 Ad.yieldmanager Logs For Dassos |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jun 23 2008, 11:09 AM
Post
#16
|
|
|
Member  Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974  |
Scan saved at 11:09:22 AM, on 6/23/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\dmadmin.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - (no file) O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37390.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...320/mcfscan.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 7349 bytes |
 |
 
|
|
Jun 23 2008, 12:42 PM
Post
#17
|
|
 Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Γεια σου!
Open notepad and copy/paste the text in the quotebox below into it: File:: C:\WINDOWS\Internet Logs\xDBA.tmp C:\WINDOWS\Internet Logs\xDBB.tmp C:\WINDOWS\Internet Logs\xDBC.tmp C:\WINDOWS\Internet Logs\xDBD.tmp C:\WINDOWS\Internet Logs\xDBE.tmp C:\WINDOWS\Internet Logs\xDBF.tmp C:\WINDOWS\Internet Logs\xDB10.tmp C:\WINDOWS\Internet Logs\xDB1A.tmp C:\WINDOWS\system32\DTOSTNEYFHIZ Save this as "CFScript"  Referring to the picture above, drag CFScript into ComboFix.exe Then post the resultant log. This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall IMPORTANT: The above script was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format! -------------------- |
|
|
|
|
Jun 23 2008, 03:45 PM
Post
#18
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
ComboFix 08-06-20.4 - Phil 2008-06-23 15:36:06.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.515 [GMT -5:00] Running from: C:\Documents and Settings\Phil\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Phil\Desktop\CFScript * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-05-23 to 2008-06-23 ))))))))))))))))))))))))))))))) . 2008-06-19 21:58 . 2008-06-19 22:49 <DIR> d-------- C:\Documents and Settings\Phil\DoctorWeb 2008-06-18 22:17 . 2008-06-18 22:17 <DIR> d-------- C:\WINDOWS\McAfee.com 2008-06-17 20:14 . 2008-06-17 20:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2008-06-17 20:14 . 2008-06-17 20:15 <DIR> d-------- C:\Program Files\AVSMedia 2008-06-17 20:03 . 2008-06-17 20:03 <DIR> d-------- C:\DECCHECK 2008-06-16 21:29 . 2008-06-16 21:29 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-16 21:29 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-16 21:29 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-16 20:27 . 2007-12-28 14:32 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-06-16 20:03 . 2008-06-16 20:03 <DIR> d-------- C:\Program Files\Zamaan's Software 2008-06-16 20:03 . 1998-06-24 13:00 244,024 --a------ C:\WINDOWS\system32\MSFLXGRD.OCX 2008-06-16 16:37 . 2008-06-16 16:39 542,026 --a------ C:\WINDOWS\system32\DTOSTNEYFHIZ 2008-06-16 16:21 . 2008-06-16 19:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-16 11:49 . 2008-06-16 11:51 2,260 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-13 09:39 . 2008-06-13 09:41 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-12 11:06 . 2008-06-12 11:08 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-06-12 00:13 . 2008-06-20 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity 2008-06-12 00:06 . 2008-06-16 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-06-11 08:45 . 2008-06-23 08:28 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-11 08:45 . 2008-06-11 08:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-11 08:45 . 2008-06-11 08:45 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-11 08:45 . 2008-06-11 08:45 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-10 18:55 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-10 18:54 . 2008-06-10 18:54 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-10 18:42 . 2008-06-10 18:42 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-06-10 18:32 . 2008-06-10 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-06-10 18:31 . 2008-06-10 18:31 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-06-10 18:04 . 2008-06-13 06:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 18:04 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-10 17:58 . 2008-06-10 17:58 <DIR> d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2 2008-06-10 17:58 . 2008-06-16 14:07 <DIR> d-------- C:\Documents and Settings\Phil\SecurityScans 2008-06-08 07:04 . 2008-06-08 07:04 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-06-07 18:01 . 2008-06-07 18:01 <DIR> dr-h----- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-06-07 17:31 . 2008-06-12 00:00 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\WholeSecurity 2008-06-07 17:31 . 2008-06-07 17:31 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\eBay 2008-06-07 17:31 . 2008-06-07 17:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\eBay 2008-06-07 17:29 . 2008-06-07 17:29 <DIR> d-------- C:\Program Files\eBay . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-23 13:53 74,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-23 13:53 6,696,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-21 22:38 6,888,041 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-06-19 03:00 105,090 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_06_18_21_55_20_small.dmp.zip 2008-06-19 02:55 3,416,576 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp 2008-06-19 02:18 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-06-19 02:18 --------- d-----w C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com 2008-06-19 02:16 3,410,432 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp 2008-06-17 22:52 3,395,584 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp 2008-06-17 00:53 3,342,848 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2008-06-17 00:43 --------- d-----w C:\Program Files\Lavasoft 2008-06-16 23:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-16 16:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-16 15:50 2,662,400 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2008-06-16 01:37 3,271,680 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2008-06-13 14:39 --------- d-----w C:\Program Files\SpywareBlaster 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 05:07 --------- d-----w C:\Program Files\Yahoo! 2008-06-11 15:17 3,235,328 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2008-06-11 13:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-06-11 00:19 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-11 00:18 3,216,896 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp 2008-06-10 23:55 --------- d-----w C:\Program Files\Java 2008-06-10 23:42 --------- d-----w C:\Program Files\Common Files\Real 2008-06-10 23:41 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-06-10 23:41 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-06-10 23:32 --------- d-----w C:\Documents and Settings\Phil\Application Data\ATI 2008-06-10 23:29 --------- d-----w C:\Program Files\ATI Technologies 2008-06-10 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-10 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-08 01:58 --------- d-----w C:\Program Files\Common Files\Scanner 2008-05-17 05:50 --------- d-----w C:\Documents and Settings\Phil\Application Data\AVGTOOLBAR 2008-05-17 05:29 --------- d-----w C:\Program Files\AVG 2008-05-17 04:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-05-12 15:56 397,312 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-05-12 15:54 305,152 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-05-12 15:53 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-05-12 15:49 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-05-12 15:45 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-05-12 15:45 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-05-12 15:45 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-05-12 15:45 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-05-12 15:44 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-05-12 15:43 540,672 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-05-12 15:43 10,153,984 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-05-12 15:41 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-05-12 15:32 3,203,168 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-05-12 15:22 1,999,616 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-05-12 15:09 47,104 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-05-12 15:05 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-05-12 15:05 327,680 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-05-12 15:03 19,968 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-05-12 15:03 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-05-12 15:02 241,664 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-05-12 14:57 548,864 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll 2008-05-02 05:08 104,781 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_05_02_00_03_36_small.dmp.zip 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 10:42 985,088 ------w C:\WINDOWS\system32\setupapi.dll 2008-04-14 10:42 11,264 ------w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 10:41 423,936 ------w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ------w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ------w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 12,168 ------w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 00:10 53,279 ------w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ------w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ------w C:\WINDOWS\system32\msafd.dll 2008-04-13 19:30 1,845,632 ------w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:27 2,188,928 ------w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 18:44 17,664 ------w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-13 18:43 12,800 ------w C:\WINDOWS\system32\spiisupd.exe 2008-04-13 18:31 7,424 ------w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:31 2,065,792 ------w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 18:30 61,440 ------w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:39 438,784 ------w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 17:39 2,897,920 ------w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 17:39 187,392 ------w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-13 17:21 733,696 ------w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 17:09 4,096 ------w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 16:48 1,647,616 ------w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ------w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 16:22 48,128 ------w C:\WINDOWS\system32\inetres.