default

    hi
    Please download the Killbox by Option^Explicit.

    Note: In the event you already have Killbox, this is a new version that I need you to download.
    • Save it to your desktop.
    • Please double-click Killbox.exe to run it.
    • Select:
      • Delete on Reboot
      • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


      C:\WINDOWS\SYSTEM32\CSCBH.EXE
      C:\WINDOWS\SYSTEM32\CSHKF.EXE
      C:\WINDOWS\SYSTEM32\DMCTU.EXE
      C:\WINDOWS\SYSTEM32\DMFGG.EXE
      C:\WINDOWS\SYSTEM32\DMNQN.EXE
      C:\WINDOWS\SYSTEM32\DMYQI.EXE
      C:\WINDOWS\SYSTEM32\DMZDE.EXE
      C:\WINDOWS\SYSTEM32\DMZXK.EXE
      C:\WINDOWS\System32\{3D29F5DA-6A58-4967-9AC6-A8229C55E646}.exe
      C:\WINDOWS\System32\{40B58FE2-D7B0-4997-8A87-30CE9BFCB145}.exe
      C:\WINDOWS\System32\{571FE379-D440-46F9-BC84-7E916FFC32CB}.exe
      C:\WINDOWS\System32\{7CAB407F-DAB8-4A75-B608-DA90AD7FEB34}.exe
      C:\WINDOWS\System32\{9156C83D-7DDE-467F-BD4F-2213A787C56A}.exe
      C:\WINDOWS\System32\{B0B3DA5A-5677-4846-93B6-543304CB95B3}.exe
      C:\WINDOWS\System32\{D2F00882-D15F-49AF-8BB9-22AF918F1A9A}.exe
      C:\WINDOWS\System32\{EB7967C9-EAAD-4137-BF80-5259F06C81BF}.exe
      C:\WINDOWS\System32\{F1759AC1-92B1-46DC-B8E6-9EAF8E884CC1}.




    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).


    If your computer does not restart automatically, please restart it manually.

    If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.


    next open hijackthis, click do a system scan only
    checkmark these lines if still there:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R3 - URLSearchHook: (no name) - {C1EB660C-B0C9-2941-D32C-69063CF76743} - StartCpl.dll (file missing)
    R3 - URLSearchHook: (no name) - {BC8438A0-83A2-BED8-F9DA-72344C233A08} - defect08.dll (file missing)
    R3 - URLSearchHook: (no name) - {E616A409-DC3D-37BD-5ACF-CDEF4C55CA50} - mozilla-text.dll (file missing)
    O4 - HKLM\..\Run: [ExchangeMaster] new32.exe
    O4 - HKLM\..\Run: [zantu] TemplateDongle.exe
    O4 - HKLM\..\Run: [Trayz] br0ken.exe
    O4 - HKLM\..\Run: [uio] sbin.exe
    O4 - HKLM\..\Run: [srbho] ExchangeMaster.exe
    O4 - HKLM\..\Run: [EXE32EXE] jopplerg.exe
    O4 - HKLM\..\Run: [uapgh.exe] C:\WINDOWS\system32\uapgh.exe
    O4 - HKCU\..\Run: [StatusCheck] media64.exe
    O4 - HKCU\..\Run: [newbreed] br0ken.exe
    O4 - HKCU\..\Run: [Brong32] xsetup.exe
    O4 - HKCU\..\Run: [XTermInit] porka_.exe
    O4 - HKCU\..\Run: [br0ken] ExchangeMaster.exe
    O4 - HKCU\..\Run: [Testimonials] uio.exe
    O4 - HKCU\..\Run: [systemdll] PasswdMon.exe
    O4 - HKCU\..\Run: [ABCXYZ] ABCXYZ.exe
    O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freewar...eanerstart.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
    O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
    O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{30C54897-ED84-42B8-BF02-55643292EE74}: NameServer = 85.255.113.133,85.255.112.143
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E8065B4-6F8A-4493-9901-331654578990}: NameServer = 85.255.113.133,85.255.112.143
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7689B0F9-53D0-4100-BED7-EE03078B2A3A}: NameServer = 85.255.113.133,85.255.112.143
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C3258295-10DD-4EB6-8D12-98ABED75573C}: NameServer = 85.255.113.133,85.255.112.143
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.133 85.255.112.143
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.133 85.255.112.143
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.133 85.255.112.143
    O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)


