 Ad.yieldmanager Logs For Dassos |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jun 17 2008, 03:07 PM
Post
#1
|
|
|
Member  Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974  |
Run by Phil on 2008-06-17 14:55:23 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Phil.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:55:30, on 6/17/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\dmadmin.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Phil\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Phil.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - (no file) O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" O4 - HKLM\..\Run: [BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37390.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: ANJOCLHEON - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\ANJOCLHEON.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: JQQYC - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\JQQYC.exe O23 - Service: PCPFJMTTZF - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\PCPFJMTTZF.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 7600 bytes -- Files created between 2008-05-17 and 2008-06-17 ----------------------------- 2008-06-17 14:21:30 0 dr-h----- C:\Documents and Settings\Phil\Recent 2008-06-16 21:29:15 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-16 20:03:32 0 d-------- C:\Program Files\Zamaan's Software 2008-06-16 16:37:35 542026 --a------ C:\WINDOWS\system32\DTOSTNEYFHIZ 2008-06-16 12:46:08 0 d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes 2008-06-16 12:46:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-16 11:49:59 2260 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-13 09:39:15 0 d--h----- C:\$AVG8.VAULT$ 2008-06-12 11:06:13 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-06-12 00:13:08 0 d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity 2008-06-12 00:06:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-06-11 08:45:10 0 d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-10 18:59:25 0 d-------- C:\Documents and Settings\Phil\Application Data\WinRAR 2008-06-10 18:54:45 0 d-------- C:\Program Files\Common Files\Java 2008-06-10 18:42:33 0 d-------- C:\Program Files\Common Files\xing shared 2008-06-10 18:32:38 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-06-10 18:31:03 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-06-10 17:58:36 0 d-------- C:\Documents and Settings\Phil\SecurityScans 2008-06-10 17:58:10 0 d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2 2008-06-08 07:04:38 0 d-------- C:\WINDOWS\system32\Adobe 2008-06-07 18:01:28 0 dr-h----- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-06-07 17:31:20 0 d-------- C:\Documents and Settings\Phil\Application Data\WholeSecurity 2008-06-07 17:31:16 0 d-------- C:\Documents and Settings\Phil\Application Data\eBay 2008-06-07 17:31:16 0 d-------- C:\Documents and Settings\All Users\Application Data\eBay 2008-06-07 17:29:30 0 d-------- C:\Program Files\eBay 2008-05-17 00:29:27 0 d-------- C:\Documents and Settings\Phil\Application Data\AVGTOOLBAR 2008-05-17 00:29:06 0 d-------- C:\Program Files\AVG 2008-05-17 00:29:04 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-05-17 00:22:01 0 d-------- C:\WINDOWS\system32\scripting 2008-05-17 00:21:59 0 d-------- C:\WINDOWS\system32\en 2008-05-17 00:21:59 0 d-------- C:\WINDOWS\l2schemas -- Find3M Report --------------------------------------------------------------- 2008-06-16 22:31:24 0 d-------- C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com 2008-06-16 22:31:23 0 d-------- C:\Program Files\Common Files 2008-06-16 22:31:22 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-06-16 19:43:39 0 d-------- C:\Program Files\Lavasoft 2008-06-13 09:39:15 0 d-------- C:\Program Files\SpywareBlaster 2008-06-12 00:07:09 0 d-------- C:\Program Files\Yahoo! 2008-06-12 00:00:02 0 d-------- C:\Documents and Settings\Phil\Application Data\Mozilla 2008-06-10 19:19:16 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-10 18:55:26 0 d-------- C:\Program Files\Java 2008-06-10 18:49:23 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-06-10 18:42:18 0 d-------- C:\Program Files\Common Files\Real 2008-06-10 18:32:38 0 d-------- C:\Documents and Settings\Phil\Application Data\ATI 2008-06-10 18:29:27 0 d-------- C:\Program Files\ATI Technologies 2008-06-10 18:28:01 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-07 20:58:02 0 d-------- C:\Program Files\Common Files\Scanner 2008-05-17 00:22:22 0 d-------- C:\Program Files\Messenger 2008-05-17 00:21:58 0 d-------- C:\Program Files\Movie Maker 2008-05-17 00:19:33 0 d-------- C:\Program Files\Windows NT 2008-05-12 10:49:00 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart> 2008-04-04 11:25:45 96 --a------ C:\WINDOWS\system32\pdfl.dat 2008-04-03 23:10:50 144 --a------ C:\WINDOWS\system32\lkfl.dat 2008-04-03 23:10:50 96 --a------ C:\WINDOWS\system32\ibfl.