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-17_16.55.23.24 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-17 19:20:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-23 15:02:48 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 12:30:49 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 11:05:51 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2002-07-31 07:50:00 24,576 ----a-w C:\WINDOWS\McAfee.com\FreeScan\avdat.exe + 2007-07-09 11:20:00 5,264 ----a-w C:\WINDOWS\McAfee.com\FreeScan\config.dat + 2008-06-18 14:51:52 156,984 ----a-w C:\WINDOWS\McAfee.com\FreeScan\mcfscan.dll + 2007-07-09 11:20:00 2,724,006 ----a-w C:\WINDOWS\McAfee.com\FreeScan\mcscan32.dll + 2008-06-18 10:20:00 873,395 ----a-w C:\WINDOWS\McAfee.com\FreeScan\names.DAT + 2006-12-18 16:03:00 7,449 ----a-w C:\WINDOWS\McAfee.com\FreeScan\rwabs16.dll + 2006-12-18 16:03:10 16,921 ----a-w C:\WINDOWS\McAfee.com\FreeScan\rwabs32.dll + 2008-06-18 10:20:00 30,830,933 ----a-w C:\WINDOWS\McAfee.com\FreeScan\scan.DAT - 2000-08-31 13:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe + 2000-08-31 13:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe + 2003-05-22 18:26:16 638,976 ----a-w C:\WINDOWS\system32\divx.dll - 2008-05-17 05:31:33 130,096 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-06-18 21:48:40 130,888 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2003-05-22 05:50:36 261,632 ----a-w C:\WINDOWS\system32\mcdvd_32.dll + 2002-01-05 21:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll + 2002-08-20 06:41:12 413,760 ----a-w C:\WINDOWS\system32\mpg4c32.dll + 2002-01-05 20:40:18 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll + 2002-01-05 08:37:26 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll + 2003-05-21 18:50:38 24,576 ----a-w C:\WINDOWS\system32\msxml3a.dll + 2004-07-04 02:59:06 524,288 ----a-w C:\WINDOWS\system32\xvidcore.dll + 2004-07-04 03:08:04 139,264 ----a-w C:\WINDOWS\system32\xvidvfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] 2008-06-02 15:56 160496 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-05-28 09:40 1197296] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-03-13 14:30 652528] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-11 08:45 1177368] "BHR"="C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe" [2006-10-24 22:14 9375744] "WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-04-25 12:31 333120] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-10 18:41 185896] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.imm4"= vcmimm4.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk] backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SECRETMAKER.lnk] backup=C:\WINDOWS\pss\SECRETMAKER.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-05-28 09:40 1197296 C:\Program Files\CCleaner\ccleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] --------- 2001-08-06 13:03 155648 C:\WINDOWS\System32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\server.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\admin.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\service\\JavaSrvc.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 "2100:TCP"= 2100:TCP:*:Disabled:IPRegister "80:TCP"= 80:TCP:*:Disabled:Web R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-11 08:45] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-11 08:45] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-11 08:45] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-11 08:45] R3 TARWDM;Video Blaster DigitalVCR;C:\WINDOWS\system32\DRIVERS\ct5882.sys [2001-11-13 19:36] S4 ANJOCLHEON;ANJOCLHEON;C:\DOCUME~1\Phil\LOCALS~1\Temp\ANJOCLHEON.exe [] S4 JQQYC;JQQYC;C:\DOCUME~1\Phil\LOCALS~1\Temp\JQQYC.exe [] S4 PCPFJMTTZF;PCPFJMTTZF;C:\DOCUME~1\Phil\LOCALS~1\Temp\PCPFJMTTZF.exe [] S4 SMSv3_0_2hs;SMSv3_0_2hs;C:\Program Files\Rosetta Stone\SMS v3.0.2hs\Service\JavaSrvc.exe [2006-04-21 11:20] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-23 15:38:13 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-23 15:40:11 ComboFix-quarantined-files.txt 2008-06-23 20:39:47 ComboFix2.txt 2008-06-23 15:55:45 ComboFix3.txt 2008-06-21 22:59:33 ComboFix4.txt 2008-06-21 22:30:25 ComboFix5.txt 2008-06-17 21:56:28 Pre-Run: 9,744,773,120 bytes free Post-Run: 9,752,682,496 bytes free 270 --- E O F --- 2008-06-19 21:47:22 |
|
|
|
|
Jun 24 2008, 10:56 AM
Post
#19
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Fhil, make sure you use notepad, ok!
