 Pop-up Adverts Missing C And D Drives, Tried all cleaners but cant resolve |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jun 11 2008, 01:59 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438  |
Im having problems with adverts that pop up exactly the same size as the current window when I hit back/forward buttons or hyperlinks. I have also lost my C and D drive icons from My Computer and the D drive (CD) opens and closes but wont play anything that goes in it. Sometimes I also get a screen wipe, then a slight pause before the desktop icons reappear. Here are the two Deckard logs: Deckard's System Scanner v20071014.68 Run by Household on 2008-06-11 07:09:42 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 78: 2008-06-11 06:09:58 UTC - RP199 - Deckard's System Scanner Restore Point 77: 2008-06-10 23:17:24 UTC - RP198 - System Checkpoint 76: 2008-06-09 19:53:43 UTC - RP197 - System Checkpoint 75: 2008-06-08 10:00:20 UTC - RP196 - System Checkpoint 74: 2008-06-07 09:59:18 UTC - RP195 - System Checkpoint -- First Restore Point -- 1: 2008-06-02 21:08:40 UTC - RP122 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 510 MiB (512 MiB recommended). -- HijackThis (run as Household.exe) ------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:12, on 11/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Household\Local Settings\Temporary Internet Files\Content.IE5\Z65KS9YA\dss[1].exe C:\WINDOWS\explorer.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Household.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {37029E75-F144-4F09-994A-0D897DB219D4} - (no file) O2 - BHO: (no name) - {437994AC-109F-49A3-B7C4-2B35402EEBC8} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: (no name) - {84CAF2E2-C8AC-4D83-AA36-EB089931D218} - (no file) O2 - BHO: (no name) - {9AA4EC55-4AC8-450C-95AF-C4CB5B3BB9D8} - C:\WINDOWS\system32\khfFXpmn.dll O2 - BHO: (no name) - {C2FBEA86-DDE3-4792-A811-CE87F2A77EC5} - C:\WINDOWS\system32\pmnnKApn.dll (file missing) O2 - BHO: (no name) - {CA6E74C7-11DD-4BB4-A331-796A9AE5CF22} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [7cf334f2] rundll32.exe "C:\WINDOWS\system32\ydeqftlo.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.download.microsoft.com O15 - Trusted Zone: http://*.update.microsoft.com O15 - Trusted Zone: http://*.windowsupdate.com O15 - Trusted Zone: http://*.windowsupdate.microsoft.com O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-18.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215644406 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215607359 O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing) O21 - SSODL: vltdfabw - {55AA50E3-706E-499D-95A2-0A8BCFDEA75B} - (no file) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O24 - Desktop Component 0: (no name) - http://player.virginradio.co.uk/core/playe...nts-vr/shim.gif -- End of file - 8370 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7> R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.10) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.10> R3 AR5523 (NETGEAR WG111T USB2.0 Wireless Card Service) - c:\windows\system32\drivers\wg11tnd5.sys <Not Verified; NETGEAR, Inc.; NETGEAR WG111T 108Mbps Wireless USB2.0 Adapter> R3 DNINDIS5 (DNINDIS5 NDIS Protocol Driver) - c:\windows\system32\dnindis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> S3 ATHFMWDL (NETGEAR WG111T bootloader driver) - c:\windows\system32\drivers\athfmwdl.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> S3 saF73 - c:\windows\system32\drivers\saf73.sys (file missing) S3 StMp3Rec (Player Recovery Device Control Driver) - c:\windows\system32\drivers\stmp3rec.sys <Not Verified; Generic; Generic MP3 Player> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\5ADB110600 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\5ADB110600 Service: NIC1394 Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Eicon Diva 2.02 S/T (PCI) Device ID: PCI\VEN_1133&DEV_E00B&SUBSYS_E00B1133&REV_00\4&3B1CAF2B&0&28F0 Manufacturer: Eicon Networks Name: Eicon Diva 2.02 S/T (PCI) PNP Device ID: PCI\VEN_1133&DEV_E00B&SUBSYS_E00B1133&REV_00\4&3B1CAF2B&0&28F0 Service: DiWan Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom 440x 10/100 Integrated Controller Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01\4&3B1CAF2B&0&48F0 Manufacturer: Broadcom Name: Broadcom 440x 10/100 Integrated Controller PNP Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01\4&3B1CAF2B&0&48F0 Service: bcm4sbxp -- Scheduled Tasks ------------------------------------------------------------- 2008-06-11 07:10:00 430 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{9823A8EF-1708-45D6-AC12-22AB45BE1A67}.job 2008-06-11 00:00:01 374 --a------ C:\WINDOWS\Tasks\HPpromotions journeysoftware.job 2008-06-04 03:30:00 296 --a------ C:\WINDOWS\Tasks\AVG Free Edition for Windows.job 2008-06-04 02:30:00 268 --a------ C:\WINDOWS\Tasks\Disk Cleanup.job -- Files created between 2008-05-11 and 2008-06-11 ----------------------------- 2008-06-10 20:18:38 93056 --a------ C:\WINDOWS\system32\ydeqftlo.dll 2008-06-10 19:43:34 0 d-------- C:\VundoFix Backups 2008-06-06 16:51:16 0 d-------- C:\fsaua.data 2008-06-06 12:22:59 0 d-------- C:\Program Files\EsetOnlineScanner 2008-06-06 12:07:21 249459 --ahs---- C:\WINDOWS\system32\nmpXFfhk.ini2 2008-06-06 12:07:16 324864 --a------ C:\WINDOWS\system32\khfFXpmn.dll 2008-06-06 09:47:03 0 dr-h----- C:\Documents and Settings\Household\Recent 2008-06-06 09:36:47 0 d-------- C:\Program Files\CCleaner 2008-06-04 22:47:28 0 d-------- C:\Program Files\Trend Micro 2008-06-04 13:51:15 249844 --ahs---- C:\WINDOWS\system32\npAKnnmp.ini2 2008-06-03 20:46:20 0 d-------- C:\Program Files\Lavasoft 2008-06-03 20:46:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-03 18:26:52 255261 --ahs---- C:\WINDOWS\system32\oXwDJRqr.ini2 2008-06-02 23:21:00 0 d-------- C:\Documents and Settings\Household\Application Data\TmpRecentIcons 2008-06-02 22:08:29 1316 --ahs---- C:\WINDOWS\system32\ooXEeMoq.ini2 -- Find3M Report --------------------------------------------------------------- 2008-06-03 20:45:18 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-03 00:06:56 0 d-a------ C:\Documents and Settings\Household\Application Data\AVG7 2008-06-01 18:46:22 0 d-------- C:\Program Files\Paint Shop Pro 6 2008-05-12 14:00:58 0 d-------- C:\Documents and Settings\Household\Application Data\AdobeUM 2008-04-29 14:08:03 0 d-------- C:\Program Files\iTunes 2008-04-29 14:07:48 0 d-------- C:\Program Files\iPod 2008-04-29 13:56:57 0 d-------- C:\Program Files\QuickTime 