Divocodec trojan issue

Lynne · Sep 28, 2008

I seem to have picked up the above.

Having scaned with spybot S&D in regular and safe mode the pop ups have stopped, however I want to be sure that I've removed all possible files. Please find below HJT log file. Appreciate any help with this.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55:02, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\emMON.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\PROGRA~1\TCOYF\tcoyftray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lynne\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [emMON] emMON.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [TCOYFReminder] C:\PROGRA~1\TCOYF\tcoyftray.exe
O4 - HKCU\..\Run: [bone poke] C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\Bat Option Bore.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Billy')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Billy')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-1006\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all (User 'Billy')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Billy')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Administrator')
O4 - HKUS\S-1-5-21-436374069-1532298954-725345543-500\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193857180859
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 9368 bytes

muuli · Sep 29, 2008

Welcome to the Safer Networking. My name is muuli. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research. Please be patient and I'd be grateful if you would note the following:

1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic. Please stay at one forum for help.
3. Please continue reading posts until I give the All Clear. It is important to note this, as a clean looking HijackThis is not always a sign your system is clean.

Note: I am still in training at Malware Removal, however I will be working under the direct supervision of one of our Malware Experts. Any recommendations will first be approved before being given to you. Because of this, there may be a short delay in getting our responses to you, however be assured that we will be working diligently on your problem.

Lynne · Sep 29, 2008

Thanks Muuli appreciate your help.

muuli · Sep 29, 2008

Hi,

Step 1

If you have version 1.5, right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
Click on Mode > Advanced Mode. When it prompts you, click Yes.
On the left hand side, click on Tools.
Check (tick) this box if it is not yet ticked: Resident.
You will notice that Resident is now added under Tools. Click on Resident.
Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
Exit Spybot Search & Destroy.
Restart your computer for the changes to take effect.

Step 2

Download Lop S&D by Eric_71 and save it to your desktop.
Lop S&D will only run on Windows XP and Windows Vista

Disable your antivirus and antimalware programs so they do not interfere with the running of Lop S&D.
To see how to disable security programs visit this tutorial:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Double-click Lop S&D.exe
Choose the language by typing of the corresponding letter and press Enter
Click OK at the informative window
Type 1, to choose Option 1 (Search) then press Enter
Wait until the end of the scan
A report will be generated, post the contents of it in your next reply.

(Copy of the report can be found at this location: %systemdrive%\lopR.txt, in most cases C:\lopR.txt)

Step 3

Please post a fresh HijackThis log and Lop S&D log.

Lynne · Sep 29, 2008

Step 1
1. I have V 1.6.0.30
2. Presume this is why I didn't see the system tray icon go clear ?

Step 2

Guidance re: turning off antimalware and antivirus wasn't clear to my version, therefore I manually turned off from the Norton Protection Centre consol and AdAware. Hope this was ok.

New logs as follows:-

--------------------\\ Lop S&D 4.2.4-4 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Lynne ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 15.0.0.60 (Not Activated)
Firewall : Norton Internet Security 15.0.0.60 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total : 74 Go Free : 20 Go
D:\ (Local Disk) - NTFS - Total : 74 Go Free : 32 Go
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-09-2008|22:20 )
Option : [1] ( 29/09/2008|18:16 )

--------------------\\ Listing folders in APPLIC~1

[29/03/2008|10:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
[28/09/2008|12:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[24/04/2008|22:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/11/2007|20:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[03/02/2008|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[03/02/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[02/11/2007|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[20/03/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4
[21/03/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Eastman Kodak Company
[28/09/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/04/2008|14:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\kds_kodak
[21/03/2008|16:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[29/09/2008|18:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki
[28/09/2008|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[15/11/2007|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/11/2007|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[28/09/2008|14:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[29/09/2008|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[28/09/2008|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[31/10/2007|21:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[05/11/2007|20:33] C:\DOCUME~1\Billy\APPLIC~1\Adobe
[25/04/2008|18:50] C:\DOCUME~1\Billy\APPLIC~1\Apple Computer
[27/09/2008|21:34] C:\DOCUME~1\Billy\APPLIC~1\Google
[02/11/2007|23:33] C:\DOCUME~1\Billy\APPLIC~1\Identities
[04/11/2007|15:47] C:\DOCUME~1\Billy\APPLIC~1\Macromedia
[04/08/2008|19:39] C:\DOCUME~1\Billy\APPLIC~1\Microsoft
[04/08/2008|19:37] C:\DOCUME~1\Billy\APPLIC~1\Real
[06/12/2007|21:34] C:\DOCUME~1\Billy\APPLIC~1\Symantec