Open notepad and copy/paste the text in the quotebox below into it: QUOTE File:: C:\WINDOWS\Internet Logs\xDBA.tmp C:\WINDOWS\Internet Logs\xDBB.tmp C:\WINDOWS\Internet Logs\xDBC.tmp C:\WINDOWS\Internet Logs\xDBD.tmp C:\WINDOWS\Internet Logs\xDBE.tmp C:\WINDOWS\Internet Logs\xDBF.tmp C:\WINDOWS\Internet Logs\xDB10.tmp C:\WINDOWS\Internet Logs\xDB1A.tmp C:\WINDOWS\system32\DTOSTNEYFHIZ Save this as "CFScript" Referring to the picture above, drag CFScript into ComboFix.exe Then post the resultant log. This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. IMPORTANT: The above script was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format! This post has been edited by DASOS: Jun 24 2008, 11:24 AM -------------------- |
|
|
|
|
Jun 26 2008, 01:14 PM
Post
#20
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
This may help!
fhi2.png ( 118.08k )
Number of downloads: 8
fhil1.png ( 64.78k )
Number of downloads: 10
-------------------- |
|
|
|
|
Jun 26 2008, 11:10 PM
Post
#21
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
ComboFix 08-06-20.4 - Phil 2008-06-26 23:04:07.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.545 [GMT -5:00] Running from: C:\Documents and Settings\Phil\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Phil\Desktop\CFScript * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 ))))))))))))))))))))))))))))))) . 2008-06-19 21:58 . 2008-06-19 22:49 <DIR> d-------- C:\Documents and Settings\Phil\DoctorWeb 2008-06-18 22:17 . 2008-06-18 22:17 <DIR> d-------- C:\WINDOWS\McAfee.com 2008-06-17 20:14 . 2008-06-17 20:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2008-06-17 20:14 . 2008-06-17 20:15 <DIR> d-------- C:\Program Files\AVSMedia 2008-06-17 20:03 . 2008-06-17 20:03 <DIR> d-------- C:\DECCHECK 2008-06-16 21:29 . 2008-06-26 08:41 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-16 21:29 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-16 21:29 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-16 20:27 . 2007-12-28 14:32 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-06-16 20:03 . 2008-06-16 20:03 <DIR> d-------- C:\Program Files\Zamaan's Software 2008-06-16 20:03 . 1998-06-24 13:00 244,024 --a------ C:\WINDOWS\system32\MSFLXGRD.OCX 2008-06-16 16:37 . 2008-06-16 16:39 542,026 --a------ C:\WINDOWS\system32\DTOSTNEYFHIZ 2008-06-16 16:21 . 2008-06-16 19:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-16 11:49 . 2008-06-16 11:51 2,260 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-13 09:39 . 2008-06-13 09:41 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-12 11:06 . 2008-06-26 09:24 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-06-12 00:13 . 2008-06-20 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity 2008-06-12 00:06 . 2008-06-16 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-06-11 08:45 . 2008-06-26 09:29 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-11 08:45 . 2008-06-11 08:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-11 08:45 . 2008-06-11 08:45 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-11 08:45 . 2008-06-11 08:45 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-10 18:55 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-10 18:54 . 2008-06-10 18:54 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-10 18:42 . 2008-06-10 18:42 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-06-10 18:32 . 2008-06-10 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-06-10 18:31 . 2008-06-10 18:31 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-06-10 18:04 . 2008-06-13 06:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 18:04 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-10 17:58 . 2008-06-10 17:58 <DIR> d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2 2008-06-10 17:58 . 2008-06-16 14:07 <DIR> d-------- C:\Documents and Settings\Phil\SecurityScans 2008-06-08 07:04 . 2008-06-08 07:04 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-06-07 18:01 . 2008-06-07 18:01 <DIR> dr-h----- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-06-07 17:31 . 2008-06-12 00:00 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\WholeSecurity 2008-06-07 17:31 . 2008-06-07 17:31 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\eBay 2008-06-07 17:31 . 2008-06-26 13:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\eBay 2008-06-07 17:29 . 2008-06-26 13:54 <DIR> d-------- C:\Program Files\eBay . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 19:03 75,848 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-26 19:03 6,696,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-26 13:34 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-26 13:34 --------- d-----w C:\Program Files\SpywareBlaster 2008-06-23 23:42 7,465,791 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-06-19 03:00 105,090 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_06_18_21_55_20_small.dmp.zip 2008-06-19 02:55 3,416,576 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp 2008-06-19 02:18 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-06-19 02:18 --------- d-----w C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com 2008-06-19 02:16 3,410,432 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp 2008-06-17 22:52 3,395,584 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp 2008-06-17 00:53 3,342,848 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2008-06-17 00:43 --------- d-----w C:\Program Files\Lavasoft 2008-06-16 23:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-16 15:50 2,662,400 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2008-06-16 01:37 3,271,680 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 05:07 --------- d-----w C:\Program Files\Yahoo! 2008-06-11 15:17 3,235,328 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2008-06-11 13:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-06-11 00:19 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-11 00:18 3,216,896 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp 2008-06-10 23:55 --------- d-----w C:\Program Files\Java 2008-06-10 23:42 --------- d-----w C:\Program Files\Common Files\Real 2008-06-10 23:41 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-06-10 23:41 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-06-10 23:32 --------- d-----w C:\Documents and Settings\Phil\Application Data\ATI 2008-06-10 23:29 --------- d-----w C:\Program Files\ATI Technologies 2008-06-10 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-10 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-08 01:58 --------- d-----w C:\Program Files\Common Files\Scanner 2008-05-17 05:50 --------- d-----w C:\Documents and Settings\Phil\Application Data\AVGTOOLBAR 2008-05-17 05:29 --------- d-----w C:\Program Files\AVG 2008-05-17 04:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-05-12 15:56 397,312 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-05-12 15:54 305,152 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-05-12 15:53 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-05-12 15:49 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-05-12 15:45 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-05-12 15:45 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-05-12 15:45 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-05-12 15:45 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-05-12 15:44 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-05-12 15:43 540,672 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-05-12 15:43 10,153,984 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-05-12 15:41 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-05-12 15:32 3,203,168 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-05-12 15:22 1,999,616 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-05-12 15:09 47,104 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-05-12 15:05 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-05-12 15:05 327,680 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-05-12 15:03 19,968 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-05-12 15:03 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-05-12 15:02 241,664 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-05-12 14:57 548,864 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll 2008-05-02 05:08 104,781 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_05_02_00_03_36_small.dmp.zip 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 10:42 985,088 ------w C:\WINDOWS\system32\setupapi.dll 2008-04-14 10:42 11,264 ------w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 10:41 423,936 ------w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ------w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ------w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 12,168 ------w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 00:10 53,279 ------w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ------w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ------w C:\WINDOWS\system32\msafd.dll 2008-04-13 19:30 1,845,632 ------w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:27 2,188,928 ------w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 18:44 17,664 ------w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-13 18:43 12,800 ------w C:\WINDOWS\system32\spiisupd.exe 2008-04-13 18:31 7,424 ------w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:31 2,065,792 ------w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 18:30 61,440 ------w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:39 438,784 ------w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 17:39 2,897,920 ------w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 17:39 187,392 ------w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-13 17:21 733,696 ------w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 17:09 4,096 ------w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 16:48 1,647,616 ------w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ------w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 16:22 48,128 ------w C:\WINDOWS\system32\inetres.