2008-04-29 13:54:11 0 d-------- C:\Program Files\Apple Software Update 2008-04-29 13:53:32 0 d-------- C:\Program Files\Common Files 2008-04-29 13:53:32 0 d-------- C:\Program Files\Common Files\Apple 2008-04-13 19:47:22 256 --a------ C:\WINDOWS\system32\pool.bin 2008-04-13 17:46:12 0 d-------- C:\Documents and Settings\Household\Application Data\Roxio -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37029E75-F144-4F09-994A-0D897DB219D4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{437994AC-109F-49A3-B7C4-2B35402EEBC8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84CAF2E2-C8AC-4D83-AA36-EB089931D218}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9AA4EC55-4AC8-450C-95AF-C4CB5B3BB9D8}] 06/06/2008 12:07 324864 --a------ C:\WINDOWS\system32\khfFXpmn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FBEA86-DDE3-4792-A811-CE87F2A77EC5}] C:\WINDOWS\system32\pmnnKApn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6E74C7-11DD-4BB4-A331-796A9AE5CF22}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [14/10/2004 21:42] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [06/12/2004 02:05] "BluetoothAuthenticationAgent"="bthprops.cpl" [12/08/2004 14:55 C:\WINDOWS\system32\bthprops.cpl] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [19/10/2005 08:59] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [19/10/2005 08:59] "7cf334f2"="C:\WINDOWS\system32\ydeqftlo.dll" [10/06/2008 20:18] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/08/2004 14:56] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk.disabled [31/01/2008 12:30:19] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [30/03/2005 08:00:27] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [19/11/2005 13:39:35] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "DisableCAD"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "NoColorChoice"=0 (0x0) "NoSizeChoice"=0 (0x0) "NoDispScrSavPage"=0 (0x0) "NoDispCPL"=0 (0x0) "NoVisualStyleChoice"=0 (0x0) "NoDispSettingsPage"=0 (0x0) "NoDispAppearancePage"=0 (0x0) "NoDispBackgroundPage"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktopChanges"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) "NoSaveSettings"=0 (0x0) "NoThemesTab"=0 (0x0) "NoToolbarCustomize"=1 (0x1) "StartMenuLogoff"=1 (0x1) "NoStartMenuMorePrograms"=0 (0x0) "NoSetFolders"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32] WinCtrl32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\khfFXpmn [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\saF73.sys] @="Driver" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent "AVG7_CC"=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP "AVG7_EMC"=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe "<NO NAME>"= "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f7a2cc3-71ae-11db-a5da-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5637dd12-74b3-11db-a5de-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff78c2f3-2d2c-11dc-a6af-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 babe.the-killer.bz 127.0.0.1 www.babe.the-killer.bz 127.0.0.1 babe.k-lined.com 127.0.0.1 www.babe.k-lined.com 127.0.0.1 did.i-used.cc 127.0.0.1 www.did.i-used.cc 127.0.0.1 coolwwwsearch.com 127.0.0.1 www.coolwwwsearch.com 127.0.0.1 coolwebsearch.com 127.0.0.1 www.coolwebsearch.com 6074 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-06-11 07:13:49 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Celeron® CPU 2.40GHz Percentage of Memory in Use: 59% Physical Memory (total/avail): 510 MiB / 205.13 MiB Pagefile Memory (total/avail): 1246.63 MiB / 986.96 MiB Virtual Memory (total/avail): 2047.88 MiB / 1904.41 MiB C: is Fixed (NTFS) - 71.7 GiB total, 22.31 GiB free. D: is CDROM (UDF) E: is CDROM (CDFS) G: is Fixed (NTFS) - 298.09 GiB total, 200.04 GiB free. \\.\PHYSICALDRIVE0 - WDC WD800BB-75JHC0 - 74.5 GiB - 3 partitions \PARTITION0 - Unknown - 39.19 MiB \PARTITION1 (bootable) - Installable File System - 71.7 GiB - C: \PARTITION2 - Unknown - 2.75 GiB \\.\PHYSICALDRIVE1 - Seagate FreeAgentDesktop USB Device - 298.09 GiB - 1 partition \PARTITION0 - Installable File System - 298.09 GiB - G: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. AntiVirusDisableNotify is set. UpdatesDisableNotify is set. AV: AVG 7.5.516 v7.5.516 (Grisoft) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Eicon\\Diva\\watch.exe"="C:\\Program Files\\Eicon\\Diva\\watch.exe:*:Disabled:Syslog Daemon" "C:\\WINDOWS\\system32\\fxsclnt.exe"="C:\\WINDOWS\\system32\\fxsclnt.exe:*:Disabled:Microsoft Fax Console" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Household\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=MAIN ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Household LOGONSERVER=\\MAIN NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\Common Files\Sonic Shared;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625;C:\PROGRA~1\COMMON~1\MUVEET~1\030625 PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0209 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip RoxioCentral=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\ SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\HOUSEH~1\LOCALS~1\Temp TMP=C:\DOCUME~1\HOUSEH~1\LOCALS~1\Temp USERDOMAIN=MAIN USERNAME=Household USERPROFILE=C:\Documents and Settings\Household windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Household (admin) Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6} --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19} --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> MsiExec.exe /I{2BE0C605-9BEC-434D-9FAE-931194E72414} --> MsiExec.exe /I{48A669A9-76FA-4CA8-BFD5-00C125AC4166} --> MsiExec.exe /I{726A362E-EBFD-4C3F-8664-6593C2B08386} --> MsiExec.exe /I{943CB81D-11B9-401E-8305-752528D00AA1} --> MsiExec.exe /I{E75F019D-98A0-4B39-B1A8-3A01400D2A18} --> MsiExec.exe /X{F664EDB9-59DF-452A-A3D7-085ED1B8D374} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Access Manager 2 --> MsiExec.exe /I{5590FCB1-AA19-4510-9FC1-BB6A8E0A14A5} Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002} Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe" BlackBerry Desktop Software 4.3 --> MsiExec.exe /i{DE7A46A8-D4DA-4EE0-AD6C-326049517BF2} BlackBerry Desktop Software 4.3 --> MsiExec.exe /I{DE7A46A8-D4DA-4EE0-AD6C-326049517BF2} Bonusprint Print Service --> C:\Program Files\Bonusprint Print Service\uninst.exe Broadcom Management Programs --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{89EE857B-8970-4F9F-AB58-A1C873AC72B3} /l1033 CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" Data Access Objects (DAO) 3.5 --> C:\Program Files\Common Files\Microsoft Shared\DAO\Remove.EXE C:\WINDOWS\UNINST.EXE -fC:\PROGRA~1\COMMON~1\MICROS~1\DAO\DeIsL1.isu Dell Driver Reset Tool --> MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76} Dell Media Experience Update --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CDE4CC8B-134B-421E-943C-90799E56F664}\setup.exe" -l0x9 -L0x9 /SMAINT Dell Support 5.0.0 (630) --> rundll32 C:\PROGRA~1\DELLSU~1\AUInst.dll,ExUninstall Diva Assistant --> MsiExec.exe /I{2B9CF693-1084-11D4-B515-00C04F05FF36} Diva Tools --> MsiExec.exe /X{A62467DE-4312-47ED-8705-60BD6C7E3DEC} ESET Online Scanner --> C:\WINDOWS\system32\OnlineScannerUninstaller.exe getPlus®_ocx --> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSo.INF, DefaultUninstall Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72} Hijackthis 1.99.1 --> "C:\Program Files\Hijackthis\unins000.exe" HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall HP Extended Capabilities 4.7 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat HP Image Zone 4.7 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat HP PSC & OfficeJet 4.7 --> "C:\Program Files\HP\Digital Imaging\{342C7C88-D335-4bc2-8CF1-281857629CE2}\setup\hpzscr01.exe" -datfile hposcr05.dat ImageMixer VCD2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F8C6BABF-0837-4EA0-AD6C-8E5A392A7538}\setup.exe" -l0x9 UNINSTALL Intel® Extreme Graphics Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562 Internet Explorer Default Page --> MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395} iPod for Windows 2005-10-12 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A} /l1033 iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060} Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java™ 6 Update 4 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040} JTIS --> C:\WINDOWS\IsUninst.exe -fc:\jaguar\Uninst.isu Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\SETUP.EXE" -l0x9 UNINSTALL Logitech SetPoint --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x9 Macromedia Flash Player --> MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c} Macromedia Flash Player 8 --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\swflash.inf,DefaultUninstall,5 Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Microsoft AutoRoute 2005 --> MsiExec.exe /I{67E4EE98-59F4-4220-89A6-A20AF5BEC689} Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office FrontPage 2003 --> MsiExec.exe /I{91170409-6000-11D3-8CFE-0150048383C9} Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} Nero Suite --> C:\Program Files\Common Files\Ahead\Uninstall\setup.exe /uninstall ExtraUninstallID="" NETGEAR WG111T Smart Wizard Wireless Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{51123D42-6B9C-4B93-900C-29F9EC5963C9}\Setup.exe" Nokia Connectivity Cable Driver --> MsiExec.exe /X{E4DD8B33-6F9B-41C5-96FF-5DBF27ED23E7} Nokia PC Connectivity Solution --> MsiExec.exe /I{588AA47B-9115-44D3-B2E5-4F10BC659D6C} Nokia PC Suite --> MsiExec.exe /I{77296E63-8C19-462B-ABA1-F510750A8C51} Paint Shop Pro 6.02 CD --> C:\Program Files\Paint Shop Pro 6\Unwise.exe C:\PROGRA~1\PAINTS~1\INSTALL.LOG PeaZip 1.9.1 --> "C:\Program Files\PeaZip\unins000.exe" Pocket DVD Wizard --> C:\PROGRA~1\POCKET~1\UNWISE.EXE C:\PROGRA~1\POCKET~1\INSTALL.LOG PowerDVD 5.3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Roxio Media Manager --> MsiExec.exe /X{303379C9-8610-4CCF-AF37-C4BF8998C591} Sonic DLA --> MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6} Sonic RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19} Sony USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL SpeedTouch USB Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\Setup.exe" /l0009 -Control_Panel Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins001.exe" Spybot - Search & Destroy 1.5.2.20 --> "C:\WINDOWS\unins000.exe" Videora iPod Converter 0.91 --> C:\Program Files\VideoraiPodConverter\uninst.exe Windows Defender Signatures --> MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C} Windows Driver Package - Nokia Modem (04/06/2006 6.8.0.17) --> C:\PROGRA~1\DIFX\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_7F91C37896B530901B0665F9EF32E19FF06F5687\nokbtmdm.inf Windows Installer Clean Up --> MsiExec.exe /I{121634B0-2F4A-11D3-ADA3-00C04F52DD53} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" -- Application Event Log ------------------------------------------------------- Event Record #/Type3009 / Error Event Submitted/Written: 06/10/2008 08:34:56 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application hijackthis.exe, version 2.0.0.2, faulting module khffxpmn.dll, version 0.0.0.0, fault address 0x00062ee3. Processing media-specific event for [hijackthis.exe!ws!] Event Record #/Type2990 / Warning Event Submitted/Written: 06/09/2008 08:34:41 AM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}', feature 'Scan' failed during request for component '{BCF3438B-BAA5-4F3D-AD4D-E339CA0B8D73}' Event Record #/Type2989 / Warning Event Submitted/Written: 06/09/2008 08:34:41 AM Event ID/Source: 1004 / MsiInstaller Event Description: Detection of product '{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}', feature 'Scan', component '{B1C1D510-D2C1-4544-B33A-31E289F2852F}' failed. The resource 'C:\WINDOWS\twain_32\hpqgnds2.tmp' does not exist. Event Record #/Type2987 / Warning Event Submitted/Written: 06/09/2008 08:34:33 AM Event ID/Source: 1001 / MsiInstaller Event Description: Detection of product '{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}', feature 'Scan' failed during request for component '{AD190C76-AF66-4700-96FD-722621A83363}' Event Record #/Type2986 / Warning Event Submitted/Written: 06/09/2008 08:34:33 AM Event ID/Source: 1004 / MsiInstaller Event Description: Detection of product '{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}', feature 'Scan', component '{B1C1D510-D2C1-4544-B33A-31E289F2852F}' failed. The resource 'C:\WINDOWS\twain_32\hpqgnds2.tmp' does not exist. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type184127 / Warning Event Submitted/Written: 06/11/2008 00:16:59 AM Event ID/Source: 51 / Disk Event Description: An error was detected on device \Device\Harddisk1\D during a paging operation. Event Record #/Type184126 / Warning Event Submitted/Written: 06/10/2008 11:44:06 PM Event ID/Source: 51 / Disk Event Description: An error was detected on device \Device\Harddisk1\D during a paging operation. Event Record #/Type184125 / Warning Event Submitted/Written: 06/10/2008 11:20:02 PM Event ID/Source: 51 / Cdrom Event Description: An error was detected on device \Device\CdRom0 during a paging operation. Event Record #/Type184124 / Warning Event Submitted/Written: 06/10/2008 11:20:02 PM Event ID/Source: 51 / Cdrom Event Description: An error was detected on device \Device\CdRom0 during a paging operation. Event Record #/Type184123 / Warning Event Submitted/Written: 06/10/2008 11:20:02 PM Event ID/Source: 51 / Cdrom Event Description: An error was detected on device \Device\CdRom0 during a paging operation. -- End of Deckard's System Scanner: finished at 2008-06-11 07:13:49 ------------ and here is the Kaspersky log file -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, June 11, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, June 10, 2008 15:24:20 Records in database: 845734 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ G:\ Scan statistics: Files scanned: 88338 Threat name: 1 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 02:57:59 File name / Threat name / Threats count rundll32.exe\ydeqftlo.dll/rundll32.exe\ydeqftlo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 2 ctfmon.exe\ydeqftlo.dll/ctfmon.exe\ydeqftlo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 1 KEM.exe\ydeqftlo.dll/KEM.exe\ydeqftlo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 1 iexplore.exe\ydeqftlo.dll/iexplore.exe\ydeqftlo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.yeb 1 The selected area was scanned. Any help you can give me would be really appreciated! Many thanks! Bandit12 |
 |
 
|
|
Jun 11 2008, 08:57 AM
Post
#2
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you.
 You are running an older version of Java. This can be a security risk so let's get you the latest version. Upgrading Java:
Please post a new log from DSS in your next reply. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 12 2008, 01:56 AM
Post
#3
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
Hi Sam
I really appreciate ou assistance! I have carried out the Java changes and the revised DSS is below: Deckard's System Scanner v20071014.68 Run by Household on 2008-06-12 07:51:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 510 MiB (512 MiB recommended). -- HijackThis (run as Household.exe) ------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:52, on 12/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\Household\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\HOUSEH~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {37029E75-F144-4F09-994A-0D897DB219D4} - (no file) O2 - BHO: (no name) - {437994AC-109F-49A3-B7C4-2B35402EEBC8} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: (no name) - {84CAF2E2-C8AC-4D83-AA36-EB089931D218} - (no file) O2 - BHO: (no name) - {872D7223-4023-4F28-B02A-ABC059F4B0A9} - C:\WINDOWS\system32\khfFXpmn.dll O2 - BHO: (no name) - {C2FBEA86-DDE3-4792-A811-CE87F2A77EC5} - C:\WINDOWS\system32\pmnnKApn.dll (file missing) O2 - BHO: (no name) - {CA6E74C7-11DD-4BB4-A331-796A9AE5CF22} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [7cf334f2] rundll32.exe "C:\WINDOWS\system32\hjtacsxb.dll",b O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.download.microsoft.com O15 - Trusted Zone: http://*.update.microsoft.com O15 - Trusted Zone: http://*.windowsupdate.com O15 - Trusted Zone: http://*.windowsupdate.microsoft.com O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-18.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215644406 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215607359 O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing) O21 - SSODL: vltdfabw - {55AA50E3-706E-499D-95A2-0A8BCFDEA75B} - (no file) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O24 - Desktop Component 0: (no name) - http://player.virginradio.co.uk/core/playe...nts-vr/shim.gif -- End of file - 8438 bytes -- Files created between 2008-05-12 and 2008-06-12 ----------------------------- 2008-06-12 07:44:19 0 d-------- C:\Program Files\Common Files\Java 2008-06-11 20:19:19 92544 --a------ C:\WINDOWS\system32\hjtacsxb.dll 2008-06-10 19:43:34 0 d-------- C:\VundoFix Backups 2008-06-06 16:51:16 0 d-------- C:\fsaua.data 2008-06-06 12:22:59 0 d-------- C:\Program Files\EsetOnlineScanner 2008-06-06 12:07:21 255955 --ahs---- C:\WINDOWS\system32\nmpXFfhk.ini2 2008-06-06 12:07:16 324864 --a------ C:\WINDOWS\system32\khfFXpmn.dll 2008-06-06 09:47:03 0 dr-h----- C:\Documents and Settings\Household\Recent 2008-06-06 09:36:47 0 d-------- C:\Program Files\CCleaner 2008-06-04 22:47:28 0 d-------- C:\Program Files\Trend Micro 2008-06-04 13:51:15 249844 --ahs---- C:\WINDOWS\system32\npAKnnmp.ini2 2008-06-03 20:46:20 0 d-------- C:\Program Files\Lavasoft 2008-06-03 20:46:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-03 18:26:52 255261 --ahs---- C:\WINDOWS\system32\oXwDJRqr.ini2 2008-06-02 23:21:00 0 d-------- C:\Documents and Settings\Household\Application Data\TmpRecentIcons 2008-06-02 22:08:29 1316 --ahs---- C:\WINDOWS\system32\ooXEeMoq.ini2 -- Find3M Report --------------------------------------------------------------- 2008-06-12 07:45:07 0 d-------- C:\Program Files\Java 2008-06-12 07:44:19 0 d-------- C:\Program Files\Common Files 2008-06-03 20:45:18 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-03 00:06:56 0 d-a------ C:\Documents and Settings\Household\Application Data\AVG7 2008-06-01 18:46:22 0 d-------- C:\Program Files\Paint Shop Pro 6 2008-05-12 14:00:58 0 d-------- C:\Documents and Settings\Household\Application Data\AdobeUM 2008-04-29 14:08:03 0 d-------- C:\Program Files\iTunes 2008-04-29 14:07:48 0 d-------- C:\Program Files\iPod 2008-04-29 13:56:57 0 d-------- C:\Program Files\QuickTime 2008-04-29 13:54:11 0 d-------- C:\Program Files\Apple Software Update 2008-04-29 13:53:32 0 d-------- C:\Program Files\Common Files\Apple 2008-04-13 19:47:22 256 --a------ C:\WINDOWS\system32\pool.bin 2008-04-13 17:46:12 0 d-------- C:\Documents and Settings\Household\Application Data\Roxio -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37029E75-F144-4F09-994A-0D897DB219D4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{437994AC-109F-49A3-B7C4-2B35402EEBC8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84CAF2E2-C8AC-4D83-AA36-EB089931D218}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872D7223-4023-4F28-B02A-ABC059F4B0A9}] 06/06/2008 12:07 324864 --a------ C:\WINDOWS\system32\khfFXpmn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FBEA86-DDE3-4792-A811-CE87F2A77EC5}] C:\WINDOWS\system32\pmnnKApn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6E74C7-11DD-4BB4-A331-796A9AE5CF22}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [14/10/2004 