[29/03/2008|10:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[31/10/2007|18:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[07/11/2007|19:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[20/05/2008|13:40] C:\DOCUME~1\Lynne\APPLIC~1\Adobe
[15/11/2007|21:24] C:\DOCUME~1\Lynne\APPLIC~1\Ahead
[24/04/2008|22:00] C:\DOCUME~1\Lynne\APPLIC~1\Apple Computer
[05/11/2007|21:02] C:\DOCUME~1\Lynne\APPLIC~1\COWON
[02/11/2007|23:46] C:\DOCUME~1\Lynne\APPLIC~1\DivX
[15/11/2007|19:58] C:\DOCUME~1\Lynne\APPLIC~1\Flickr
[28/09/2008|11:30] C:\DOCUME~1\Lynne\APPLIC~1\Google
[07/12/2007|13:33] C:\DOCUME~1\Lynne\APPLIC~1\Help
[31/10/2007|18:58] C:\DOCUME~1\Lynne\APPLIC~1\Identities
[05/11/2007|16:54] C:\DOCUME~1\Lynne\APPLIC~1\Macromedia
[19/05/2008|16:58] C:\DOCUME~1\Lynne\APPLIC~1\Microsoft
[03/11/2007|18:30] C:\DOCUME~1\Lynne\APPLIC~1\Ovusoft
[17/09/2008|12:19] C:\DOCUME~1\Lynne\APPLIC~1\Real
[05/12/2007|23:30] C:\DOCUME~1\Lynne\APPLIC~1\Symantec
[25/09/2008|21:27] C:\DOCUME~1\Lynne\APPLIC~1\thatrealhole
[27/09/2008|08:37] C:\DOCUME~1\Lynne\APPLIC~1\uTorrent
[15/11/2007|21:10] C:\DOCUME~1\Lynne\APPLIC~1\WinMount

[02/11/2007|23:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[29/09/2008 18:00][--ah-----] C:\WINDOWS\tasks\AC589F15918B1E11.job
[26/09/2008 12:43][--a------] C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[11/09/2008 22:39][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[22/09/2008 20:00][--a------] C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Lynne.job
[29/09/2008 18:07][--ah-----] C:\WINDOWS\tasks\SA.DAT
[29/08/2002 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( AC589F15918B1E11.job )=( c:\docume~1\lynne\applic~1\thatre~1\KeepDownloadGpl.exe )

--------------------\\ Listing Folders in C:\Program Files

[04/11/2007|19:15] C:\Program Files\2
[03/02/2008|18:46] C:\Program Files\ABC Amber Audio Converter
[28/09/2008|14:07] C:\Program Files\Adobe
[17/04/2008|20:10] C:\Program Files\Apple Software Update
[31/10/2007|23:27] C:\Program Files\ATI Technologies
[16/04/2008|18:55] C:\Program Files\AVI to MPEG Converter
[03/02/2008|20:43] C:\Program Files\Bonjour
[31/10/2007|19:49] C:\Program Files\Broadcom
[20/03/2008|21:22] C:\Program Files\Channel4
[28/09/2008|11:48] C:\Program Files\Common Files
[31/10/2007|18:15] C:\Program Files\ComPlus Applications
[31/10/2007|21:15] C:\Program Files\Creative
[01/11/2007|20:44] C:\Program Files\CyberLink
[31/10/2007|20:01] C:\Program Files\Dell
[25/09/2008|21:30] C:\Program Files\DivX
[28/09/2008|14:53] C:\Program Files\Exterminate It!
[03/11/2007|18:18] C:\Program Files\Flickr Uploadr
[29/09/2008|16:03] C:\Program Files\Google
[24/04/2008|22:35] C:\Program Files\InstallShield Installation Information
[13/08/2008|22:06] C:\Program Files\Internet Explorer
[17/04/2008|20:26] C:\Program Files\iPod
[17/04/2008|20:26] C:\Program Files\iTunes
[25/09/2008|21:18] C:\Program Files\JetAudio
[21/03/2008|16:46] C:\Program Files\Kodak
[20/03/2008|21:22] C:\Program Files\Kontiki
[03/11/2007|18:28] C:\Program Files\KWorld Multimedia
[28/09/2008|11:48] C:\Program Files\Lavasoft
[06/11/2007|20:48] C:\Program Files\Logitech
[15/11/2007|23:22] C:\Program Files\MagicISO
[14/08/2008|11:12] C:\Program Files\Messenger
[31/10/2007|19:02] C:\Program Files\Microsoft ActiveSync
[31/10/2007|18:19] C:\Program Files\microsoft frontpage
[31/10/2007|19:01] C:\Program Files\Microsoft Office
[31/10/2007|19:01] C:\Program Files\Microsoft Visual Studio
[31/10/2007|19:01] C:\Program Files\Microsoft Works
[31/10/2007|19:02] C:\Program Files\Microsoft.NET
[31/10/2007|18:16] C:\Program Files\Movie Maker
[01/11/2007|18:23] C:\Program Files\MSBuild
[31/10/2007|18:14] C:\Program Files\MSN
[31/10/2007|18:14] C:\Program Files\MSN Gaming Zone
[24/03/2008|22:44] C:\Program Files\MSXML 4.0
[01/11/2007|21:17] C:\Program Files\MSXML 6.0
[29/03/2008|17:55] C:\Program Files\Music Coach
[01/11/2007|20:35] C:\Program Files\Nero
[31/10/2007|18:16] C:\Program Files\NetMeeting
[22/12/2007|01:34] C:\Program Files\Norton Internet Security
[31/10/2007|18:14] C:\Program Files\Online Services
[01/11/2007|08:06] C:\Program Files\Outlook Express
[17/04/2008|20:24] C:\Program Files\QuickTime
[04/08/2008|19:31] C:\Program Files\Real
[01/11/2007|18:19] C:\Program Files\Reference Assemblies
[28/09/2008|11:51] C:\Program Files\Spybot - Search & Destroy
[07/06/2008|18:36] C:\Program Files\Symantec
[05/11/2007|16:07] C:\Program Files\TCOYF
[25/09/2008|21:26] C:\Program Files\thatrealhole
[31/10/2007|18:58] C:\Program Files\Uninstall Information
[09/05/2008|00:32] C:\Program Files\uTorrent
[01/11/2007|08:04] C:\Program Files\Windows Media Connect 2
[01/11/2007|20:44] C:\Program Files\Windows Media Player
[31/10/2007|18:14] C:\Program Files\Windows NT
[05/12/2007|23:28] C:\Program Files\Windows Sidebar
[31/10/2007|18:17] C:\Program Files\WindowsUpdate
[01/11/2007|20:51] C:\Program Files\WinRAR
[15/11/2007|23:06] C:\Program Files\WinZip
[31/10/2007|18:19] C:\Program Files\xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[24/04/2008|22:43] C:\Program Files\Common Files\Adobe
[01/11/2007|20:36] C:\Program Files\Common Files\Ahead
[03/02/2008|20:39] C:\Program Files\Common Files\Apple
[25/09/2008|21:16] C:\Program Files\Common Files\COWON
[31/10/2007|19:01] C:\Program Files\Common Files\DESIGNER
[31/10/2007|23:26] C:\Program Files\Common Files\InstallShield
[21/03/2008|16:45] C:\Program Files\Common Files\Kodak
[31/10/2007|19:02] C:\Program Files\Common Files\L&H
[06/11/2007|20:32] C:\Program Files\Common Files\logishrd
[05/12/2007|23:02] C:\Program Files\Common Files\Microsoft Shared
[31/10/2007|18:16] C:\Program Files\Common Files\MSSoap
[31/10/2007|01:08] C:\Program Files\Common Files\ODBC
[04/08/2008|19:32] C:\Program Files\Common Files\Real
[31/10/2007|18:16] C:\Program Files\Common Files\Services
[31/10/2007|01:08] C:\Program Files\Common Files\SpeechEngines
[29/09/2008|18:14] C:\Program Files\Common Files\Symantec Shared
[01/11/2007|08:06] C:\Program Files\Common Files\System
[28/09/2008|11:48] C:\Program Files\Common Files\Wise Installation Wizard
[04/08/2008|19:32] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 43 Processes )