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-17_16.55.23.24 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-17 19:20:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-27 03:32:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-04-14 12:30:49 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-13 11:05:51 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2002-07-31 07:50:00 24,576 ----a-w C:\WINDOWS\McAfee.com\FreeScan\avdat.exe + 2007-07-09 11:20:00 5,264 ----a-w C:\WINDOWS\McAfee.com\FreeScan\config.dat + 2008-06-18 14:51:52 156,984 ----a-w C:\WINDOWS\McAfee.com\FreeScan\mcfscan.dll + 2007-07-09 11:20:00 2,724,006 ----a-w C:\WINDOWS\McAfee.com\FreeScan\mcscan32.dll + 2008-06-18 10:20:00 873,395 ----a-w C:\WINDOWS\McAfee.com\FreeScan\names.DAT + 2006-12-18 16:03:00 7,449 ----a-w C:\WINDOWS\McAfee.com\FreeScan\rwabs16.dll + 2006-12-18 16:03:10 16,921 ----a-w C:\WINDOWS\McAfee.com\FreeScan\rwabs32.dll + 2008-06-18 10:20:00 30,830,933 ----a-w C:\WINDOWS\McAfee.com\FreeScan\scan.DAT - 2000-08-31 13:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe + 2000-08-31 13:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe + 2003-05-22 18:26:16 638,976 ----a-w C:\WINDOWS\system32\divx.dll - 2008-05-17 05:31:33 130,096 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-06-18 21:48:40 130,888 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2003-05-22 05:50:36 261,632 ----a-w C:\WINDOWS\system32\mcdvd_32.dll + 2002-01-05 21:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll + 2002-08-20 06:41:12 413,760 ----a-w C:\WINDOWS\system32\mpg4c32.dll + 2002-01-05 20:40:18 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll + 2002-01-05 08:37:26 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll + 2003-05-21 18:50:38 24,576 ----a-w C:\WINDOWS\system32\msxml3a.dll + 2004-07-04 02:59:06 524,288 ----a-w C:\WINDOWS\system32\xvidcore.dll + 2004-07-04 03:08:04 139,264 ----a-w C:\WINDOWS\system32\xvidvfw.dll - 2008-06-10 23:49:23 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat + 2008-06-27 03:32:49 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] 2008-06-02 15:56 160496 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-05-28 09:40 1197296] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-11 08:45 1177368] "BHR"="C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe" [2006-10-24 22:14 9375744] "WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-04-25 12:31 333120] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-10 18:41 185896] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.imm4"= vcmimm4.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk] backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SECRETMAKER.lnk] backup=C:\WINDOWS\pss\SECRETMAKER.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-05-28 09:40 1197296 C:\Program Files\CCleaner\ccleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] --------- 2001-08-06 13:03 155648 C:\WINDOWS\System32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\server.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\admin.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\service\\JavaSrvc.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 "2100:TCP"= 2100:TCP:*:Disabled:IPRegister "80:TCP"= 80:TCP:*:Disabled:Web R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-11 08:45] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-11 08:45] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-11 08:45] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-11 08:45] R3 TARWDM;Video Blaster DigitalVCR;C:\WINDOWS\system32\DRIVERS\ct5882.sys [2001-11-13 19:36] S4 ANJOCLHEON;ANJOCLHEON;C:\DOCUME~1\Phil\LOCALS~1\Temp\ANJOCLHEON.exe [] S4 JQQYC;JQQYC;C:\DOCUME~1\Phil\LOCALS~1\Temp\JQQYC.exe [] S4 PCPFJMTTZF;PCPFJMTTZF;C:\DOCUME~1\Phil\LOCALS~1\Temp\PCPFJMTTZF.exe [] S4 SMSv3_0_2hs;SMSv3_0_2hs;C:\Program Files\Rosetta Stone\SMS v3.0.2hs\Service\JavaSrvc.exe [2006-04-21 11:20] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-26 23:05:56 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-26 23:07:48 ComboFix-quarantined-files.txt 2008-06-27 04:07:38 ComboFix2.txt 2008-06-23 20:40:12 ComboFix3.txt 2008-06-23 15:55:45 ComboFix4.txt 2008-06-21 22:59:33 ComboFix5.txt 2008-06-21 22:30:25 Pre-Run: 9,959,309,312 bytes free Post-Run: 9,939,263,488 bytes free 272 --- E O F --- 2008-06-19 21:47:22 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:10:07 PM, on 6/26/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\dmadmin.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37390.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...320/mcfscan.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 6970 bytes |
|
|
|
|
Jun 29 2008, 02:14 PM
Post
#22
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
I did a McAfee online scan and before it reboot the comp. I got this message:RemAdm-ProcLaunch!171 Then it said C:\Documents and setting\...\A0229998.exe My mom will be in Loutraki tomorrow
|
|
|
|