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] 06/02/2008 15:56 160496 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [03/13/2008 14:30] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [01/10/2008 11:41] "WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [04/25/2008 12:31] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [04/02/2008 21:07] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/11/2008 08:45] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/10/2008 18:41] "YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [02/26/2008 11:26] "BHR"="C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe" [10/24/2006 22:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [05/28/2008 09:40] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 19:12] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [01/10/2008 11:41] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk] backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SECRETMAKER.lnk] backup=C:\WINDOWS\pss\SECRETMAKER.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\System32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-06-17 14:57:20 ------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:03:29, on 6/17/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\dmadmin.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - (no file) O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" O4 - HKLM\..\Run: [BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37390.cab O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: ANJOCLHEON - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\ANJOCLHEON.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: JQQYC - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\JQQYC.exe O23 - Service: PCPFJMTTZF - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Phil\LOCALS~1\Temp\PCPFJMTTZF.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 7592 bytes |
 |
 
|
|
Jun 17 2008, 03:42 PM
Post
#2
|
|
 Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Γεια σου φιλιπακι!!
Please download ComboFix.exe. Visit this webpage for download links, and reed the instructions carefully, for running the tool: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
-------------------- |
|
|
|
|
Jun 17 2008, 04:24 PM
Post
#3
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
problem I have xp pro (sp3) It only lists sp1 and sp2 What to do?
|
|
|
|
|
Jun 17 2008, 04:30 PM
Post
#4
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Ένα λεπτό δώσε μου.
-------------------- |
|
|
|
|
Jun 17 2008, 04:35 PM
Post
#5
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
No problem go!!
-------------------- |
|
|
|
|
Jun 17 2008, 04:36 PM
Post
#6
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
ok
|
|
|
|
|
Jun 17 2008, 04:44 PM
Post
#7
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
Said this machine already has recovory console installed aborting operations and then it told me to have a nice day lol
This post has been edited by ptv: Jun 17 2008, 04:50 PM |
|
|
|
|
Jun 17 2008, 04:47 PM
Post
#8
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Ok! run ComboFix and post the log!
-------------------- |
|
|
|
|
Jun 17 2008, 04:51 PM
Post
#9
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
I edited my above post will do
|
|
|
|
|
Jun 17 2008, 04:57 PM
Post
#10
|
|
|
Member Group: Members Posts: 33 Joined: 28-October 07 Member No.: 165,974 |
ComboFix 08-06-16.5 - Phil 2008-06-17 16:52:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510 [GMT -5:00] Running from: C:\Documents and Settings\Phil\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))) . 2008-06-16 21:29 . 2008-06-16 21:29 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-16 21:29 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-16 21:29 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-16 20:27 . 2007-12-28 14:32 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-06-16 20:03 . 2008-06-16 20:03 <DIR> d-------- C:\Program Files\Zamaan's Software 2008-06-16 20:03 . 1998-06-24 13:00 244,024 --a------ C:\WINDOWS\system32\MSFLXGRD.OCX 2008-06-16 16:37 . 2008-06-16 16:39 542,026 --a------ C:\WINDOWS\system32\DTOSTNEYFHIZ 2008-06-16 16:21 . 2008-06-16 19:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes 2008-06-16 12:46 . 2008-06-16 12:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-16 11:49 . 2008-06-16 11:51 2,260 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-13 09:39 . 2008-06-13 09:41 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-12 11:06 . 2008-06-12 11:08 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-06-12 00:13 . 2008-06-16 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity 2008-06-12 00:06 . 2008-06-16 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-06-11 08:45 . 2008-06-17 14:23 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-11 08:45 . 2008-06-11 08:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-11 08:45 . 2008-06-11 08:45 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-11 08:45 . 