21:42] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [06/12/2004 02:05] "BluetoothAuthenticationAgent"="bthprops.cpl" [12/08/2004 14:55 C:\WINDOWS\system32\bthprops.cpl] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [19/10/2005 08:59] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [19/10/2005 08:59] "7cf334f2"="C:\WINDOWS\system32\hjtacsxb.dll" [11/06/2008 20:19] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/08/2004 14:56] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk.disabled [31/01/2008 12:30:19] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [30/03/2005 08:00:27] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [19/11/2005 13:39:35] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "DisableCAD"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=0 (0x0) "NoColorChoice"=0 (0x0) "NoSizeChoice"=0 (0x0) "NoDispScrSavPage"=0 (0x0) "NoDispCPL"=0 (0x0) "NoVisualStyleChoice"=0 (0x0) "NoDispSettingsPage"=0 (0x0) "NoDispAppearancePage"=0 (0x0) "NoDispBackgroundPage"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktopChanges"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) "NoSaveSettings"=0 (0x0) "NoThemesTab"=0 (0x0) "NoToolbarCustomize"=1 (0x1) "StartMenuLogoff"=1 (0x1) "NoStartMenuMorePrograms"=0 (0x0) "NoSetFolders"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32] WinCtrl32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\khfFXpmn [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\saF73.sys] @="Driver" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent "AVG7_CC"=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP "AVG7_EMC"=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe "<NO NAME>"= "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f7a2cc3-71ae-11db-a5da-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5637dd12-74b3-11db-a5de-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff78c2f3-2d2c-11dc-a6af-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe -- End of Deckard's System Scanner: finished at 2008-06-12 07:53:22 ------------ I look forward to hearing rom you. Regards Bandit12 |
|
|
|
|
Jun 12 2008, 03:17 PM
Post
#4
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.
O2 - BHO: (no name) - {37029E75-F144-4F09-994A-0D897DB219D4} - (no file) O2 - BHO: (no name) - {437994AC-109F-49A3-B7C4-2B35402EEBC8} - (no file) O2 - BHO: (no name) - {84CAF2E2-C8AC-4D83-AA36-EB089931D218} - (no file) O2 - BHO: (no name) - {872D7223-4023-4F28-B02A-ABC059F4B0A9} - C:\WINDOWS\system32\khfFXpmn.dll O2 - BHO: (no name) - {C2FBEA86-DDE3-4792-A811-CE87F2A77EC5} - C:\WINDOWS\system32\pmnnKApn.dll (file missing) O2 - BHO: (no name) - {CA6E74C7-11DD-4BB4-A331-796A9AE5CF22} - (no file) O4 - HKLM\..\Run: [7cf334f2] rundll32.exe "C:\WINDOWS\system32\hjtacsxb.dll",b O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing) O21 - SSODL: vltdfabw - {55AA50E3-706E-499D-95A2-0A8BCFDEA75B} - (no file) Reboot your computer. Please download ComboFix and save it to your desktop. Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet. Double click combofix.exe and follow the prompts. When it's done running it will produce a log for you. Please post that log in your next reply. Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 12 2008, 05:19 PM
Post
#5
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
Hi Sam
OK, I have carried out your instructions and here is the Combofix log. I have my C and D drives back after Combofix ran by the way!! ComboFix 08-06-11.1 - Household 2008-06-12 22:56:40.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222 [GMT 1:00] Running from: C:\Documents and Settings\Household\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\system32\bxscatjh.ini C:\WINDOWS\system32\ddecwcew.ini C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\dvyibpwo.ini C:\WINDOWS\system32\gxymfybf.ini C:\WINDOWS\system32\htqxdqqs.ini C:\WINDOWS\system32\iqttbnkq.ini C:\WINDOWS\system32\jklwecqg.ini C:\WINDOWS\system32\khfFXpmn.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nmpXFfhk.ini C:\WINDOWS\system32\nmpXFfhk.ini2 C:\WINDOWS\system32\npAKnnmp.ini C:\WINDOWS\system32\npAKnnmp.ini2 C:\WINDOWS\system32\oltfqedy.ini C:\WINDOWS\system32\ooXEeMoq.ini C:\WINDOWS\system32\ooXEeMoq.ini2 C:\WINDOWS\system32\owpbiyvd.dll C:\WINDOWS\system32\oXwDJRqr.ini C:\WINDOWS\system32\oXwDJRqr.ini2 C:\WINDOWS\system32\qkdnldrt.ini C:\WINDOWS\system32\shstuknh.ini C:\WINDOWS\system32\wkxxhcef.ini . ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) . 2008-06-12 07:45 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-12 07:44 . 2008-06-12 07:44 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-11 07:09 . 2008-06-11 07:09 <DIR> d-------- C:\Deckard 2008-06-10 19:43 . 2008-06-10 19:43 <DIR> d-------- C:\VundoFix Backups 2008-06-06 16:51 . 2008-06-06 16:51 <DIR> d-------- C:\fsaua.data 2008-06-06 12:22 . 2008-06-06 16:48 <DIR> d-------- C:\Program Files\EsetOnlineScanner 2008-06-06 09:36 . 2008-06-06 09:36 <DIR> d-------- C:\Program Files\CCleaner 2008-06-04 22:47 . 2008-06-04 22:47 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-03 20:46 . 2008-06-03 20:46 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-03 20:46 . 2008-06-03 20:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-30 15:50 . 2005-10-19 08:59 163,840 --a------ C:\WINDOWS\system32\igfxres.dll 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 18:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-12 18:13 --------- d-----w C:\Documents and Settings\Household\Application Data\AdobeUM 2008-06-12 06:45 --------- d-----w C:\Program Files\Java 2008-06-06 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-04 07:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVG7 2008-06-03 19:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-02 23:06 --------- d---a-w C:\Documents and Settings\Household\Application Data\AVG7 2008-06-01 17:46 --------- d-----w C:\Program Files\Paint Shop Pro 6 2008-04-29 13:08 --------- d-----w C:\Program Files\iTunes 2008-04-29 13:07 --------- d-----w C:\Program Files\iPod 2008-04-29 12:56 --------- d-----w C:\Program Files\QuickTime 2008-04-29 12:54 --------- d-----w C:\Program Files\Apple Software Update 2008-04-29 12:53 --------- d-----w C:\Program Files\Common Files\Apple 2008-04-29 10:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 10:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 10:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-13 16:46 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Roxio 