    then close all explorer and browser windows
    leaving only hijackthis running

    and click fix checked

    reboot

    First download AVG Anti-Spyware from HERE and save that file to your desktop.
    This is a 30 day trial of the program
    1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
    2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
    3. On the main screen select the icon "Update" then select the "Update now" link.
      • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
    4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
    6. Under "Reports"
      • Select "Automatically generate report after every scan"
      • Un-Select "Only if threats were found"
    Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
    1. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
      IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
    2. Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
    3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
    4. AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
      Once the scan is complete do the following:
    5. If you have any infections you will prompted, then select "Apply all actions"
    6. Next select the "Reports" icon at the top.
    7. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
    8. Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.


    also post a new hijackthis log


    Note:
    If You have connection problems or those 017's ~ O17 - HKLM~ 85.255.116.103,85.255.112.198, return =>
    Before doing this write down all the settings, Note that not all system/setups even have these settings, while some connection service's will require them.
    In the windows control panel: If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
    Press OK twice to get out of the properties screen and reboot if it asks.
    That option might not be available one some systems
    I Am A Proud Member of ASAP Since 2004

    To Ride, Shoot Straight And Speak TheTruth

    HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!

  3. #13
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 9:08:47 PM, on 12/12/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
    C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\SYSTEM32\USRshutA.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Yahoo!\YCentral\YahooCentral.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\hijackthis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
    O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
    O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [YCentral] C:\Program Files\Yahoo!\YCentral\YahooCentral.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/1...L/PhPSetup.cab
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freewar...eanerstart.cab
    O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://mercynet.mercydesmoines.org/...terisSetup.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1138152948921
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1153536653890
    O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...07/mcfscan.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)

  4. #14
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    AND
    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 9:02:43 PM 12/12/2006

    + Scan result:



    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057252.exe -> Adware.Msnagent : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057249.dll -> Adware.NetNucleus : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057251.exe -> Adware.Raze : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057254.exe -> Adware.Raze : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057253.dll -> Adware.SBSoft : Cleaned with backup (quarantined).
    C:\Documents and Settings\User\Cookies\user@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\User\Cookies\user@citi.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned.
    C:\Documents and Settings\User\Cookies\user@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\User\Cookies\user@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\User\Cookies\user@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\RECYCLER\S-1-5-21-3256355825-294238107-3547592017-1004\Dc2.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057250.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057264.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057343.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP265\A0058342.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP267\A0058420.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0059418.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0061417.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0062421.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0063416.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0064417.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0065417.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP272\A0066422.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP275\A0067418.exe -> Trojan.DNSChanger.ef : Cleaned with backup (quarantined).
    C:\hijackthis\backups\backup-20061212-162150-869.inf -> Trojan.NetChg.a : Cleaned with backup (quarantined).
    C:\hijackthis\backups\backup-20061212-162151-906.inf -> Trojan.NetChg.a : Cleaned with backup (quarantined).
    C:\!KillBox\dmctu.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\!KillBox\dmfgg.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\!KillBox\dmnqn.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\!KillBox\dmyqi.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\!KillBox\dmzde.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\!KillBox\dmzxk.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP221\A0051774.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP221\A0051792.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP222\A0051811.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP222\A0051880.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP223\A0051896.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP223\A0051911.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP223\A0051927.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP223\A0051943.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP224\A0052004.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP224\A0052046.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP224\A0052066.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP225\A0052087.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP225\A0052110.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP225\A0052128.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP225\A0052143.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052167.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052182.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052207.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052221.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052237.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP226\A0052253.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP227\A0052279.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP227\A0052292.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP227\A0052308.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP228\A0052329.exe -> Trojan.Pakes : Cleaned with backup (quarantined).

  5. #15
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP228\A0052346.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP228\A0052363.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP229\A0052384.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP229\A0052403.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP229\A0052420.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP229\A0052444.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP230\A0052524.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP230\A0052540.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP230\A0052557.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP231\A0052582.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP231\A0052609.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP231\A0052627.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP231\A0052640.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP232\A0052674.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP233\A0052693.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP233\A0052708.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP233\A0052722.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP236\A0052871.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP236\A0052889.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP236\A0052991.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP236\A0053006.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP236\A0053020.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP237\A0053050.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP237\A0053066.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP237\A0053082.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP237\A0053099.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP237\A0053112.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP238\A0053130.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP239\A0053149.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP239\A0053208.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP241\A0053257.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP242\A0053289.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP243\A0053311.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP243\A0053328.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP244\A0053358.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP245\A0053374.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP245\A0053388.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP246\A0053455.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP246\A0053472.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP246\A0053489.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP246\A0053514.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP248\A0053601.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP249\A0053653.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP249\A0053666.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP249\A0053681.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP249\A0053698.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053719.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053734.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053754.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053769.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053782.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP250\A0053798.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053815.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053830.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053843.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053859.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053874.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP251\A0053898.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0053991.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054033.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054051.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054065.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054081.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054105.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054123.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP253\A0054146.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP253\A0054162.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP254\A0054180.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP254\A0054198.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP254\A0054215.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP254\A0054260.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP255\A0054375.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP255\A0054396.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP256\A0054414.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP256\A0054435.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP256\A0054449.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP256\A0054465.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP257\A0055535.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP257\A0055555.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP257\A0055571.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055625.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055641.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055663.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055737.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055760.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP258\A0055777.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP259\A0055808.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP259\A0056834.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP259\A0056850.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP259\A0056870.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056888.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056907.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056924.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056939.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056950.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056969.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP260\A0056985.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP261\A0057179.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057266.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP262\A0057341.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP265\A0058340.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP267\A0058417.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0059436.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0060416.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0061418.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0062418.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0063417.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP268\A0064416.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP272\A0066415.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP275\A0067416.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067463.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067464.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067465.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067466.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067467.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP276\A0067468.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP252\A0054083.dll -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{1346104A-6FC0-4867-AD5E-26F64F088334}\RP257\A0055539.exe -> Trojan.Small : Cleaned with backup (quarantined).


    ::Report end

  6. #16
    Expert-Emeritus illukka's Avatar
    Join Date
    Nov 2005
    Location
    The Pits Of Hell
    Posts
    1,289

    Default

    hi

    much better, however there still are issues..

    delete the folder C:\!KillBox

    click start > run > type cmd and hit enter

    the command prompt should open. type sc stop MsaSvc and hit enter
    next type sc delete MsaSvcand hit enter

    reboot

    rescan with hiajckthis and post a fresh log
    I Am A Proud Member of ASAP Since 2004

    To Ride, Shoot Straight And Speak TheTruth

    HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!

  7. #17
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 4:20:40 PM, on 12/14/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
    C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
    C:\WINDOWS\SYSTEM32\USRshutA.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Yahoo!\YCentral\YahooCentral.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\hijackthis\HijackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
    O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
    O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [YCentral] C:\Program Files\Yahoo!\YCentral\YahooCentral.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/1...L/PhPSetup.cab
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freewar...eanerstart.cab
    O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://mercynet.mercydesmoines.org/...terisSetup.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1138152948921
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1153536653890
    O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...07/mcfscan.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

  8. #18
    Expert-Emeritus illukka's Avatar
    Join Date
    Nov 2005
    Location
    The Pits Of Hell
    Posts
    1,289

    Default

    hi

    well done

    now lets do a final online virus scan to see if there still is something:
    Please run the F-Secure Online Scanner