2008-06-11 08:45 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-10 18:55 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-10 18:54 . 2008-06-10 18:54 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-10 18:42 . 2008-06-10 18:42 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-06-10 18:32 . 2008-06-10 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-06-10 18:31 . 2008-06-10 18:31 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-06-10 18:04 . 2008-04-14 07:30 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 18:04 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-10 17:58 . 2008-06-10 17:58 <DIR> d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2 2008-06-10 17:58 . 2008-06-16 14:07 <DIR> d-------- C:\Documents and Settings\Phil\SecurityScans 2008-06-08 07:04 . 2008-06-08 07:04 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-06-07 18:01 . 2008-06-07 18:01 <DIR> dr-h----- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-06-07 17:31 . 2008-06-12 00:00 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\WholeSecurity 2008-06-07 17:31 . 2008-06-07 17:31 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\eBay 2008-06-07 17:31 . 2008-06-07 17:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\eBay 2008-06-07 17:29 . 2008-06-07 17:29 <DIR> d-------- C:\Program Files\eBay 2008-05-17 00:29 . 2008-05-17 00:29 <DIR> d-------- C:\Program Files\AVG 2008-05-17 00:29 . 2008-05-17 00:50 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\AVGTOOLBAR 2008-05-17 00:29 . 2008-06-11 08:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-05-17 00:22 . 2008-05-17 00:22 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-05-17 00:21 . 2008-05-17 00:21 <DIR> d-------- C:\WINDOWS\system32\en 2008-05-17 00:21 . 2008-05-17 00:22 <DIR> d-------- C:\WINDOWS\l2schemas 2008-05-17 00:07 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-17 03:34 74,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-17 03:34 6,696,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-17 03:31 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-06-17 03:31 --------- d-----w C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com 2008-06-17 00:53 3,342,848 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp 2008-06-17 00:43 --------- d-----w C:\Program Files\Lavasoft 2008-06-16 23:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-16 16:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-16 15:50 2,662,400 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp 2008-06-16 01:37 3,271,680 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp 2008-06-13 14:39 --------- d-----w C:\Program Files\SpywareBlaster 2008-06-12 05:07 --------- d-----w C:\Program Files\Yahoo! 2008-06-11 15:17 3,235,328 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp 2008-06-11 00:19 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-11 00:18 3,216,896 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp 2008-06-10 23:55 --------- d-----w C:\Program Files\Java 2008-06-10 23:42 --------- d-----w C:\Program Files\Common Files\Real 2008-06-10 23:41 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-06-10 23:41 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-06-10 23:32 --------- d-----w C:\Documents and Settings\Phil\Application Data\ATI 2008-06-10 23:29 --------- d-----w C:\Program Files\ATI Technologies 2008-06-10 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-10 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-09 01:48 5,865,212 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-06-08 01:58 --------- d-----w C:\Program Files\Common Files\Scanner 2008-05-17 04:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-05-12 15:56 397,312 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-05-12 15:54 305,152 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-05-12 15:53 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-05-12 15:49 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-05-12 15:45 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-05-12 15:45 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-05-12 15:45 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-05-12 15:45 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-05-12 15:44 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-05-12 15:43 540,672 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-05-12 15:43 10,153,984 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-05-12 15:41 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-05-12 15:32 3,203,168 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-05-12 15:22 1,999,616 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-05-12 15:09 47,104 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-05-12 15:05 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-05-12 15:05 327,680 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-05-12 15:03 19,968 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-05-12 15:03 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-05-12 15:02 241,664 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-05-12 14:57 548,864 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll 2008-05-02 05:08 104,781 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_05_02_00_03_36_small.dmp.zip 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 10:42 985,088 ------w C:\WINDOWS\system32\setupapi.dll 2008-04-14 10:42 11,264 ------w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 10:41 423,936 ------w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ------w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ------w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 12,168 ------w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 00:10 53,279 ------w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ------w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ------w C:\WINDOWS\system32\msafd.dll 2008-04-13 19:30 1,845,632 ------w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:27 2,188,928 ------w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 18:44 17,664 ------w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-13 18:43 12,800 ------w C:\WINDOWS\system32\spiisupd.exe 2008-04-13 18:31 7,424 ------w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:31 2,065,792 ------w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 18:30 61,440 ------w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:39 438,784 ------w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 17:39 2,897,920 ------w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 17:39 187,392 ------w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-13 17:21 733,696 ------w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 17:09 4,096 ------w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 16:48 1,647,616 ------w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ------w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 16:22 48,128 ------w C:\WINDOWS\system32\inetres.dll 2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2008-04-03 02:07 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-04-03 02:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-03-01 02:03 24,096 ----a-w C:\Documents and Settings\Phil\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] 2008-06-02 15:56 160496 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-05-28 09:40 1197296] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-03-13 14:30 652528] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2008-01-10 11:41 223984] "WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-04-25 12:31 333120] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-11 08:45 1177368] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-10 18:41 185896] "YMailAdvisor"="C:\Program Files\Yahoo!\Common\YMailAdvisor.exe" [2008-02-26 11:26 132376] "BHR"="C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe" [2006-10-24 22:14 9375744] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.MPG4"= MPG4C32DF.dll "vidc.MP42"= MPG4C32DF.dll "vidc.MP43"= MPG4C32DF.dll "vidc.divx"= KM4.dll "vidc.imm4"= vcmimm4.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk] backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SECRETMAKER.lnk] backup=C:\WINDOWS\pss\SECRETMAKER.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner] --a------ 2008-05-28 09:40 1197296 C:\Program Files\CCleaner\ccleaner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] --------- 2001-08-06 13:03 155648 C:\WINDOWS\System32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\server.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\admin.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.0.2hs\\service\\JavaSrvc.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 "2100:TCP"= 2100:TCP:*:Disabled:IPRegister "80:TCP"= 80:TCP:*:Disabled:Web R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-11 08:45] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-11 08:45] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-11 08:45] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-11 08:45] R3 TARWDM;Video Blaster DigitalVCR;C:\WINDOWS\system32\DRIVERS\ct5882.sys [2001-11-13 19:36] S3 ANJOCLHEON;ANJOCLHEON;C:\DOCUME~1\Phil\LOCALS~1\Temp\ANJOCLHEON.exe [] S3 JQQYC;JQQYC;C:\DOCUME~1\Phil\LOCALS~1\Temp\JQQYC.exe [] S3 PCPFJMTTZF;PCPFJMTTZF;C:\DOCUME~1\Phil\LOCALS~1\Temp\PCPFJMTTZF.exe [] S4 SMSv3_0_2hs;SMSv3_0_2hs;C:\Program Files\Rosetta Stone\SMS v3.0.2hs\Service\JavaSrvc.exe [2006-04-21 11:20] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-17 16:54:32 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-17 16:56:27 ComboFix-quarantined-files.txt 2008-06-17 21:55:48 Pre-Run: 10,120,581,120 bytes free Post-Run: 10,129,862,656 bytes free 239 --- E O F --- 2008-06-13 15:01:37 |
|
|
|
|
Jun 20 2008, 04:46 AM
Post
#11
|
|
|
Malware hunter Group: HJT Team Posts: 1,421 Joined: 7-February 06 From: Greece loutraki 6 km from korinth canal Member No.: 54,061 |
Sorry for delay Fhil I didn’t have internet connection, OTE grrrrrrrr! Run ComboFix again and post the log. And a new HijackThis log 
|