2008-04-13 16:46 --------- d-----w C:\Documents and Settings\Household\Application Data\Roxio 2008-01-21 20:43 48,008 -c--a-w C:\Documents and Settings\Household\Application Data\GDIPFONTCACHEV1.DAT 2006-11-22 12:58 28,672 ----a-w C:\Documents and Settings\Household\atwbxdet.dll 2005-06-16 09:19 284 -c--a-w C:\Documents and Settings\Household\Application Data\ViewerApp.dat 2007-11-30 17:57 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 14:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 21:42 1404928] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-12 14:55 110592 C:\WINDOWS\system32\bthprops.cpl] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 08:59 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59 126976] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] Adobe Reader Speed Launch.lnk.disabled [2008-01-31 12:30:19 1757] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2005-03-30 08:00:27 581632] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [2005-11-19 13:39:35 483412] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\saF73.sys] @="Driver" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent "AVG7_CC"=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP "AVG7_EMC"=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe "<NO NAME>"= "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Eicon\\Diva\\watch.exe"= "C:\\WINDOWS\\system32\\fxsclnt.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= R0 DiMaint;Eicon Maintenance Driver;C:\WINDOWS\system32\DRIVERS\DISDN\dimaint.sys [2002-12-04 20:49] R2 DiCapi;Eicon CAPI 2.0 Driver;C:\WINDOWS\system32\DRIVERS\DISDN\capi202k.sys [2001-06-12 19:27] R2 DiPort;Eicon Port Driver;C:\WINDOWS\system32\DRIVERS\DISDN\diport40.sys [2002-10-16 20:32] S3 AR5523;NETGEAR WG111T USB2.0 Wireless Card Service;C:\WINDOWS\system32\DRIVERS\wg11tnd5.sys [2004-10-15 11:41] S3 ATHFMWDL;NETGEAR WG111T bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys [2004-10-14 19:24] S3 DiWan;Eicon Driver for all Diva Client cards;C:\WINDOWS\system32\DRIVERS\DISDN\Diwan.sys [2002-10-03 21:35] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 13:10] S3 saF73;saF73;C:\WINDOWS\System32\drivers\saF73.sys [] S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41] S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2004-12-19 05:32] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f7a2cc3-71ae-11db-a5da-00146c3373a3}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5637dd12-74b3-11db-a5de-00146c3373a3}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff78c2f3-2d2c-11dc-a6af-00146c3373a3}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe . Contents of the 'Scheduled Tasks' folder "2008-06-04 02:30:00 C:\WINDOWS\Tasks\AVG Free Edition for Windows.job" - C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe "2008-06-04 01:30:00 C:\WINDOWS\Tasks\Disk Cleanup.job" - C:\WINDOWS\system32\cleanmgr.exe "2008-06-12 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe "2008-06-12 22:10:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{9823A8EF-1708-45D6-AC12-22AB45BE1A67}.job" - C:\WINDOWS\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-12 23:09:41 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Logitech\SetPoint\lgscroll.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.exe . ************************************************************************** . Completion time: 2008-06-12 23:14:17 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-12 22:14:12 Pre-Run: 23,577,374,720 bytes free Post-Run: 23,634,104,320 bytes free 181 --- E O F --- 2008-05-27 22:02:45 Many thanks Bandit12 |
|
|
|
|
Jun 12 2008, 05:43 PM
Post
#6
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Download and scan with SUPERAntiSpyware Free for Home Users
Also post a new log from DSS. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 13 2008, 01:16 PM
Post
#7
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
Hi Sam
All done. Here is the Super Antispyware Scan log: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/13/2008 at 01:13 PM Application Version : 4.15.1000 Core Rules Database Version : 3481 Trace Rules Database Version: 1472 Scan type : Complete Scan Total Scan Time : 04:39:19 Memory items scanned : 331 Memory threats detected : 0 Registry items scanned : 7324 Registry threats detected : 0 File items scanned : 79810 File threats detected : 98 Adware.Tracking Cookie C:\Documents and Settings\Household\Cookies\household@banner.casino.blackpoolclub.co[2].txt C:\Documents and Settings\Household\Cookies\household@uk.sitestat[3].txt C:\Documents and Settings\Household\Cookies\household@edge.ru4[1].txt C:\Documents and Settings\Household\Cookies\household@rotator.adjuggler[1].txt C:\Documents and Settings\Household\Cookies\household@ad1.emediate[1].txt C:\Documents and Settings\Household\Cookies\household@americanexpress.122.2o7[1].txt C:\Documents and Settings\Household\Cookies\household@banner.bingo.blackpoolclub.co[2].txt C:\Documents and Settings\Household\Cookies\household@doubleclick[1].txt C:\Documents and Settings\Household\Cookies\household@counter.hitslink[1].txt C:\Documents and Settings\Household\Cookies\household@atwola[1].txt C:\Documents and Settings\Household\Cookies\household@247realmedia[1].txt C:\Documents and Settings\Household\Cookies\household@atdmt[2].txt C:\Documents and Settings\Household\Cookies\household@mediaplex[1].txt C:\Documents and Settings\Household\Cookies\household@serving-sys[2].txt C:\Documents and Settings\Household\Cookies\household@nextag[2].txt C:\Documents and Settings\Household\Cookies\household@www.burstbeacon[2].txt C:\Documents and Settings\Household\Cookies\household@tradedoubler[1].txt C:\Documents and Settings\Household\Cookies\household@banner.poker.blackpoolclub.co[2].txt C:\Documents and Settings\Household\Cookies\household@anad.tacoda[2].txt C:\Documents and Settings\Household\Cookies\household@msnportal.112.2o7[1].txt C:\Documents and Settings\Household\Cookies\household@atoc.112.2o7[1].txt C:\Documents and Settings\Household\Cookies\household@82.98.235[1].txt C:\Documents and Settings\Household\Cookies\household@bannersng.yell[1].txt C:\Documents and Settings\Household\Cookies\household@ehg-ads.hitbox[2].txt C:\Documents and Settings\Household\Cookies\household@adrevolver[2].txt C:\Documents and Settings\Household\Cookies\household@hitbox[2].txt C:\Documents and Settings\Household\Cookies\household@reduxads.valuead[2].txt C:\Documents and Settings\Household\Cookies\household@statse.webtrendslive[2].txt C:\Documents and Settings\Household\Cookies\household@uk.sitestat[1].txt C:\Documents and Settings\Household\Cookies\household@tribalfusion[2].txt C:\Documents and Settings\Household\Cookies\household@track.webgains[2].txt C:\Documents and Settings\Household\Cookies\household@uk.sitestat[2].txt C:\Documents and Settings\Household\Cookies\household@adviva[1].txt C:\Documents and Settings\Household\Cookies\household@bluestreak[1].txt C:\Documents and Settings\Household\Cookies\household@media.adrevolver[1].txt C:\Documents and Settings\Household\Cookies\household@banner.poker770[2].txt C:\Documents and Settings\Household\Cookies\household@www.burstnet[1].txt C:\Documents and Settings\Household\Cookies\household@server.iad.liveperson[2].txt C:\Documents and Settings\Household\Cookies\household@adopt.euroclick[2].txt C:\Documents and Settings\Household\Cookies\household@ehg-eset.hitbox[1].txt C:\Documents and Settings\Household\Cookies\household@ehg-kasperskylab.hitbox[1].txt C:\Documents and Settings\Household\Cookies\household@eas.apm.emediate[2].txt C:\Documents and Settings\Household\Cookies\household@adultfriendfinder[1].txt C:\Documents and Settings\Household\Cookies\household@bs.serving-sys[1].txt C:\Documents and Settings\Household\Cookies\household@www.etracker[1].txt C:\Documents and Settings\Household\Cookies\household@statcounter[1].txt C:\Documents and Settings\Household\Cookies\household@tagiq.clickforensics[1].txt C:\Documents and Settings\Household\Cookies\household@ad.uk.tangozebra[1].txt C:\Documents and Settings\Household\Cookies\household@nextag.co[1].txt C:\Documents and Settings\Household\Cookies\household@revsci[1].txt C:\Documents and Settings\Household\Cookies\household@tripod[2].txt C:\Documents and Settings\Household\Cookies\household@uk.sitestat[4].txt C:\Documents and Settings\Household\Cookies\household@affiliatemarketing.directtrack[1].txt C:\Documents and Settings\Household\Cookies\household@adtech[1].txt C:\Documents and Settings\Household\Cookies\household@tracker.pegsanalytics[2].txt C:\Documents and Settings\Household\Cookies\household@valueclick[1].txt C:\Documents and Settings\Household\Cookies\household@ads.sun[2].txt C:\Documents and Settings\Household\Cookies\household@2o7[1].txt C:\Documents and Settings\Household\Cookies\household@ad.zanox[2].txt C:\Documents and Settings\Household\Cookies\household@insightexpressai[1].txt C:\Documents and Settings\Household\Cookies\household@xiti[1].txt C:\Documents and Settings\Household\Cookies\household@banner.joylandcasino[2].txt C:\Documents and Settings\Household\Cookies\household@006.free-counters.co[1].txt C:\Documents and Settings\Household\Cookies\household@www.clash-media[3].txt C:\Documents and Settings\Household\Cookies\household@ehg-logantod.hitbox[1].txt C:\Documents and Settings\Household\Cookies\household@www.googleadservices[1].txt C:\Documents and Settings\Household\Cookies\household@zanox[2].txt C:\Documents and Settings\Household\Cookies\household@data.coremetrics[1].txt C:\Documents and Settings\Household\Cookies\household@directtrack[1].txt C:\Documents and Settings\Household\Cookies\household@media.adrevolver[2].txt C:\Documents and Settings\Household\Cookies\household@dynamic.media.adrevolver[2].txt C:\Documents and Settings\Household\Cookies\household@e-2dj6wgmiekc5ebp.stats.esomniture[2].txt C:\Documents and Settings\Household\Cookies\household@www.inteletrack[2].txt C:\Documents and Settings\Household\Cookies\household@advertising[2].txt C:\Documents and Settings\Household\Cookies\household@ads.bleepingcomputer[2].txt C:\Documents and Settings\Household\Cookies\household@tracker.pegsanalytics[1].txt C:\Documents and Settings\Household\Cookies\household@hornymatches[2].txt C:\Documents and Settings\Household\Cookies\household@questionmarket[2].txt C:\Documents and Settings\Household\Cookies\household@angleinteractive.directtrack[2].txt C:\Documents and Settings\Household\Cookies\household@zedo[1].txt C:\Documents and Settings\Household\Cookies\household@linksynergy[1].txt C:\Documents and Settings\Household\Cookies\household@anat.tacoda[1].txt C:\Documents and Settings\Household\Cookies\household@ads1.partnerlogic[2].txt C:\Documents and Settings\Household\Cookies\household@track.webtrekk[1].txt C:\Documents and Settings\Household\Cookies\household@ad.doubleclick[1].txt C:\Documents and Settings\Household\Cookies\household@ads1.partnerlogic[1].txt C:\Documents and Settings\Household\Cookies\household@ads1.partnerlogic[3].txt C:\Documents and Settings\Household\Cookies\household@ads1.partnerlogic[4].txt C:\Documents and Settings\Household\Cookies\household@ads1.partnerlogic[5].txt C:\Documents and Settings\Household\Cookies\household@ehg-ads.hitbox[1].txt C:\Documents and Settings\Household\Cookies\household@ehg-ads.hitbox[3].txt C:\Documents and Settings\Household\Cookies\household@ehg-ads.hitbox[4].txt C:\Documents and Settings\Household\Cookies\household@ehg-ads.hitbox[5].txt C:\Documents and Settings\Household\Cookies\household@track.webgains[1].txt C:\Documents and Settings\Household\Cookies\household@www.clash-media[1].txt C:\Documents and Settings\Household\Cookies\household@www.clash-media[2].txt Adware.Vundo Variant/Rel C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP196\A0027456.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP196\A0027457.DLL And a new DSS log: Deckard's System Scanner v20071014.68 Run by Household on 2008-06-13 19:15:10 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 510 MiB (512 MiB recommended). -- HijackThis (run as Household.exe) ------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:15, on 13/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Household\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\HOUSEH~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.download.microsoft.com O15 - Trusted Zone: http://*.update.microsoft.com O15 - Trusted Zone: http://*.windowsupdate.com O15 - Trusted Zone: http://*.windowsupdate.microsoft.com O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-18.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215644406 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188215607359 O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O24 - Desktop Component 0: (no name) - http://player.virginradio.co.uk/core/playe...nts-vr/shim.gif -- End of file - 7769 bytes -- Files created between 2008-05-13 and 2008-06-13 ----------------------------- 2008-06-13 07:41:03 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-06-13 07:40:51 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-06-13 07:40:50 0 d-------- C:\Documents and Settings\Household\Application Data\SUPERAntiSpyware.com 2008-06-12 22:52:39 68096 --a------ C:\WINDOWS\zip.exe 2008-06-12 22:52:39 49152 --a------ C:\WINDOWS\VFind.exe 2008-06-12 22:52:39 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-06-12 22:52:39 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-06-12 22:52:39 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-06-12 22:52:39 98816 --a------ C:\WINDOWS\sed.exe 2008-06-12 22:52:39 80412 --a------ C:\WINDOWS\grep.exe 2008-06-12 22:52:39 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-06-12 19:16:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-06-12 07:44:19 0 d-------- C:\Program Files\Common Files\Java 2008-06-10 19:43:34 0 d-------- C:\VundoFix Backups 2008-06-06 16:51:16 0 d-------- C:\fsaua.data 2008-06-06 12:22:59 0 d-------- C:\Program Files\EsetOnlineScanner 2008-06-06 09:47:03 0 dr-h----- C:\Documents and Settings\Household\Recent 2008-06-06 09:36:47 0 d-------- C:\Program Files\CCleaner 2008-06-04 22:47:28 0 d-------- C:\Program Files\Trend Micro 2008-06-03 20:46:20 0 d-------- C:\Program Files\Lavasoft 2008-06-03 20:46:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft -- Find3M Report --------------------------------------------------------------- 2008-06-13 07:40:08 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-12 19:16:20 0 d-------- C:\Program Files\Common Files\Adobe 2008-06-12 19:13:33 0 d-------- C:\Documents and Settings\Household\Application Data\AdobeUM 2008-06-12 07:45:07 0 d-------- C:\Program Files\Java 2008-06-12 07:44:19 0 d-------- C:\Program Files\Common Files 2008-06-03 00:06:56 0 d-a------ C:\Documents and Settings\Household\Application Data\AVG7 2008-06-01 18:46:22 0 d-------- C:\Program Files\Paint Shop Pro 6 2008-04-29 14:08:03 0 d-------- C:\Program Files\iTunes 2008-04-29 14:07:48 0 d-------- C:\Program Files\iPod 2008-04-29 13:56:57 0 d-------- C:\Program Files\QuickTime 2008-04-29 13:54:11 0 d-------- C:\Program Files\Apple Software Update 2008-04-29 13:53:32 0 d-------- C:\Program Files\Common Files\Apple 2008-04-13 19:47:22 256 --a------ C:\WINDOWS\system32\pool.bin 2008-04-13 17:46:12 0 d-------- C:\Documents and Settings\Household\Application Data\Roxio -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [14/10/2004 21:42] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [06/12/2004 02:05] "BluetoothAuthenticationAgent"="bthprops.cpl" [12/08/2004 14:55 C:\WINDOWS\system32\bthprops.cpl] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [19/10/2005 08:59] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [19/10/2005 08:59] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/08/2004 14:56] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [28/05/2008 10:33] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/04/2008 03:38:16] Adobe Reader Speed Launch.lnk.disabled [31/01/2008 12:30:19] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [30/03/2005 08:00:27] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04] NETGEAR WG111T Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [19/11/2005 13:39:35] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"=0 (0x0) "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [13/05/2008 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\saF73.sys] @="Driver" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent "AVG7_CC"=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP "AVG7_EMC"=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe "<NO NAME>"= "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f7a2cc3-71ae-11db-a5da-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5637dd12-74b3-11db-a5de-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff78c2f3-2d2c-11dc-a6af-00146c3373a3}] AutoRun\command- F:\InstallTomTomHOME.exe -- End of Deckard's System Scanner: finished at 2008-06-13 19:15:59 ------------ Many thanks Bandit12 |
|
|
|
|
Jun 13 2008, 02:31 PM
Post
#8
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Your log is looking pretty good.
How are things on your end? Any problems now? -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 13 2008, 04:10 PM
Post
#9
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
Sam
Its late here here now so going to give the PC a good workout over the weekend but it looks like you have done a brilliant job! I tried to run a Windows update but the validation failed (Windows Genuine Advantage Validation Tool (KB892130)) to install. However, when I check my update history, Windows installed 4 updates today without it. I think the auto update is therefore working, just not the validation tool. Many many thanks for getting me up and going again and Ill report in again after the weeked. Cheers! Bandit12 |
|
|
|
|
Jun 14 2008, 10:35 AM
Post
#10
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Sounds good. Just let me know and I'll post back with some final steps for you.
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 16 2008, 11:46 AM
Post
#11
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
Hi Sam
Have used a good deal over the weekend with no problems. Let me know if you think I need to do anything more. Many thanks once again. Regards Bandit12 |
|
|
|
|
Jun 16 2008, 03:45 PM
Post
#12
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
That's what I like to hear!
 Just a few last things and you should be good to go! First, your log shows that you don't have the recovery console installed. Check this link for more info on the recovery console and how to get it installed. How to install and use the Windows XP Recovery Console =================== Next, let's remove Combofix now that we're done with it and clean up a few other things.
================== Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
 -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 16 2008, 05:14 PM
Post
#13
|
|
|
New Member Group: Members Posts: 7 Joined: 10-June 08 Member No.: 215,438 |
All done!!
Thanks again! Bandit12 |
|
|
|
|
Jun 17 2008, 08:06 AM
Post
#14
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Glad I could help you out!
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Jun 27 2008, 11:04 AM
Post
#15
|
|
|
Malware Expert Group: HJT Team Posts: 16,986 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Now that your problem appears to be resolved, this thread will be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request.
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th February 2010 - 03:47 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.