Just something else i tried
I noticed that someone had the same problem as me and it has taken a while for me to get a reply so i have also tried this as suggeste to Giltrap by Mr_Jak3
Go to virustotal.com
Copy the following to the box next to "Browse" button:
C:\WINDOWS\system32\svchosts.exe
Click on Send
Wait for the scan to end.
Copy & Paste the scan results to here.
1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
This is the log I got from virustotal:
STATUS: FINISHEDComplete scanning result of "svchosts.exe", received in VirusTotal at 01.03.2007, 20:11:01 (CET).
Antivirus Version Update Result
AntiVir 7.3.0.21 01.03.2007 TR/Dldr.Agent.bca.11
Authentium 4.93.8 12.30.2006 no virus found
Avast 4.7.892.0 12.30.2006 no virus found
AVG 386 01.03.2007 Generic2.MHF
BitDefender 7.2 01.03.2007 Adware.Softomate.Z
CAT-QuickHeal 8.00 01.03.2007 no virus found
ClamAV devel-20060426 01.03.2007 no virus found
DrWeb 4.33 01.03.2007 no virus found
eSafe 7.0.14.0 01.02.2007 no virus found
eTrust-InoculateIT 23.73.103 01.03.2007 no virus found
eTrust-Vet 30.3.3299 01.03.2007 no virus found
Ewido 4.0 01.03.2007 Downloader.Agent.bca
Fortinet 2.82.0.0 01.03.2007 W32/Agent.BCA!tr.dldr
F-Prot 3.16f 01.02.2007 no virus found
F-Prot4 4.2.1.29 01.03.2007 no virus found
Ikarus T3.1.0.27 01.03.2007 no virus found
Kaspersky 4.0.2.24 01.03.2007 Trojan-Downloader.Win32.Agent.bca
McAfee 4931 01.03.2007 Matcash
Microsoft 1.1904 01.03.2007 no virus found
NOD32v2 1954 01.03.2007 no virus found
Norman 5.80.02 12.31.2007 W32/Softomate.ES.dropper
Panda 9.0.0.4 01.03.2007 Adware/Maxifiles
Prevx1 V2 01.03.2007 Trojan.SystemPoser
Sophos 4.13.0 01.02.2007 no virus found
Sunbelt 2.2.907.0 12.18.2006 no virus found
TheHacker 6.0.3.141 01.01.2007 no virus found
UNA 1.83 01.03.2007 no virus found
VBA32 3.11.1 01.03.2007 no virus found
VirusBuster 4.3.19:9 01.03.2007 no virus found
Aditional Information
File size: 36864 bytes
MD5: 7b69c00ba9f072dd06d61411fc09ded5
SHA1: c080169d9b2824399e3dd7a9678487e67841f4c5
norman sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO:
ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File length: 36864 bytes.
[ Changes to filesystem ]
* Deletes file C:WINDOWS{837F873E-0000-1044--popo0000}.
* Creates directory C:WINDOWS{837F873E-0000-1044--popo0000}.
* Creates file C:WINDOWS{837F873E-0000-1044--popo0000}directorexe.lzma.
* Creates file C:WINDOWS{837F873E-0000-1044--popo0000}Update.exe.
* Deletes file C:WINDOWS{837F873E-0000-1044--popo0000}directorexe.lzma.
* Deletes file C:WINDOWS{837F873E-0000-1044--popo0000}directordll.lzma.
[ Changes to registry ]
* Creates key "HKLMSoftwareHARDWAREDESCRIPTIONSystemCentralProcessor
Prevx info:
http://fileinfo.prevx.com/fileinfo.asp?PXC=42b766636399
and the log i got from combofix:
Mom and Dad - 07-01-03 11:15:42.45 Service Pack 1
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Mom and Dad\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\{3C2C697E-0821-1033-0421-041028030001}
C:\Program Files\Common Files\{CC2C697E-0822-1033-0421-041028030001}
C:\Program Files\Common Files\{CC2C697E-0821-1033-0421-041028030001}
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\WINDOWS\PPATCH~1
C:\QooBox\Purity\WINDOWS\PPATCH~1\?hkdsk.exe
C:\QooBox\Purity\WINDOWS\system32\RACLE~1
C:\QooBox\Purity\WINDOWS\system32\RACLE~1\explorer.exe
C:\QooBox\Purity\WINDOWS\system32\RACLE~1\?racle
((((((((((((((((((((((((((((((( Files Created from 2006-12-03 to 2007-01-03 ))))))))))))))))))))))))))))))))))
2007-01-03 11:19 <DIR> d-------- C:\Program Files\Common Files\{CC2C697E-0822-1033-0421-041028030001}
2007-01-01 21:46 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-01 21:46 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-01 21:46 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-01 21:46 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-01 21:46 3,670 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-01 21:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-01 21:46 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-01 19:34 <DIR> d-------- C:\Program Files\HJT
2007-01-01 16:04 684,032 --a------ C:\WINDOWS\system32\libeay32.dll
2007-01-01 16:04 155,648 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-01-01 16:04 15,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2007-01-01 16:04 15,360 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2007-01-01 16:04 14,848 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
2007-01-01 16:04 122,368 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2007-01-01 16:04 <DIR> d-------- C:\Program Files\Webroot
2007-01-01 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-01-01 16:02 <DIR> d-------- C:\Documents and Settings\Mom and Dad\Application Data\Webroot
2006-12-31 01:00 <DIR> d--h----- C:\Program Files\Common Files\Uninstall Information
2006-12-31 00:30 <DIR> d-------- C:\Program Files\PeDevice
2006-12-30 20:59 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-30 20:59 <DIR> d-------- C:\Documents and Settings\Mom and Dad\Application Data\Lavasoft
2006-12-30 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2006-12-30 20:57 2 --a------ C:\WINDOWS\system32\wnsapiit.exe
2006-12-30 20:57 <DIR> d-------- C:\Program Files\Outerinfo
2006-12-30 20:27 <DIR> d-------- C:\Program Files\Ipwindows
2006-12-30 20:25 92,485 --a------ C:\gp.exe
2006-12-30 20:25 36,864 --a------ C:\WINDOWS\system32\svchosts.exe
2006-12-30 20:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-12-30 20:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-30 18:12 <DIR> d--hs---- C:\WINDOWS\system32\dyfrism
2006-12-23 09:12 <DIR> d-------- C:\Program Files\Santa
2006-12-12 06:43 183,808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe
2006-12-03 20:50 <DIR> d-------- C:\Program Files\QuickTime
2006-12-03 20:49 <DIR> d-------- C:\Program Files\iTunes
2006-12-03 20:48 38,229 --------- C:\WINDOWS\system32\drivers\StMp3Rec.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-03 11:19 -------- d-------- C:\Program Files\Common Files\{CC2C697E-0822-1033-0421-041028030001}
2007-01-03 11:19 -------- d-------- C:\Program Files\Common Files
2007-01-01 16:27 -------- d-------- C:\Program Files\Windows NT
2007-01-01 16:27 -------- d-------- C:\Program Files\Windows Media Player
2007-01-01 16:27 -------- d-------- C:\Program Files\Internet Explorer
2006-12-30 20:58 -------- d-------- C:\Program Files\Google
2006-12-30 20:38 -------- d-a-s---- C:\Program Files\NewDotNet
2006-12-30 20:38 -------- d-------- C:\Program Files\Free Offers from Freeze.com
2006-12-23 19:41 1226 --a------ C:\Documents and Settings\Mom and Dad\Application Data\AdobeDLM.log
2006-12-03 20:47 -------- d-------- C:\Program Files\iPod
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"Bano"="\"C:\\WINDOWS\\System32\\RACLE~1\\explorer.exe\" -vt yazb"
"Aqsz"="C:\\WINDOWS\\??pPatch\\?hkdsk.exe"
"swg"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.2480\\GoogleToolbarNotifier.exe\""
"winlogon"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"VTTimer"="VTTimer.exe"
"SoundMan"="SOUNDMAN.EXE"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"OpwareSE2"="\"C:\\Program Files\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"QuickFinder Scheduler"="\"C:\\WUTemp\\Programs\\QFSCHD100.EXE\""
"ViewMgr"="\"C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe\""
"ht5nkgki"="C:\\WINDOWS\\System32\\ht5nkgki.exe"
"AcctMgr"="\"C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe\" /startup"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"{CC2C697E-0821-1033-0421-041028030001}"="\"C:\\Program Files\\Common Files\\{CC2C697E-0821-1033-0421-041028030001}\\Update.exe\" te-110-12-0000282"
"{CC2C697E-0822-1033-0421-041028030001}"="\"C:\\Program Files\\Common Files\\{CC2C697E-0822-1033-0421-041028030001}\\Update.exe\" te-110-12-0000282"
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
"winlogon"=""
"New.net Startup"="rundll32 C:\\PROGRA~1\\NEWDOT~1\\NEWDOT~2.DLL,ClientStartup -s"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoAdminPage"="1"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcctMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcctMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostStartTrayApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GhostStartTrayApp"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Norton Ghost\\GhostStartTrayApp.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dbme32
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
C:\WINDOWS\tasks\Symantec Drmc.job
C:\WINDOWS\tasks\wrSpySweeper_66D7702AC3264E8FAE2BDA71DAFD43F6.job
Completion time: 07-01-03 11:19:52.17
C:\ComboFix.txt ... 07-01-03 11:19
C:\ComboFix2.txt ... 07-01-03 11:14
Hope this helps some anyways!
rive and the one below are in the Program Files in C