IEXPLORE.EXE ~ [PID:3144]
iexplore.exe ~ [PID:2228]

--------------------\\ Searching with S_Lop

C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\Bat Option Bore.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\fugojyzb.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\gunktdbb.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\Keep Download Gpl.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\namrwasc.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\svfxnfbc.exe
C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\wazjcufd.exe

--------------------\\ Searching for Lop Files - Folders

C:\DOCUME~1\Lynne\APPLIC~1\thatre~1
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\Bat Option Bore.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\fugojyzb.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\gunktdbb.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\Keep Download Gpl.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\namrwasc.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\svfxnfbc.exe
C:\DOCUME~1\Lynne\APPLIC~1\thatre~1\wazjcufd.exe
C:\Program Files\thatre~1
C:\DOCUME~1\Lynne\Cookies\lynne@accva.advertserve[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@ecnext.advertserve[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@adultfriendfinder[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@advertising.marketnetwork[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@advertising[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@adopt.euroclick[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@partypoker[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@32vegas[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@banner.32vegas[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@cachewww.32vegas[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@govegas.about[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@las-vegas-hotels.tripadvisor[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@lasvegastickets[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@vegasview[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@vegas[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www.accessvegas[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www.lasvegastickets[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www.vegasaffiliates[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www.vegasview[2].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www9.vegas[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@www.lop[1].txt
C:\DOCUME~1\Lynne\Cookies\lynne@888ladies[2].txt
C:\WINDOWS\Tasks\AC589F15918B1E11.job

--------------------\\ Searching within the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dale bend less]
"DisplayName"="CiD Help"
"UninstallString"="C:\\DOCUME~1\\Lynne\\APPLIC~1\\THATRE~1\\Bat Option Bore.exe -uninstall"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bone poke"="C:\\DOCUME~1\\Lynne\\APPLIC~1\\THATRE~1\\Bat Option Bore.exe"
"bone poke"="C:\\DOCUME~1\\Lynne\\APPLIC~1\\THATRE~1\\Bat Option Bore.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-29 18:18:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

No other infections found !

[F:16][D:13]-> C:\DOCUME~1\Lynne\LOCALS~1\Temp
[F:2337][D:0]-> C:\DOCUME~1\Lynne\Cookies
[F:36271][D:35]-> C:\DOCUME~1\Lynne\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 29/09/2008|18:21 - Option : [1]

--------------------\\ Scan completed at 18:21:56

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:39, on 29/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\emMON.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\PROGRA~1\TCOYF\tcoyftray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Documents and Settings\Lynne\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [emMON] emMON.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [TCOYFReminder] C:\PROGRA~1\TCOYF\tcoyftray.exe
O4 - HKCU\..\Run: [bone poke] C:\DOCUME~1\Lynne\APPLIC~1\THATRE~1\Bat Option Bore.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193857180859
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8424 bytes

muuli · Sep 30, 2008

Hi,

Lynne said:
1. I have V 1.6.0.30
2. Presume this is why I didn't see the system tray icon go clear ?

I'm not sure, but teatimer don't cause any problems now because it's not running anymore.

Do you know what is this? Or please tell me what that folder including.
C:\Program Files\2

Step 1

Please remove via Add or Remove Programs (press Start -> Controlpanel -> Add or Remove Promgrams):
uTorrent

Step 2

Press Start -> My Computer -> Local Disk (C)
Locate the following folder using the path below. If found please delete.
C:\Program Files\uTorrent

Step 3

Please produce uninstall list:

Open HijackThis.
Click on the Open the Misc Tools section button.
Look under System tools.
Click on the Open Uninstall Manager... button.
Click on the Save list... button.
It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
Notepad will open. Please post this log in your next reply.

Lynne · Sep 30, 2008

C:\Program Files\2 - relates to bought online software and contains a .log file and a .htm file.

I am unable to uninstall utorrent via add/remove progms as it does not show there nor under start/ all prgms. The only way I see to remove is via C/prgm files. Do you want me to remove this way ?

I haven't attempted Step 3 yet given the above.

Await your update. Thanks.

muuli · Oct 1, 2008

Hi,

Yes, please remove that uTorrent folder and then go to Step 3.

Lynne · Oct 2, 2008

Step 2 - complete

Step 3

4oD
ABC Amber Audio Converter
Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2
aiofw
aioocr
aioprnt
aioscnnr
AppCore
Apple Mobile Device Support
Apple Software Update
ATI Control Panel
ATI Display Driver
AVI to MPEG Converter
BBC iPlayer Download Manager
Bonjour
Broadcom Driver Installer
ccCommon
CCScore
center
Component Framework
COWON Media Center - jetAudio Basic
DivX Player
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSSONIC
ESSTOOLS
essvatgt
Flickr Uploadr 2.5.0.15
Help_CTR
helptut
helpug
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
HyperMediaCenter
Intel(R) 537EP V9x DF PCI Modem
Intel(R) PRO Network Connections Drivers
iTunes
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
KODAK All-in-One Printer Software
ksdip
Learn Keyboard
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Macromedia Shockwave Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
Music Coach Player
Nero 7 Ultra Edition
netbrdg
Norton AntiVirus
Norton AntiVirus Help
Norton Confidential Core
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
OfotoXMI
PowerDVD
QuickTime
RealPlayer
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
SFR
SHASTA
skin0001
SKINXSDK
Sound Blaster Live!
SPBBC 32bit
Spybot - Search & Destroy
staticcr
Taking Charge of Your Fertility Software
tooltips
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
VPRINTOL
Windows Communication Foundation
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
WinZip
WIRELESS

muuli · Oct 2, 2008

Hi,

Step 1

Double click LopSD.exe to start the program.

Choose the language by typing of the corresponding letter and press Enter
Click OK at the informative window
Type 3 to choose Option 3 (Fix - Hosts), then press Enter
Don't close the window during suppression!
Wait until the end of the scan
A report will be generated, post the contents of it in your next reply.

(Copy of the report can be found at this location: %systemdrive%\lopR.txt, in most cases C:\lopR.txt)

Step 2

Please post a fresh HijackThis log and Lop S&D log.

Lynne · Oct 2, 2008

Step 1

I originally ran this however decided to run again after turning off Norton and Teatimer. Unfortunately I don't have a copy of the original report (overwritten).

--------------------\\ Lop S&D 4.2.4-4 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Lynne ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 15.0.0.60 (Not Activated)
Firewall : Norton Internet Security 15.0.0.60 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total : 74 Go Free : 20 Go
D:\ (Local Disk) - NTFS - Total : 74 Go Free : 32 Go
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-09-2008|22:20 )
Option : [3] ( 02/10/2008|17:31 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX

Deleted! - C:\DOCUME~1\Lynne\Cookies\lynne@advertising[1].txt

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing folders in APPLIC~1

[29/03/2008|10:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
[28/09/2008|12:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[24/04/2008|22:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/11/2007|20:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[03/02/2008|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[03/02/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[02/11/2007|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[20/03/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4
[21/03/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Eastman Kodak Company
[28/09/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/04/2008|14:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\kds_kodak
[21/03/2008|16:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[02/10/2008|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki
[28/09/2008|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[15/11/2007|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/11/2007|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[28/09/2008|14:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[02/10/2008|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[28/09/2008|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[31/10/2007|21:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[05/11/2007|20:33] C:\DOCUME~1\Billy\APPLIC~1\Adobe
[25/04/2008|18:50] C:\DOCUME~1\Billy\APPLIC~1\Apple Computer
[27/09/2008|21:34] C:\DOCUME~1\Billy\APPLIC~1\Google
[02/11/2007|23:33] C:\DOCUME~1\Billy\APPLIC~1\Identities
[04/11/2007|15:47] C:\DOCUME~1\Billy\APPLIC~1\Macromedia
[04/08/2008|19:39] C:\DOCUME~1\Billy\APPLIC~1\Microsoft
[04/08/2008|19:37] C:\DOCUME~1\Billy\APPLIC~1\Real
[06/12/2007|21:34] C:\DOCUME~1\Billy\APPLIC~1\Symantec

[29/03/2008|10:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[31/10/2007|18:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[07/11/2007|19:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[20/05/2008|13:40] C:\DOCUME~1\Lynne\APPLIC~1\Adobe
[15/11/2007|21:24] C:\DOCUME~1\Lynne\APPLIC~1\Ahead
[24/04/2008|22:00] C:\DOCUME~1\Lynne\APPLIC~1\Apple Computer
[05/11/2007|21:02] C:\DOCUME~1\Lynne\APPLIC~1\COWON
[02/11/2007|23:46] C:\DOCUME~1\Lynne\APPLIC~1\DivX
[15/11/2007|19:58] C:\DOCUME~1\Lynne\APPLIC~1\Flickr
[28/09/2008|11:30] C:\DOCUME~1\Lynne\APPLIC~1\Google
[07/12/2007|13:33] C:\DOCUME~1\Lynne\APPLIC~1\Help
[31/10/2007|18:58] C:\DOCUME~1\Lynne\APPLIC~1\Identities
[05/11/2007|16:54] C:\DOCUME~1\Lynne\APPLIC~1\Macromedia
[19/05/2008|16:58] C:\DOCUME~1\Lynne\APPLIC~1\Microsoft
[03/11/2007|18:30] C:\DOCUME~1\Lynne\APPLIC~1\Ovusoft
[17/09/2008|12:19] C:\DOCUME~1\Lynne\APPLIC~1\Real
[05/12/2007|23:30] C:\DOCUME~1\Lynne\APPLIC~1\Symantec
[27/09/2008|08:37] C:\DOCUME~1\Lynne\APPLIC~1\uTorrent
[15/11/2007|21:10] C:\DOCUME~1\Lynne\APPLIC~1\WinMount

[02/11/2007|23:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[02/10/2008 12:43][--a------] C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[11/09/2008 22:39][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[29/09/2008 20:00][--a------] C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Lynne.job
[02/10/2008 17:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[29/08/2002 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[30/09/2008|22:13] C:\Program Files\2
[03/02/2008|18:46] C:\Program Files\ABC Amber Audio Converter
[28/09/2008|14:07] C:\Program Files\Adobe
[17/04/2008|20:10] C:\Program Files\Apple Software Update
[31/10/2007|23:27] C:\Program Files\ATI Technologies
[16/04/2008|18:55] C:\Program Files\AVI to MPEG Converter
[03/02/2008|20:43] C:\Program Files\Bonjour
[31/10/2007|19:49] C:\Program Files\Broadcom
[20/03/2008|21:22] C:\Program Files\Channel4
[28/09/2008|11:48] C:\Program Files\Common Files
[31/10/2007|18:15] C:\Program Files\ComPlus Applications
[31/10/2007|21:15] C:\Program Files\Creative
[01/11/2007|20:44] C:\Program Files\CyberLink
[31/10/2007|20:01] C:\Program Files\Dell
[25/09/2008|21:30] C:\Program Files\DivX
[28/09/2008|14:53] C:\Program Files\Exterminate It!
[03/11/2007|18:18] C:\Program Files\Flickr Uploadr
[29/09/2008|16:03] C:\Program Files\Google
[24/04/2008|22:35] C:\Program Files\InstallShield Installation Information
[13/08/2008|22:06] C:\Program Files\Internet Explorer
[17/04/2008|20:26] C:\Program Files\iPod
[17/04/2008|20:26] C:\Program Files\iTunes
[25/09/2008|21:18] C:\Program Files\JetAudio
[21/03/2008|16:46] C:\Program Files\Kodak
[20/03/2008|21:22] C:\Program Files\Kontiki
[03/11/2007|18:28] C:\Program Files\KWorld Multimedia
[28/09/2008|11:48] C:\Program Files\Lavasoft
[06/11/2007|20:48] C:\Program Files\Logitech
[15/11/2007|23:22] C:\Program Files\MagicISO
[14/08/2008|11:12] C:\Program Files\Messenger
[31/10/2007|19:02] C:\Program Files\Microsoft ActiveSync
[31/10/2007|18:19] C:\Program Files\microsoft frontpage
[31/10/2007|19:01] C:\Program Files\Microsoft Office
[31/10/2007|19:01] C:\Program Files\Microsoft Visual Studio
[31/10/2007|19:01] C:\Program Files\Microsoft Works
[31/10/2007|19:02] C:\Program Files\Microsoft.NET
[31/10/2007|18:16] C:\Program Files\Movie Maker
[01/11/2007|18:23] C:\Program Files\MSBuild
[31/10/2007|18:14] C:\Program Files\MSN
[31/10/2007|18:14] C:\Program Files\MSN Gaming Zone
[24/03/2008|22:44] C:\Program Files\MSXML 4.0
[01/11/2007|21:17] C:\Program Files\MSXML 6.0
[29/03/2008|17:55] C:\Program Files\Music Coach
[01/11/2007|20:35] C:\Program Files\Nero
[31/10/2007|18:16] C:\Program Files\NetMeeting
[22/12/2007|01:34] C:\Program Files\Norton Internet Security
[31/10/2007|18:14] C:\Program Files\Online Services
[01/11/2007|08:06] C:\Program Files\Outlook Express
[17/04/2008|20:24] C:\Program Files\QuickTime
[04/08/2008|19:31] C:\Program Files\Real
[01/11/2007|18:19] C:\Program Files\Reference Assemblies
[28/09/2008|11:51] C:\Program Files\Spybot - Search & Destroy
[07/06/2008|18:36] C:\Program Files\Symantec
[05/11/2007|16:07] C:\Program Files\TCOYF
[31/10/2007|18:58] C:\Program Files\Uninstall Information
[01/11/2007|08:04] C:\Program Files\Windows Media Connect 2
[01/11/2007|20:44] C:\Program Files\Windows Media Player
[31/10/2007|18:14] C:\Program Files\Windows NT
[05/12/2007|23:28] C:\Program Files\Windows Sidebar
[31/10/2007|18:17] C:\Program Files\WindowsUpdate
[01/11/2007|20:51] C:\Program Files\WinRAR
[15/11/2007|23:06] C:\Program Files\WinZip
[31/10/2007|18:19] C:\Program Files\xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[24/04/2008|22:43] C:\Program Files\Common Files\Adobe
[01/11/2007|20:36] C:\Program Files\Common Files\Ahead
[03/02/2008|20:39] C:\Program Files\Common Files\Apple
[25/09/2008|21:16] C:\Program Files\Common Files\COWON
[31/10/2007|19:01] C:\Program Files\Common Files\DESIGNER
[31/10/2007|23:26] C:\Program Files\Common Files\InstallShield
[21/03/2008|16:45] C:\Program Files\Common Files\Kodak
[31/10/2007|19:02] C:\Program Files\Common Files\L&H
[06/11/2007|20:32] C:\Program Files\Common Files\logishrd
[05/12/2007|23:02] C:\Program Files\Common Files\Microsoft Shared
[31/10/2007|18:16] C:\Program Files\Common Files\MSSoap
[31/10/2007|01:08] C:\Program Files\Common Files\ODBC
[04/08/2008|19:32] C:\Program Files\Common Files\Real
[31/10/2007|18:16] C:\Program Files\Common Files\Services
[31/10/2007|01:08] C:\Program Files\Common Files\SpeechEngines
[02/10/2008|17:30] C:\Program Files\Common Files\Symantec Shared
[01/11/2007|08:06] C:\Program Files\Common Files\System
[28/09/2008|11:48] C:\Program Files\Common Files\Wise Installation Wizard
[04/08/2008|19:32] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 42 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 17:34:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

No other infections found !

[F:20][D:13]-> C:\DOCUME~1\Lynne\LOCALS~1\Temp
[F:2331][D:0]-> C:\DOCUME~1\Lynne\Cookies
[F:36251][D:35]-> C:\DOCUME~1\Lynne\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 29/09/2008|18:21 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 02/10/2008|17:20 - Option : [3]
3 - "C:\Lop SD\LopR_3.txt" - 02/10/2008|17:38 - Option : [3]

--------------------\\ Scan completed at 17:38:03

Step 2

These scans have also been done with Teatimer and Norton turned off

--------------------\\ Lop S&D 4.2.4-4 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Lynne ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 15.0.0.60 (Not Activated)
Firewall : Norton Internet Security 15.0.0.60 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total : 74 Go Free : 20 Go
D:\ (Local Disk) - NTFS - Total : 74 Go Free : 32 Go
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-09-2008|22:20 )
Option : [1] ( 02/10/2008|17:41 )

--------------------\\ Listing folders in APPLIC~1

[29/03/2008|10:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\Apple Computer
[28/09/2008|12:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[24/04/2008|22:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/11/2007|20:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[03/02/2008|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[03/02/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[02/11/2007|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[20/03/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4
[21/03/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Eastman Kodak Company
[28/09/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/04/2008|14:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\kds_kodak
[21/03/2008|16:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[02/10/2008|17:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki
[28/09/2008|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[15/11/2007|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/11/2007|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[28/09/2008|14:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[02/10/2008|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[28/09/2008|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[31/10/2007|21:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[05/11/2007|20:33] C:\DOCUME~1\Billy\APPLIC~1\Adobe
[25/04/2008|18:50] C:\DOCUME~1\Billy\APPLIC~1\Apple Computer
[27/09/2008|21:34] C:\DOCUME~1\Billy\APPLIC~1\Google
[02/11/2007|23:33] C:\DOCUME~1\Billy\APPLIC~1\Identities
[04/11/2007|15:47] C:\DOCUME~1\Billy\APPLIC~1\Macromedia
[04/08/2008|19:39] C:\DOCUME~1\Billy\APPLIC~1\Microsoft
[04/08/2008|19:37] C:\DOCUME~1\Billy\APPLIC~1\Real
[06/12/2007|21:34] C:\DOCUME~1\Billy\APPLIC~1\Symantec

[29/03/2008|10:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[31/10/2007|18:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[07/11/2007|19:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[20/05/2008|13:40] C:\DOCUME~1\Lynne\APPLIC~1\Adobe
[15/11/2007|21:24] C:\DOCUME~1\Lynne\APPLIC~1\Ahead
[24/04/2008|22:00] C:\DOCUME~1\Lynne\APPLIC~1\Apple Computer
[05/11/2007|21:02] C:\DOCUME~1\Lynne\APPLIC~1\COWON
[02/11/2007|23:46] C:\DOCUME~1\Lynne\APPLIC~1\DivX
[15/11/2007|19:58] C:\DOCUME~1\Lynne\APPLIC~1\Flickr
[28/09/2008|11:30] C:\DOCUME~1\Lynne\APPLIC~1\Google
[07/12/2007|13:33] C:\DOCUME~1\Lynne\APPLIC~1\Help
[31/10/2007|18:58] C:\DOCUME~1\Lynne\APPLIC~1\Identities
[05/11/2007|16:54] C:\DOCUME~1\Lynne\APPLIC~1\Macromedia
[19/05/2008|16:58] C:\DOCUME~1\Lynne\APPLIC~1\Microsoft
[03/11/2007|18:30] C:\DOCUME~1\Lynne\APPLIC~1\Ovusoft
[17/09/2008|12:19] C:\DOCUME~1\Lynne\APPLIC~1\Real
[05/12/2007|23:30] C:\DOCUME~1\Lynne\APPLIC~1\Symantec
[27/09/2008|08:37] C:\DOCUME~1\Lynne\APPLIC~1\uTorrent
[15/11/2007|21:10] C:\DOCUME~1\Lynne\APPLIC~1\WinMount

[02/11/2007|23:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[02/10/2008 12:43][--a------] C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[11/09/2008 22:39][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[29/09/2008 20:00][--a------] C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Lynne.job
[02/10/2008 17:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[29/08/2002 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[30/09/2008|22:13] C:\Program Files\2
[03/02/2008|18:46] C:\Program Files\ABC Amber Audio Converter
[28/09/2008|14:07] C:\Program Files\Adobe
[17/04/2008|20:10] C:\Program Files\Apple Software Update
[31/10/2007|23:27] C:\Program Files\ATI Technologies
[16/04/2008|18:55] C:\Program Files\AVI to MPEG Converter
[03/02/2008|20:43] C:\Program Files\Bonjour
[31/10/2007|19:49] C:\Program Files\Broadcom
[20/03/2008|21:22] C:\Program Files\Channel4
[28/09/2008|11:48] C:\Program Files\Common Files
[31/10/2007|18:15] C:\Program Files\ComPlus Applications
[31/10/2007|21:15] C:\Program Files\Creative
[01/11/2007|20:44] C:\Program Files\CyberLink
[31/10/2007|20:01] C:\Program Files\Dell
[25/09/2008|21:30] C:\Program Files\DivX
[28/09/2008|14:53] C:\Program Files\Exterminate It!
[03/11/2007|18:18] C:\Program Files\Flickr Uploadr
[29/09/2008|16:03] C:\Program Files\Google
[24/04/2008|22:35] C:\Program Files\InstallShield Installation Information
[13/08/2008|22:06] C:\Program Files\Internet Explorer
[17/04/2008|20:26] C:\Program Files\iPod
[17/04/2008|20:26] C:\Program Files\iTunes
[25/09/2008|21:18] C:\Program Files\JetAudio
[21/03/2008|16:46] C:\Program Files\Kodak
[20/03/2008|21:22] C:\Program Files\Kontiki
[03/11/2007|18:28] C:\Program Files\KWorld Multimedia
[28/09/2008|11:48] C:\Program Files\Lavasoft
[06/11/2007|20:48] C:\Program Files\Logitech
[15/11/2007|23:22] C:\Program Files\MagicISO
[14/08/2008|11:12] C:\Program Files\Messenger
[31/10/2007|19:02] C:\Program Files\Microsoft ActiveSync
[31/10/2007|18:19] C:\Program Files\microsoft frontpage
[31/10/2007|19:01] C:\Program Files\Microsoft Office
[31/10/2007|19:01] C:\Program Files\Microsoft Visual Studio
[31/10/2007|19:01] C:\Program Files\Microsoft Works
[31/10/2007|19:02] C:\Program Files\Microsoft.NET
[31/10/2007|18:16] C:\Program Files\Movie Maker
[01/11/2007|18:23] C:\Program Files\MSBuild
[31/10/2007|18:14] C:\Program Files\MSN
[31/10/2007|18:14] C:\Program Files\MSN Gaming Zone
[24/03/2008|22:44] C:\Program Files\MSXML 4.0
[01/11/2007|21:17] C:\Program Files\MSXML 6.0
[29/03/2008|17:55] C:\Program Files\Music Coach
[01/11/2007|20:35] C:\Program Files\Nero
[31/10/2007|18:16] C:\Program Files\NetMeeting
[22/12/2007|01:34] C:\Program Files\Norton Internet Security
[31/10/2007|18:14] C:\Program Files\Online Services
[01/11/2007|08:06] C:\Program Files\Outlook Express
[17/04/2008|20:24] C:\Program Files\QuickTime
[04/08/2008|19:31] C:\Program Files\Real
[01/11/2007|18:19] C:\Program Files\Reference Assemblies
[28/09/2008|11:51] C:\Program Files\Spybot - Search & Destroy
[07/06/2008|18:36] C:\Program Files\Symantec
[05/11/2007|16:07] C:\Program Files\TCOYF
[31/10/2007|18:58] C:\Program Files\Uninstall Information
[01/11/2007|08:04] C:\Program Files\Windows Media Connect 2
[01/11/2007|20:44] C:\Program Files\Windows Media Player
[31/10/2007|18:14] C:\Program Files\Windows NT
[05/12/2007|23:28] C:\Program Files\Windows Sidebar
[31/10/2007|18:17] C:\Program Files\WindowsUpdate
[01/11/2007|20:51] C:\Program Files\WinRAR
[15/11/2007|23:06] C:\Program Files\WinZip
[31/10/2007|18:19] C:\Program Files\xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[24/04/2008|22:43] C:\Program Files\Common Files\Adobe
[01/11/2007|20:36] C:\Program Files\Common Files\Ahead
[03/02/2008|20:39] C:\Program Files\Common Files\Apple
[25/09/2008|21:16] C:\Program Files\Common Files\COWON
[31/10/2007|19:01] C:\Program Files\Common Files\DESIGNER
[31/10/2007|23:26] C:\Program Files\Common Files\InstallShield
[21/03/2008|16:45] C:\Program Files\Common Files\Kodak
[31/10/2007|19:02] C:\Program Files\Common Files\L&H
[06/11/2007|20:32] C:\Program Files\Common Files\logishrd
[05/12/2007|23:02] C:\Program Files\Common Files\Microsoft Shared
[31/10/2007|18:16] C:\Program Files\Common Files\MSSoap
[31/10/2007|01:08] C:\Program Files\Common Files\ODBC
[04/08/2008|19:32] C:\Program Files\Common Files\Real
[31/10/2007|18:16] C:\Program Files\Common Files\Services
[31/10/2007|01:08] C:\Program Files\Common Files\SpeechEngines
[02/10/2008|17:30] C:\Program Files\Common Files\Symantec Shared
[01/11/2007|08:06] C:\Program Files\Common Files\System
[28/09/2008|11:48] C:\Program Files\Common Files\Wise Installation Wizard
[04/08/2008|19:32] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 42 Processes )

iexplore.exe ~ [PID:2888]

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 17:42:41
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

No other infections found !

[F:20][D:13]-> C:\DOCUME~1\Lynne\LOCALS~1\Temp
[F:2331][D:0]-> C:\DOCUME~1\Lynne\Cookies
[F:36251][D:35]-> C:\DOCUME~1\Lynne\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 29/09/2008|18:21 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 02/10/2008|17:20 - Option : [3]
3 - "C:\Lop SD\LopR_3.txt" - 02/10/2008|17:38 - Option : [3]
4 - "C:\Lop SD\LopR_4.txt" - 02/10/2008|17:44 - Option : [1]

--------------------\\ Scan completed at 17:44:56

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:01, on 02/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\emMON.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\PROGRA~1\TCOYF\tcoyftray.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lynne\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [emMON] emMON.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [TCOYFReminder] C:\PROGRA~1\TCOYF\tcoyftray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193857180859
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8180 bytes

muuli · Oct 2, 2008

Hi,

How your computer running now?

Step 1

Please remove via Add or Remove Programs (press Start -> Controlpanel -> Add or Remove Promgrams):
Adobe Reader 8.1.2

Step 2

Download a new version of Adobe Acrobat Reader.

Click here to download the latest version of Adobe Acrobat Reader.
Select your Windows version and click on Download. If you are using Internet Explorer, you will receive prompts. Allow the installation to be ran and it will be installed automatically for you.

If you are using other browsers, it will prompt you to save a file. Save this file to your desktop and run it to install the latest version of Adobe Reader.
Close your Internet browser and open it again.

If you don't like Adobe Reader, you can try Foxit PDF Reader. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Step 3

Show hidden files:
1. Click Start.
2. Open My Computer.
3. Select the Tools menu and click Folder Options.
4. Select the View Tab.
5. Under the Hidden files and folders heading select Show hidden files and folders.
6. Uncheck the Hide protected operating system files (recommended) option.
7. Click Yes to confirm.
8. Click OK.

Press Start -> My Computer -> Local Disk (C)
Locate the following folder using the path below. If found please delete.
C:\Documents and Settings\Lynne\Application Data\uTorrent

Step 4

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the "Perform Full Scan" option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step 5

Please post a fresh HijackThis log and Malwarebytes' Anti-Malware log.

Lynne · Oct 2, 2008

Thanks Muuli.

Step 1
Complete

Step 2
Complete

Step 3
Hidden files was already unchecked
Unchecked Hide protected operating system files (recommended) option

Step 4
I didn't get the option to:
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware

And had to manually check for updates

I didn't get an option for results or for any removal which I presume is because there was nothing found to be removed
Scan results:
Malwarebytes' Anti-Malware 1.28
Database version: 1226
Windows 5.1.2600 Service Pack 2

02/10/2008 21:44:06
mbam-log-2008-10-02 (21-44-06).txt

Scan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)
Objects scanned: 146459
Time elapsed: 1 hour(s), 10 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Step 5

I haven't run a new malware scan as there was nothing to remove. I also ran the hijackthis scan without Norton or Teatimer off. Hope this was ok.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:08, on 02/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\emMON.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\PROGRA~1\TCOYF\tcoyftray.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Lynne\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [emMON] emMON.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [TCOYFReminder] C:\PROGRA~1\TCOYF\tcoyftray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193857180859
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8624 bytes

muuli · Oct 3, 2008

Hi,

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Next...

Remove Lop S&D.exe, you will find it on your desktop.
Remove also this folder:
C:\Lop SD

Empty recycle bin.

Disable and Enable System Restore. - If you are using Windows XP or Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
- Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
- Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
- Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
  totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
  
  Malwarebytes' Anti-Malware Setup Guide
  
  Malwarebytes' Anti-Malware Scanning Guide
- Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
- Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety
- MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
- Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!

Lynne · Oct 5, 2008

Muuli,

Thanks for your help. I've followed your recommendations.

Can I ask what the reason was for uninstalling utorrent ? Am I safe to restore from recycle bin ?

muuli · Oct 5, 2008

Hi,

uTorrent is clean program, but the stuff which you can download with it may be infected. Please also read this, http://forums.spybot.info/showthread.php?t=282

Divocodec trojan issue

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member

Lynne

New member

muuli

New member