Hijack This Dss Kaspersky Reports

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages

1 2 >

Hijack This Dss Kaspersky Reports

Options

miekiemoes View Member Profile	May 14 2008, 12:59 AM Post #2
Malware Killer Dog Group: HJT Team Posts: 15,002 Joined: 18-February 05 From: Belgium Member No.: 12,408	Hi, I understand that you need help in order to get rid of the malware that is present on your system - But you need to help us first.. I notice that you never scanned with an Antivirus previously before starting this thread - because you don't even have an Antivirus installed! This is somewhat suicidal in today's digital world. That's why I want you to install one first!! * Please install Avira Antivirus: http://www.free-av.com/ This is a free Antivirus. Perform a full scan with Avira and let it delete everything it is finding. Then reboot. After reboot, open your Avira and select "reports". There doubleclick the report from the Full scan you have done. Click the "Report File" button and copy and paste this report in your next reply together with a new HijackThislog. Then we'll start from there, because it really makes no sense otherwise that we clean this up manually if an Antivirusscan is not present which should be able to deal with most and prevent further reinfection. -------------------- AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog. My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here! Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

keaton87 View Member Profile	May 15 2008, 06:03 AM Post #3
New Member Group: Members Posts: 7 Joined: 13-May 08 Member No.: 208,711	that is a good idea and here they are Avira AntiVir Personal Report file date: Wednesday, 14 May 2008 23:54 Scanning for 1264213 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: MCPURPLZ Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 01:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 00:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 00:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 00:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 02:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 05:08:58 ANTIVIR2.VDF : 7.0.4.0 1554432 Bytes 5/5/2008 06:39:53 ANTIVIR3.VDF : 7.0.4.33 166912 Bytes 5/13/2008 06:39:55 Engineversion : 8.1.0.42 AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 01:58:21 AESCRIPT.DLL : 8.1.0.31 262522 Bytes 5/14/2008 06:40:24 AESCN.DLL : 8.1.0.16 119156 Bytes 5/14/2008 06:40:22 AERDL.DLL : 8.1.0.20 418165 Bytes 5/14/2008 06:40:20 AEPACK.DLL : 8.1.1.4 364918 Bytes 5/14/2008 06:40:16 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 5/14/2008 06:40:12 AEHEUR.DLL : 8.1.0.26 1237366 Bytes 5/14/2008 06:40:09 AEHELP.DLL : 8.1.0.14 115063 Bytes 5/14/2008 06:40:00 AEGEN.DLL : 8.1.0.20 299380 Bytes 5/14/2008 06:39:59 AEEMU.DLL : 8.1.0.6 430451 Bytes 5/14/2008 06:39:57 AECORE.DLL : 8.1.0.28 168310 Bytes 5/14/2008 06:39:56 AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/23/2008 09:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 02:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 05:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 1/23/2008 09:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 00:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 00:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 09:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/23/2008 09:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 04:05:10 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 06:37:25 RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 04:02:11 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, I:, K:, O:, P:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: Wednesday, 14 May 2008 23:54 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceHelper.exe' - '1' Module(s) have been scanned Scan process 'distnoted.exe' - '1' Module(s) have been scanned Scan process 'iTunes.exe' - '1' Module(s) have been scanned Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'usnsvc.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned Scan process 'SetPoint.exe' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned Scan process 'MSASCui.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned Scan process 'guard.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'schedul2.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 46 processes with 46 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'I:\' [INFO] No virus was found! Boot sector 'K:\' [INFO] No virus was found! Boot sector 'O:\' [INFO] No virus was found! Boot sector 'P:\' [INFO] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\__c0024539.dat [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] The registry was scanned ( '36' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\browse.dll [DETECTION] Is the Trojan horse TR/BHO.BB.13 [NOTE] The file was moved to '4899fb21.qua'! C:\WINDOWS\system32\Cgv13.sys [DETECTION] Is the Trojan horse TR/Rkit.Agent.EA.19 [NOTE] The file was moved to '48a0fb17.qua'! C:\WINDOWS\system32\credgui.dll [DETECTION] Is the Trojan horse TR/Spy.Agent.NDH.2 [NOTE] The file was moved to '488ffb25.qua'! C:\WINDOWS\system32\dcpnet.dll [DETECTION] Is the Trojan horse TR/BHO.BB.50 [NOTE] The file was moved to '489afb1a.qua'! C:\WINDOWS\system32\ftpsys.dll [DETECTION] Is the Trojan horse TR/BHO.BB.55 [NOTE] The file was moved to '489afb30.qua'! C:\WINDOWS\system32\lawtfuvc.exe [DETECTION] Is the Trojan horse TR/PrivacySet.A [NOTE] The file was moved to '48a1fb25.qua'! C:\WINDOWS\system32\pmcrt.dll [DETECTION] Is the Trojan horse TR/BHO.BB.46 [NOTE] The file was moved to '488dfb40.qua'! C:\WINDOWS\system32\sililber.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4896fb42.qua'! C:\WINDOWS\system32\windll.dll [DETECTION] Is the Trojan horse TR/Dldr.Small.ehe.25 [NOTE] The file was moved to '4898fb49.qua'! C:\WINDOWS\system32\winload.dll [DETECTION] Is the Trojan horse TR/Spy.Agent.QW.2 [NOTE] The file was moved to '4898fb4a.qua'! C:\WINDOWS\system32\ws_imod.dll [DETECTION] Is the Trojan horse TR/Spy.Agent.NDH [NOTE] The file was moved to '4889fb57.qua'! C:\WINDOWS\system32\__c0024539.dat [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\__c008DBD7.dat [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '488e1628.qua'! C:\WINDOWS\system32\ActiveScan\pskavs.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [NOTE] The file was moved to '4896163f.qua'! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'I:\' <BACKUP> Begin scan in 'K:\' Begin scan in 'O:\' <EXCHANGE> Begin scan in 'P:\' <LaCie> End of the scan: Thursday, 15 May 2008 02:57 Used time: 3:02:45 min The scan has been done completely. 13612 Scanning directories 343330 Files were scanned 15 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 13 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 343315 Files not concerned 2831 Archives were scanned 4 Warnings 13 Notes Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:03:18 PM, on 15/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1FC54CF8-19C5-4009-9C87-77CD1222A7D8} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {BBF905E4-80AE-40B1-B2EC-BEF4F4257B60} - C:\WINDOWS\system32\opnmJCst.dll (file missing) O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\System32\JMRaidTool.exe boot O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [0414381a] rundll32.exe "C:\WINDOWS\system32\ovcxuqod.dll",b O4 - HKLM\..\Run: [BM07270b86] Rundll32.exe "C:\WINDOWS\system32\ajlmxfmg.dll",s O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [SVC aup] aup.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Microsoft Telecoms Center] telcoms.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [SVC aup] aup.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O10 - Unknown file in Winsock LSP: xfire_lsp_10650.dll O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1183900581500 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1183900566828 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by22fd.bay22.hotmail.msn.com/activex/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{EDEDE645-4C73-4C52-8EDF-C829F7D6DCD1}: NameServer = 202.55.145.2 202.55.145.10 O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O20 - Winlogon Notify: hltyehlq - hltyehlq.dll (file missing) O20 - Winlogon Notify: __c0024539 - __c0024539.dat (file missing) O22 - SharedTaskScheduler: COM+ Service - {3BF77FF3-E054-4728-ADD0-B21EF95EECE1} - (no file) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\System32\CTsvcCDA.exe (file missing) O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Microsoft Java Service (Windows Java Service) - Unknown owner - C:\WINDOWS\jusched.exe (file missing) -- End of file - 10877 bytes

miekiemoes View Member Profile	May 15 2008, 06:10 AM Post #4
Malware Killer Dog Group: HJT Team Posts: 15,002 Joined: 18-February 05 From: Belgium Member No.: 12,408	Hi, Much better, but we're not finished yet... * Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix This includes installing the Windows XP Recovery Console in case you have not installed it yet. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. -------------------- AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog. My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here! Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

keaton87

May 18 2008, 06:14 AM

Post #5

New Member

Group: Members
Posts: 7
Joined: 13-May 08
Member No.: 208,711

hey sorry took me a few days im always busy on weekends thanks to work
thanks again

ComboFix 08-05-15.3 - Keaton 2008-05-18 20:57:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1555 [GMT 10:00]
Running from: C:\Documents and Settings\Keaton\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mt_32.dll
C:\WINDOWS\system32\tsCJmnpo.ini
C:\WINDOWS\system32\tsCJmnpo.ini2
O:\Autorun.inf
P:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSUPDATE
-------\Service_RpcApi

((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-07-04 14:41 . 2008-05-05 22:22 <DIR> d-------- C:\ArmyBuilder
2008-05-14 16:38 . 2008-05-14 16:38 <DIR> d-------- C:\Program Files\Avira
2008-05-14 16:38 . 2008-05-14 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-14 01:03 . 2008-05-14 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-14 01:02 . 2008-05-14 01:02 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-14 01:01 . 2008-05-14 01:01 <DIR> d-------- C:\Deckard
2008-05-14 00:48 . 2008-05-14 00:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-14 00:28 . 2008-05-14 00:31 211 --a------ C:\WINDOWS\wininit.ini
2008-05-13 22:40 . 2008-05-13 23:40 355 --ahs---- C:\WINDOWS\system32\doquxcvo.ini
2008-05-13 22:33 . 2008-05-14 00:12 109,821 --a------ C:\WINDOWS\BM07270b86.xml
2008-05-12 16:00 . 2008-05-18 20:38 <DIR> d-------- C:\Documents and Settings\Keaton\Application Data\dvdcss
2008-05-04 23:02 . 2008-05-04 23:02 <DIR> d-------- C:\Program Files\Windows Defender
2008-05-04 23:00 . 2008-05-04 23:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-04 23:00 . 2008-05-04 23:00 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-04 23:00 . 2008-05-04 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-04 23:00 . 2008-05-04 23:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-20 09:26 . 2008-07-04 22:37 <DIR> d-------- C:\Program Files\PicToWeave
2008-04-20 09:26 . 2008-04-20 09:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PicToWeave

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 10:41 --------- d-----w C:\Documents and Settings\Keaton\Application Data\uTorrent
2008-05-18 10:10 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-18 10:06 --------- d-----w C:\Documents and Settings\Keaton\Application Data\Vso
2008-05-18 08:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-05-16 07:37 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-15 02:12 77,084 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-15 02:12 5,519,392 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-15 02:12 34,844 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-15 02:12 248,864 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-12 12:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 12:58 --------- d-----w C:\Documents and Settings\Keaton\Application Data\Xfire
2008-05-04 13:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-31 10:59 --------- d-----w C:\Program Files\WM Converter
2008-03-26 13:26