    Note: This Scanner is for Internet Explorer Only!
    • Follow the Instruction Here for installation.
    • Accept the License Agreement.
    • Once the ActiveX installs,Click Full System Scan
    • Once the download completes,the scan will begin automatically.
    • The scan will take some time to finish,so please be patient.
    • When the scan completes, click the Automatic cleaning (recommended) button.
    • Click the Show Report button and Copy&Paste the entire report in your next reply.
    I Am A Proud Member of ASAP Since 2004

    To Ride, Shoot Straight And Speak TheTruth

    HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!

  9. #19
    Junior Member
    Join Date
    Nov 2006
    Posts
    15

    Default

    It wasn't exactly spotless but it sure is running a whole lot better then it was before you started helping me.

    Thanks


    Scanning Report
    Friday, December 15, 2006 06:28:24 - 11:33:03
    Computer name: USER-84DQGJGOQB
    Scanning type: Scan system for viruses, rootkits, spyware
    Target: C:\


    --------------------------------------------------------------------------------

    Result: 6 malware found
    Tracking Cookie (spyware)
    System (Disinfected)
    System
    Trojan-Downloader.BAT.Ftp.ab (virus)
    C:\WINDOWS\SYSTEM32\I (Renamed & Submitted)
    Trojan.Win32.Puper.bx (virus)
    C:\WINDOWS\SYSTEM32\{F1759AC1-92B1-46DC-B8E6-9EAF8E884CC1}.EXE (Renamed & Submitted)
    W32/Spybot.KWJ (virus)
    C:\WINDOWS\SYSTEM32\TFTP1312 (Submitted)
    Win32.Trojandownloader.Zlob (spyware)
    System (Disinfected)

    --------------------------------------------------------------------------------

    Statistics
    Scanned:
    Files: 21741
    System: 3875
    Not scanned: 9
    Actions:
    Disinfected: 2
    Renamed: 2
    Deleted: 0
    None: 2
    Submitted: 3
    Files not scanned:
    C:\PAGEFILE.SYS
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    C:\WINDOWS\$NTUNINSTALLKB835732$\CALLCONT.DLL
    C:\WINDOWS\$NTUNINSTALLKB835732$\RTCDLL.DLL
    C:\WINDOWS\$NTUNINSTALLKB828741$\CATSRV.DLL
    C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\ME_6JDPAWALTHWSJFF
    C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\ME_DRRFGO7CHOC7BAJ
    C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\ME_LFQEIWMYIO2SS0Z
    C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\ME_VPXATA3EAMU8TUI

    --------------------------------------------------------------------------------

    Options
    Scanning engines:
    F-Secure Libra: 2.4.2, 2006-12-15
    F-Secure AVP: 7.0.171, 2006-12-15
    F-Secure Orion: 1.2.37, 2006-12-15
    F-Secure Blacklight: 1.0.31, 0000-00-00
    F-Secure Draco: 1.0.35, 0260-02-44
    F-Secure Pegasus: 1.19.0, 2006-11-12
    Scanning options:
    Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX
    Use Advanced heuristics

    --------------------------------------------------------------------------------

    Copyright © 1998-2006 Product support |Send virus sample to F-Secure
    F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

  10. #20
    Expert-Emeritus illukka's Avatar
    Join Date
    Nov 2005
    Location
    The Pits Of Hell
    Posts
    1,289

    Default

    hi

    looks like it did good

    click start> search. search for *.0xe
    delete all results

    also delete:
    C:\WINDOWS\SYSTEM32\I
    C:\WINDOWS\SYSTEM32\TFTP1312

    then:

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Reenable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    here are some additional utilities that will enhance your safety

    • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software


    also remember to keep your java updated, see this topic for instructions

    http://forums.spybot.info/showpost.p...80&postcount=2
    I Am A Proud Member of ASAP Since 2004

    To Ride, Shoot Straight And Speak TheTruth

    HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •