Results 1 to 10 of 11

Thread: Malware cause CPU usage to go to 100% in cycles

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. 2006-12-20, 20:57 #1
    pjnec
    pjnec is offline
    Junior Member
    Join Date
    Dec 2006
    Posts
    7

    Default Malware cause CPU usage to go to 100% in cycles

    Hi,

    To however is going to help me here, just a word of thanks from me here before i start. You guys are wonderful.

    OK.. get to the problem.

    I have been having this problem of for about 2 weeks or so. The CPU usage is weird, with periodic peaks @ 100% usage by a process called "iexplore.exe". The peaks come like every 30 seconds or so. Under the Windows Task Manager the User of this process is "System". When I launched my Internet Explorer 7, another process with the same name "iexplore.exe" appears, but by User account which I have logged in to Windows.

    When I terminated the process "iexplorer.exe" started by System, the problem is gone. However, when I reboot, the problem will get back again.

    Scanned my comp with updated AVG Free edition in safe mode, but did not detect any virus.

    Scanned with online scanner Panda. The Report is as follows:

    ********************************************************

    Incident Status Location

    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.bs.serving-sys.com/]
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.serving-sys.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.hitbox.com/]
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.doubleclick.net/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.tradedoubler.com/]
    Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.statcounter.com/]
    Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.adtech.de/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.atdmt.com/]
    Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[statse.webtrendslive.com/]
    Spyware:Cookie/Go Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.go.com/]
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.mediaplex.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.ehg-dig.hitbox.com/]
    Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\dy57f3ss.default\cookies.txt[.valueclick.com/]
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.com.com/]
    Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.statcounter.com/]
    Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.zedo.com/]
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.serving-sys.com/]
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.bs.serving-sys.com/]
    Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.2o7.net/]
    Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[ad.yieldmanager.com/]
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.doubleclick.net/]
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.mediaplex.com/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.atdmt.com/]
    Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.adtech.de/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.hitbox.com/]
    Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.burstnet.com/]
    Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.casalemedia.com/]
    Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.go.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.ehg-dig.hitbox.com/]
    Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.anm.co.uk/]
    Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.questionmarket.com/]
    Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.tribalfusion.com/]
    Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.888.com/]
    Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[statse.webtrendslive.com/]
    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.advertising.com/]
    Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.revenue.net/]
    Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.as-us.falkag.net/]
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.realmedia.com/]
    Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.bravenet.com/]
    Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.hotlog.ru/]
    Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.spylog.com/]

    **********************continuation in next post ************
  2. 2006-12-20, 20:59 #2
    pjnec
    pjnec is offline
    Junior Member
    Join Date
    Dec 2006
    Posts
    7

    Default Continuation***

    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.phg.hitbox.com/]
    Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.adviva.net/]
    Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Master\Application Data\Mozilla\Firefox\Profiles\99glmtf5.default\cookies.txt[.belnk.com/]
    Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Master\Cookies\master@casalemedia[1].txt
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Master\Cookies\master@com[1].txt
    Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Master\Cookies\master@go[1].txt
    Adware:Adware/Gmter Not disinfected C:\Documents and Settings\Master\Local Settings\Temporary Internet Files\Content.IE5\9EWMF91W\popup[1].htm
    Adware:Adware/Popuper Not disinfected C:\WINDOWS\system32\slpube03.dll

    *****************************************************

    Scanned with Spybot Search and Destroy in Safe mode and removed everything it detected.


    *****************************************************


    Here is my HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 3:05:35 PM, on 12/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\NUS-VPN\cvpnd.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\qttask.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Chameleon Clock\ChamClock.exe
    C:\Program Files\Toshiba\Windows Utilities\FNESSE32.EXE
    C:\Program Files\TurboNote\tbnote.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Documents and Settings\Master\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.sg/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
    O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [TFncKy] C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
    O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [HomeAlarm] C:\Program Files\Chameleon Clock\ChamClock.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Fn-esse.lnk = C:\Program Files\Toshiba\Windows Utilities\FNESSE32.EXE
    O4 - Global Startup: TurboNote.lnk = C:\Program Files\TurboNote\tbnote.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136329400116
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: winnqw32 - winnqw32.dll (file missing)
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\NUS-VPN\cvpnd.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: Ken32 Driver Service - Unknown owner - C:\WINDOWS\System32\SVCH0ST
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SRS Labs License Service - SRS Labs - C:\Program Files\Common Files\SRS Labs Shared\Service\srslabslicenseservice.exe

    *********************************************************

    After doing all these, I still face the same problem with iexplore.exe after i reboot the computer.

    Regards,
    John
  3. 2006-12-25, 12:54 #3
    LonnyRJones
    LonnyRJones is offline
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Hi John

    C:\WINDOWS\system32\slpube03.dll < delete that file manualy

    Post a report from this tool if any FILES show
    F-Secure Blacklight: https://europe.f-secure.com/blacklight/try.shtml
    Click the i accept button near the bottom of that page.
    click the first download button (version with grapichal user interface)
    Download/save (not open) and run blacklite click > scan then > next, next again then exit
    there will be a new txt near blacklite. post it please.
    Important: If any files show Do not rename them YET.....legitimate files can be listed.

    Download and run Silentrunners.Vbs post the log it creates please
    http://www.silentrunners.org/sr_scriptuse.html click no to not skip the suplimentry searchs
    Wait until there is a All Done message !!, Then open and post the log next to it.
    Your antivirus script protection might interfear or alert, please allow it to run after a bit box will say done.
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006
  4. 2006-12-26, 04:00 #4
    pjnec
    pjnec is offline
    Junior Member
    Join Date
    Dec 2006
    Posts
    7

    Default

    Hi,

    I have manually deleted slpube03.dll in safe mode.

    Ran Backlight and here is the result:

    12/26/06 10:29:51 [Info]: BlackLight Engine 1.0.47 initialized
    12/26/06 10:29:51 [Info]: OS: 5.1 build 2600 (Service Pack 2)
    12/26/06 10:29:51 [Note]: 7019 4
    12/26/06 10:29:51 [Note]: 7005 0
    12/26/06 10:29:55 [Note]: 7006 0
    12/26/06 10:29:55 [Note]: 7011 1384
    12/26/06 10:29:56 [Note]: 7026 0
    12/26/06 10:29:56 [Note]: 7026 0
    12/26/06 10:30:15 [Note]: FSRAW library version 1.7.1020
    12/26/06 10:41:37 [Note]: 2000 1012
    12/26/06 10:49:40 [Note]: 7007 0

    ****************************************************

    Ran the Silent Runners script and here is the result:

    "Silent Runners.vbs", revision 49, http://www.silentrunners.org/
    Operating System: Windows XP SP2
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:
    ---------------------------------

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
    "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
    "MsnMsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
    "HomeAlarm" = "C:\Program Files\Chameleon Clock\ChamClock.exe" ["Softshape Dev."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
    "IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
    "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
    "00THotkey" = "C:\WINDOWS\System32\00THotkey.exe" ["TOSHIBA Corporation"]
    "000StTHK" = "000StTHK.exe" [null data]
    "TFNF5" = "TFNF5.exe" ["TOSHIBA Corp."]
    "SigmaTel StacMon" = "C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" ["SigmaTel Inc."]
    "Apoint" = "C:\Program Files\Apoint2K\Apoint.exe" ["Alps Electric Co., Ltd."]
    "TFncKy" = "C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe" ["TOSHIBA Corporation"]
    "TouchED" = "C:\Program Files\TOSHIBA\TouchED\TouchED.Exe" ["TOSHIBA Corporation"]
    "PadTouch" = ""C:\Program Files\TOSHIBA\PadTouch\PadExe.exe" [file not found]
    "AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]
    "IMJPMIG8.1" = ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32" [MS]
    "MSPY2002" = "C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC" [null data]
    "PHIME2002ASync" = "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC" [MS]
    "PHIME2002A" = "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName" [MS]
    "BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
    "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
    "QuickTime Task" = "C:\WINDOWS\system32\qttask.exe" [null data]
    "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
    "TPSMain" = "TPSMain.exe" ["TOSHIBA Corporation"]
    "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
    "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
    "1A:Stardock TrayMonitor" = "(empty string)" [file not found]
    "(Default)" = "(empty string)" [file not found]
    "Sony Ericsson PC Suite" = ""C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions" ["Sony Ericsson Mobile Communications AB"]
    "RegistryMechanic" = "(empty string)" [file not found]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
    \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "SSVHelper Class"
    \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
    {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "IeCatch2 Class"
    \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
    \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{C4213067-97B3-4929-9B98-B5600FBBBA13}" = "TouchED"
    -> {HKLM...CLSID} = "TouchShellExt Class"
    \InProcServer32\(Default) = "C:\Program Files\TOSHIBA\TouchED\TouchED.dll" ["TOSHIBA Corporation"]
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
    -> {HKLM...CLSID} = "Portable Media Devices Menu"
    \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
    "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
    -> {HKLM...CLSID} = "Microsoft Office Outlook"
    \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> {HKLM...CLSID} = (no title provided)
    \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
    -> {HKLM...CLSID} = "Outlook File Icon Extension"
    \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
    "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
    -> {HKLM...CLSID} = "RealOne Player Context Menu Class"
    \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
    "{5360490C-92EB-4BDB-8203-313CC9082133}" = "Shell PublishingExt Extension"
    -> {HKLM...CLSID} = "Shell PublishingExt Class"
    \InProcServer32\(Default) = "C:\WINDOWS\System32\slpube03.dll" [file not found]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
    -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
    \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
    -> {HKLM...CLSID} = "AVG7 Find Extension Class"
    \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager"
    -> {HKLM...CLSID} = "Sony Ericsson File Manager"
    \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {HKLM...CLSID} = "WinRAR"
    \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
    -> {HKLM...CLSID} = "My Sharing Folders"
    \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll" [MS]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    <<!>> "{93994DE8-8239-4655-B1D1-5F4E91300429}" = (no title provided)
    -> {HKLM...CLSID} = "DVDIdleShell Class"
    \InProcServer32\(Default) = "C:\PROGRA~1\DVDREG~1\DVDShell.dll" ["Fengtao Software Inc."]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    <<!>> igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
    <<!>> winnqw32\DLLName = "winnqw32.dll" [file not found]

    HKLM\Software\Classes\PROTOCOLS\Filter\
    <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
    -> {HKLM...CLSID} = (no title provided)
    \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

    HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
    {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
    -> {HKLM...CLSID} = "PDF Shell Extension"
    \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
    \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {HKLM...CLSID} = "WinRAR"
    \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {HKLM...CLSID} = "WinRAR"
    \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
    \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {HKLM...CLSID} = "WinRAR"
    \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


    Group Policies {GPedit.msc branch and setting}:
    -----------------------------------------------

    Note: detected settings may not have any effect.

    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

    "NoDrives" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    "NoViewOnDrive" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    "NoDesktopCleanupWizard" = (REG_DWORD) hex:0x00000001
    {unrecognized setting}

    "NoCDBurning" = (REG_DWORD) hex:0x00000001
    {unrecognized setting}

    "NoBandCustomize" = (REG_DWORD) hex:0x00000000
    {User Configuration|Administrative Templates|Windows Components|Internet Explorer|Toolbars|
    Disable customizing browser toolbars}

    "NoMovingBands" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    "NoCloseDragDropBands" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    "NoSetTaskbar" = (REG_DWORD) hex:0x00000000
    {User Configuration|Administrative Templates|Start Menu and Taskbar|
    Prevent changes to Taskbar and Start Menu Settings}

    "NoToolbarsOnTaskbar" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    "NoSaveSettings" = (REG_DWORD) hex:0x00000000
    {User Configuration|Administrative Templates|Desktop|
    Don't save settings at exit}

    "NoActiveDesktop" = (REG_DWORD) hex:0x00000000
    {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop|
    Disable Active Desktop}

    "ClassicShell" = (REG_DWORD) hex:0x00000000
    {User Configuration|Administrative Templates|Windows Components|Windows Explorer|
    Enable Classic Shell / Turn on Classic Shell}

    HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\

    "Colors" = (REG_DWORD) hex:0x00000000
    {unrecognized setting}

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

    "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
    {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    Shutdown: Allow system to be shut down without having to log on}

    "undockwithoutlogon" = (REG_DWORD) hex:0x00000001
    {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    Devices: Allow undock without having to log on}


    Active Desktop and Wallpaper:
    -----------------------------

    Active Desktop may be disabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


    Startup items in "Master" & "All Users" startup folders:
    --------------------------------------------------------

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
    "Fn-esse" -> shortcut to: "C:\Program Files\Toshiba\Windows Utilities\FNESSE32.EXE" ["TOSHIBA Corp."]
    "TurboNote" -> shortcut to: "C:\Program Files\TurboNote\tbnote.exe" ["WebCentre Ltd, New Zealand"]


    Winsock2 Service Provider DLLs:
    -------------------------------

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 35
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


    Toolbars, Explorer Bars, Extensions:
    ------------------------------------

    Toolbars

    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
    "{F2CF5485-4E02-4F68-819C-B92DE9277049}"
    -> {HKLM...CLSID} = "&Links"
    \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

    HKLM\Software\Microsoft\Internet Explorer\Toolbar\
    "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
    -> {HKLM...CLSID} = "FlashGet Bar"
    \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"]

    Explorer Bars

    HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

    HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research"
    Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
    InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]


    Running Services (Display Name, Service Name, Path {Service DLL}):
    ------------------------------------------------------------------

    AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
    AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
    Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]}
    Cisco Systems, Inc. VPN Service, CVPND, ""C:\Program Files\NUS-VPN\cvpnd.exe"" ["Cisco Systems, Inc."]
    Messenger Sharing USN Journal Reader service, usnsvc, "C:\WINDOWS\system32\svchost.exe -k usnsvc" {"C:\Program Files\MSN Messenger\usnsvc.dll" [MS]}
    Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


    Print Monitors:
    ---------------

    HKLM\System\CurrentControlSet\Control\Print\Monitors\
    BJ Language Monitor2\Driver = "CNBJMON2.DLL" [MS]
    Canon BJ Language Monitor PIXMA iP1000\Driver = "CNMLM6e.DLL" ["CANON INC."]
    HP CLJ2600n LM\Driver = "ZLHP2600.DLL" ["Zenographics, Inc."]
    Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
    PrimoMon\Driver = "Primomonnt.dll" [null data]


    ----------
    <<!>>: Suspicious data at a malware launch point.

    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + To search all directories of local fixed drives for DESKTOP.INI
    DLL launch points, use the -supp parameter or answer "No" at the
    first message box and "Yes" at the second message box.
    ---------- (total run time: 120 seconds, including 18 seconds for message boxes)
  5. 2006-12-27, 05:02 #5
    LonnyRJones
    LonnyRJones is offline
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Start Hijackthis and place a check next to these items If there.
    O20 - Winlogon Notify: winnqw32 - winnqw32.dll (file missing)
    ====================================
    Hit fix checked and close Hijackthis.

    How's that PC acting now ?
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006
  6. 2006-12-27, 12:10 #6
    pjnec
    pjnec is offline
    Junior Member
    Join Date
    Dec 2006
    Posts
    7

    Default

    Ok. Done as instructed. However, the PC is still having the same problem.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules