 Desktop Infected With Malware!, Haven't got any help from Xoftspy, Lavasoft, Trojan remover etc... |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jul 5 2008, 05:18 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 9 Joined: 5-July 08 Member No.: 220,653  |
This is my first post and any help/solution to my problem would be appreciated. A few days back, my desktop computer got infected with some malware. I was recieveing tons of popups in minutes and it extremely slowed my computer. There were various messages, warnings, popups asking me to install "System Defender" or "Antivirus 2008" and as far as I remember, this malware, did install Antivirus 2008 on my system since there was a Shortcut on my Desktop which I deleted. Thinking that creating a new Windows user might help me, I went ahead and created a new Computer Administrative user. It did help me for 2-3 days but today I am seeing the messages asking me to install "System Defender" or "Antivirus 2008". I have tried using Xoftspy, Lavasoft, Trojan remover etc with no help. Then after extensively exhausting myself, being a non-techy person its hard for me, I found the following topic on this site, Laptop Full Of Malware - http://www.bleepingcomputer.com/forums/ind...howtopic=152234 which is a pretty similar bleepuation to mine. So going according to the "Preparation guide For use...." topic, i am pasting my DSS main and extra text files. I didn't do Kaspersky internet scan, no reason. Main.txt CODE Deckard's System Scanner v20071014.68 Run by Amandeep Singh on 2008-07-06 03:20:01 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 70: 2008-07-05 21:50:05 UTC - RP362 - Deckard's System Scanner Restore Point 69: 2008-07-05 13:48:25 UTC - RP361 - System Checkpoint 68: 2008-07-04 10:45:06 UTC - RP360 - Installed Ad-Aware 67: 2008-07-04 09:47:16 UTC - RP359 - Removed Kaspersky Internet Security 8.0 Beta. 66: 2008-07-04 08:58:23 UTC - RP358 - Installed Kaspersky Internet Security 8.0 Beta. -- First Restore Point -- 1: 2008-07-02 12:32:11 UTC - RP293 - Installed Picture Resizer Backed up registry hives. Performed disk cleanup. [color=red]System Drive C: has 2.36 GiB (less than 15%) free.[/color] -- HijackThis (run as Amandeep Singh.exe) -------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:21:53 AM, on 7/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Amandeep Singh\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Amandeep Singh.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://s2.cookingluck.com/?pid=6082&v=77 F2 - REG:system.ini: UserInit=userinit.exe, O1 - Hosts: 203.27.235.25 www.payseal.icicibank.com O1 - Hosts: 210.210.19.82 www.sifymall.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: 734914 helper - {0BD071A6-C989-49E8-9B8E-80F92A868E26} - C:\WINDOWS\system32\734914\734914.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: 931928 helper - {5F6D7A37-A3D1-47F1-920D-3F48370D509B} - C:\WINDOWS\system32\931928\931928.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: cj helper - {B552B8A4-76AC-4e8c-A469-C1585B111116} - C:\Program Files\IE Extensions\cj.v5.dll (file missing) O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O3 - Toolbar: nqgpedlr - {5617800C-D585-4F9D-A18D-176A8C3C7147} - C:\WINDOWS\nqgpedlr.dll (file missing) O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [XoftSpySE] C:\Program Files\XoftSpySE\xoftspy.exe -s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://ra.intuit.com/sdccommon/download/tgctlcm.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O21 - SSODL: RunOnceSys - {a4bd507d-d7dd-4d66-b3a1-8aa458737d6b} - C:\WINDOWS\Resources\RunOnceSys.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- End of file - 4339 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 ScreenNT - c:\windows\system32\drivers\screennt.sys <Not Verified;; Anti-Virus> R2 EMLSS - c:\windows\system32\drivers\emltdi.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R2 OnlineNT - c:\program files\quick heal\onlinent.sys <Not Verified;; Online Protection> R3 ZSMC211 (USB PC Camera) - c:\windows\system32\drivers\zs211.sys <Not Verified; ZSMC Corporation; > -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S4 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S4 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing) S4 NT Online Protection - c:\progra~1\quickh~1\onlnsvc.exe S4 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - S4 ScanWscS (Quick Heal Helper Service WSC) - c:\progra~1\quickh~1\scanwscs.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-07-06 03:03:56 466 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2008-07-06 01:14:28 380 --a------ C:\WINDOWS\Tasks\XoftSpySE.job 2008-06-08 17:30:28 472 --a------ C:\WINDOWS\Tasks\Batch File For Killing uTorrent.job -- Files created between 2008-06-06 and 2008-07-06 ----------------------------- 2008-07-06 03:21:45 0 d-------- C:\Program Files\Trend Micro 2008-07-06 00:38:20 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\vlc 2008-07-05 16:55:40 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\DivX 2008-07-05 16:55:39 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Media Player Classic 2008-07-05 16:55:01 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\WinRAR 2008-07-05 05:28:22 0 d-------- C:\WINDOWS\system32\931928 2008-07-04 16:15:09 0 d-------- C:\Program Files\Lavasoft 2008-07-04 16:15:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-04 16:14:36 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-04 15:31:50 162304 --a------ C:\WINDOWS\system32\ztvunrar36.dll 2008-07-04 15:31:50 77312 --a------ C:\WINDOWS\system32\ztvunace26.dll 2008-07-04 15:31:50 69632 --a------ C:\WINDOWS\system32\ztvcabinet.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2008-07-04 15:31:50 153088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2008-07-04 15:31:50 75264 --a------ C:\WINDOWS\system32\unacev2.dll 2008-07-04 15:31:36 0 d-------- C:\Program Files\Trojan Remover 2008-07-04 15:31:36 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Simply Super Software 2008-07-04 15:31:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software 2008-07-04 14:56:50 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Identities 2008-07-04 14:28:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-04 06:45:38 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Adobe 2008-07-04 06:20:02 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Macromedia 2008-07-04 06:18:59 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\Mozilla 2008-07-04 06:18:42 0 d-------- C:\Documents and Settings\Amandeep Singh\Application Data\uTorrent 2008-07-04 05:55:40 5822 --a------ C:\WINDOWS\system32\egvrijnh.dll 2008-07-03 16:51:34 0 d--h----- C:\Documents and Settings\Amandeep Singh\NetHood 2008-07-03 16:51:34 0 dr------- C:\Documents and Settings\Amandeep Singh\Favorites 2008-07-03 16:51:34 0 d-------- C:\Documents and Settings\Amandeep Singh\Desktop 2008-07-03 16:51:34 0 d---s---- C:\Documents and Settings\Amandeep Singh\Cookies 2008-07-03 16:51:34 0 dr-h----- C:\Documents and Settings\Amandeep Singh\Application Data 2008-07-03 16:51:33 0 d--h----- C:\Documents and Settings\Amandeep Singh\Templates 2008-07-03 16:51:33 0 dr------- C:\Documents and Settings\Amandeep Singh\Start Menu 2008-07-03 16:51:33 0 dr-h----- C:\Documents and Settings\Amandeep Singh\SendTo 2008-07-03 16:51:33 0 dr-h----- C:\Documents and Settings\Amandeep Singh\Recent 2008-07-03 16:51:33 0 d--h----- C:\Documents and Settings\Amandeep Singh\PrintHood 2008-07-03 16:51:33 0 dr------- C:\Documents and Settings\Amandeep Singh\My Documents 2008-07-03 16:51:32 1310720 --ah----- C:\Documents and Settings\Amandeep Singh\NTUSER.DAT 2008-07-03 16:51:32 0 d--h----- C:\Documents and Settings\Amandeep Singh\Local Settings 2008-07-03 16:33:16 0 d--hs---- C:\FOUND.006 2008-07-03 15:52:12 12416 --a------ C:\WINDOWS\system32\drivers\SCREENNT.SYS <Not Verified;; Anti-Virus> 2008-07-03 15:52:12 30208 --a------ C:\WINDOWS\system32\drivers\ONLINENT.SYS <Not Verified;; Online Protection> 2008-07-03 15:52:09 6659 --a------ C:\WINDOWS\system32\drivers\EMLTDI.SYS <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> 2008-07-03 13:06:53 0 d-------- C:\WINDOWS\privacy_danger 2008-07-03 13:06:00 0 d-------- C:\Documents and Settings\AMAN\Application Data\TmpRecentIcons 2008-07-03 05:47:48 5822 --a------ C:\WINDOWS\system32\emqvwcqi.dll 2008-07-03 05:47:32 0 d-------- C:\WINDOWS\system32\734914 2008-07-02 17:56:02 94208 --a------ C:\WINDOWS\emrf.exe 2008-07-02 15:08:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Trymedia 2008-07-02 15:00:56 0 d-------- C:\Program Files\Sierra 2008-06-29 00:02:41 0 d-------- C:\WINDOWS\system32\Adobe 2008-06-12 09:09:17 0 dr-h----- C:\Documents and Settings\AMAN\Recent 2008-06-10 06:14:53 0 d--hs---- C:\WINDOWS\CSC 2008-06-09 02:07:28 0 d--hs---- C:\FOUND.005 2008-06-06 07:03:49 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Templates 2008-06-06 07:03:49 0 dr------- C:\Documents and Settings\LogMeInRemoteUser\Start Menu 2008-06-06 07:03:49 0 dr-h----- C:\Documents and Settings\LogMeInRemoteUser\SendTo 2008-06-06 07:03:49 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Recent 2008-06-06 07:03:49 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\PrintHood 2008-06-06 07:03:49 229376 --ah----- C:\Documents and Settings\LogMeInRemoteUser\NTUSER.DAT 2008-06-06 07:03:49 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\NetHood 2008-06-06 07:03:49 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\My Documents 2008-06-06 07:03:49 0 d--h----- C:\Documents and Settings\LogMeInRemoteUser\Local Settings 2008-06-06 07:03:49 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Favorites 2008-06-06 07:03:49 0 d-------- C:\Documents and Settings\LogMeInRemoteUser\Desktop 2008-06-06 07:03:49 0 d---s---- C:\Documents and Settings\LogMeInRemoteUser\Cookies 2008-06-06 07:03:49 0 dr-h----- C:\Documents and Settings\LogMeInRemoteUser\Application Data 2008-06-06 07:03:49 0 d---s---- C:\Documents and Settings\LogMeInRemoteUser\Application Data\Microsoft 2008-06-06 06:50:04 0 d-------- C:\Documents and Settings\All Users\Application Data\LogMeIn 2008-06-06 06:49:46 0 d-------- C:\Program Files\LogMeIn -- Find3M Report --------------------------------------------------------------- 2008-07-04 06:19:54 0 --a------ C:\AUTOEXEC.BAT 2008-06-06 06:53:20 1792 --a------ C:\WINDOWS\mozver.dat 2008-05-29 18:00:00 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2008-05-29 17:56:52 0 d-------- C:\Program Files\Eidos 2008-05-09 06:07:38 0 d-------- C:\Program Files\Common Files\xing shared 2008-05-09 06:07:22 0 d-------- C:\Program Files\Real 2008-05-09 06:07:22 0 d-------- C:\Program Files\Common Files\Real -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BD071A6-C989-49E8-9B8E-80F92A868E26}] 07/03/2008 05:47 AM 14848 --a------ C:\WINDOWS\system32\734914\734914.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F6D7A37-A3D1-47F1-920D-3F48370D509B}] 07/05/2008 05:28 AM 15360 --a------ C:\WINDOWS\system32\931928\931928.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B552B8A4-76AC-4e8c-A469-C1585B111116}] C:\Program Files\IE Extensions\cj.v5.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [03/01/2008 02:24 AM] "XoftSpySE"="C:\Program Files\XoftSpySE\xoftspy.exe" [07/06/2008 01:18 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:56 AM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "RunOnceSys"= {a4bd507d-d7dd-4d66-b3a1-8aa458737d6b} - C:\WINDOWS\Resources\RunOnceSys.dll [07/03/2008 05:47 AM 12838] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] LMIinit.dll 05/28/2008 12:32 PM 87352 C:\WINDOWS\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\681f9ed8] rundll32.exe "C:\WINDOWS\system32\dyienlxi.dll",b [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus] C:\Program Files\antiviirus.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 8.0\avp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DBISQL9] "C:\Program Files\Sybase\SQL Anywhere 9\win32\dbisqlg.exe" -preload [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Domino] C:\WINDOWS\Domino.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Email Protection] C:\PROGRA~1\QUICKH~1\EmlProxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] ? ????? ??Ÿ [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger] C:\PROGRA~1\QUICKH~1\SCANMSG.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin] C:\Program Files\ESET\ESET NOD32 Antivirus\nodlogin.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\On-Line Protection] C:\PROGRA~1\QUICKH~1\CATEYE.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] ? ????? ??Ÿ [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] SkyTel.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Scan] C:\PROGRA~1\QUICKH~1\Sensor.EXE /LOADRUN [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SybaseCentral43] "C:\Program Files\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe" -preload [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Update Scheduler] C:\PROGRA~1\QUICKH~1\UPSCHD.EXE /CHECK [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Virtual PDF Printer] C:\Program Files\Virtual PDF Printer\VirtualPDFPrinter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Viewpoint Manager Service"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ScanWscS"=2 (0x2) "rpcapd"=3 (0x3) "NT Online Protection"=2 (0x2) "MDM"=2 (0x2) "iPod Service"=3 (0x3) "CLTNetCnService"=2 (0x2) "Apple Mobile Device"=2 (0x2) "WZCSVC"=2 (0x2) "WebClient"=2 (0x2) "VSS"=2 (0x2) "UPS"=2 (0x2) "TrkWks"=2 (0x2) "SwPrv"=3 (0x3) "stisvc"=2 (0x2) "SSDPSRV"=3 (0x3) "SQLAgent$SONY_MEDIAMGR"=3 (0x3) "seclogon"=2 (0x2) "SCardSvr"=3 (0x3) "RemoteRegistry"=2 (0x2) "RDSessMgr"=3 (0x3) "RasMan"=3 (0x3) "RasAuto"=3 (0x3) "NtLmSsp"=3 (0x3) "Netlogon"=3 (0x3) "MSSQLServerADHelper"=2 (0x2) "MSSQL$SONY_MEDIAMGR"=2 (0x2) "MSDTC"=3 (0x3) "mnmsrvc"=3 (0x3) "LmHosts"=2 (0x2) "lanmanworkstation"=2 (0x2) "lanmanserver"=2 (0x2) "FastUserSwitchingCompatibility"=3 (0x3) "EventSystem"=3 (0x3) "dmserver"=2 (0x2) "dmadmin"=3 (0x3) "CryptSvc"=2 (0x2) "COMSysApp"=3 (0x3) "clr_optimization_v2.0.50727_32"=3 (0x3) "Browser"=2 (0x2) "BITS"=2 (0x2) "aspnet_state"=2 (0x2) "AppMgmt"=3 (0x3) -- Hosts ----------------------------------------------------------------------- 203.27.235.25 www.payseal.icicibank.com 210.210.19.82 www.sifymall.com -- End of Deckard's System Scanner: finished at 2008-07-06 03:22:17 ------------ Extra.txt CODE Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz CPU 1: Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz Percentage of Memory in Use: 32% Physical Memory (total/avail): 1015.29 MiB / 686.04 MiB Pagefile Memory (total/avail): 2442.95 MiB / 2218.7 MiB Virtual Memory (total/avail): 2047.88 MiB / 1933.16 MiB A: is Removable (Unformatted) C: is Fixed (FAT32) - 29.28 GiB total, 2.36 GiB free. D: is Fixed (NTFS) - 119.75 GiB total, 22.27 GiB free. E: is CDROM (CDFS) \\.\PHYSICALDRIVE0 - WDC WD1600AAJS-22PSA0 - 149.05 GiB - 2 partitions \PARTITION0 (bootable) - Unknown - 29.29 GiB - C: \PARTITION1 - Extended w/Extended Int 13 - 119.75 GiB - D: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. UpdatesDisableNotify is set. AntivirusOverride is set. AV: ESET NOD32 Antivirus 3.0 v3.0 (ESET, spol. s r. o.) [COLOR=RED]Outdated[/COLOR] [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Free Download Manager\\fdmwi.exe"="C:\\Program Files\\Free Download Manager\\fdmwi.exe:*:Enabled:fdmwi" "C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe"="C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe:*:Enabled:Anti-Leech plugin helper program" "C:\\Program Files\\Anti-Leech\\ALIE_1.0.2.3\\alhlp.exe"="C:\\Program Files\\Anti-Leech\\ALIE_1.0.2.3\\alhlp.exe:*:Enabled:Anti-Leech plugin helper program" "C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\Personal Firewall\\ioloFW.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\Personal Firewall\\ioloFW.exe:*:Enabled:iolo Firewall®" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\ioloAV.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\ioloAV.exe:*:Enabled:iolo AntiVirus®" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\iAVEmailScanner.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\iAVEmailScanner.exe:*:Enabled:iolo AntiVirus® Email Protection" "C:\\Program Files\\Sybase\\SQL Anywhere 9\\WIN32\\DBISQLG.EXE"="C:\\Program Files\\Sybase\\SQL Anywhere 9\\WIN32\\DBISQLG.EXE:*:Enabled:Adaptive Server Anywhere ISQL" "C:\\Program Files\\Sybase\\Shared\\Sybase Central 4.3\\WIN32\\SCJVIEW.EXE"="C:\\Program Files\\Sybase\\Shared\\Sybase Central 4.3\\WIN32\\SCJVIEW.EXE:*:Enabled:Sybase Central" "D:\\GAMES\\Quake III Arena\\quake3.exe"="D:\\GAMES\\Quake III Arena\\quake3.exe:*:Enabled:quake3" "C:\\Program Files\\VideoLAN\\VLC\\VLC.EXE"="C:\\Program Files\\VideoLAN\\VLC\\VLC.EXE:*:Enabled:VLC media player" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\cryptload v0.8 clean\\RouterClient.exe"="C:\\cryptload v0.8 clean\\RouterClient.exe:*:Enabled:RouterClient" "C:\\Program Files\\Sybase\\SQL Anywhere 9\\WIN32\\dbeng9.exe"="C:\\Program Files\\Sybase\\SQL Anywhere 9\\WIN32\\dbeng9.exe:*:Enabled:Adaptive Server Anywhere Database Engine" "C:\\Program Files\\Sybase\\SQL Anywhere 8\\win32\\dbeng8.exe"="C:\\Program Files\\Sybase\\SQL Anywhere 8\\win32\\dbeng8.exe:*:Enabled:Adaptive Server Anywhere Database Engine" "C:\\Program Files\\Microsoft Games\\Halo Trial\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo Trial\\halo.exe:*:Enabled:Halo" "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"="C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE:*:Enabled:Firefox" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Amandeep Singh\Application Data ASANY8=C:\Program Files\Sybase\SQL Anywhere 8 ASANY9=C:\Program Files\Sybase\SQL Anywhere 9 ASANYSH8=C:\Program Files\Sybase\Shared ASANYSH9=C:\Program Files\Sybase\Shared CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=AMANDEEP_SINGH ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Amandeep Singh LOGONSERVER=\\AMANDEEP_SINGH NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Sybase\SQL Anywhere 8\win32;C:\Program Files\Sybase\SQL Anywhere 8\drivers;C:\Program Files\Sybase\Shared\Sybase Central 4.1;C:\Program Files\Sybase\SQL Anywhere 9\win32;C:\Program Files\Sybase\Shared\win32;C:\Program Files\Sybase\SQL Anywhere 9\drivers;C:\Program Files\Sybase\Shared\Sybase Central 4.3\win32 PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 2, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f02 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\AMANDE~1\LOCALS~1\Temp TMP=C:\DOCUME~1\AMANDE~1\LOCALS~1\Temp USERDOMAIN=AMANDEEP_SINGH USERNAME=Amandeep Singh USERPROFILE=C:\Documents and Settings\Amandeep Singh windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- AMAN [I](admin)[/I] LogMeInRemoteUser [I](admin)[/I] Amandeep Singh [I](admin)[/I] Administrator [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7} Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Photoshop 7.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll" Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Adobe Reader 8.1.2 Security Update 1 (KB403742) --> Adobe Shockwave Player --> C:\WINDOWS\system32\ADOBE\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\ADOBE\SHOCKW~1\INSTALL.LOG Advanced ZIP Password Recovery --> C:\PROGRA~1\AZPR\UNWISE.EXE C:\PROGRA~1\AZPR\INSTALL.LOG AIM 6 --> C:\Program Files\AIM6\uninst.exe AnalogX Vocal Remover (WinAmp) --> C:\Program Files\Winamp\Plugins\wavremu.exe Apple Mobile Device Support --> MsiExec.exe /I{3EBD3749-304E-4A4C-9575-C00E5F015217} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe" BitComet 0.93 --> C:\Program Files\BitComet\uninst.exe CutePDF Writer 2.7 --> C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe /uninstall Data Fax SoftModem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\HXFSETUP.EXE -U -ITrx200Ck.inf DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC ESET NOD32 Antivirus --> MsiExec.exe /I{7D974ACA-4EE5-412C-8E6A-A5B57B305727} Free Download Manager 2.5 --> "C:\Program Files\Free Download Manager\unins000.exe" FreeRIP v3.01 --> "C:\Program Files\FreeRIP3\unins000.exe" Google Talk (remove only) --> "C:\Program Files\Google\Google Talk\uninstall.exe" High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" Hitman: Contracts --> C:\PROGRA~1\EIDOS\HITMAN~1\uninstall.exe Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" ImTOO 3GP Video Converter --> C:\Program Files\ImTOO\3GP Video Converter 3\Uninstall.exe Intel(R) Graphics Media Accelerator Driver --> C:\WINDOWS\system32\igxpun.exe -uninstall iTunes --> MsiExec.exe /I{B8A204BC-7177-470E-BBDD-47256D05B325} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} K-Lite Codec Pack 3.5.0 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe" LimeWire 4.14.8 --> "C:\Program Files\LimeWire\uninstall.exe" LogMeIn --> MsiExec.exe /I{ED0042CA-CBEA-4ADF-B262-FE0518AF2221} Merlin --> C:\WINDOWS\IsUninst.exe -fc:\DRstuff\Uninst.isu Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9} Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} MJ Studio - be your own DJ --> C:\PROGRA~1\d-lusion\MJ\UNWISE.EXE C:\PROGRA~1\d-lusion\MJ\INSTALL.LOG Mozilla Firefox (2.0.0.15) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} Nero Suite --> C:\Program Files\Common Files\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID="" Net Transport 1.87.258 --> "C:\Program Files\Xi\NetTransport 2\unins000.exe" Picture Resizer --> MsiExec.exe /I{E2D421B2-54A5-4957-9815-457CCBF770FD} PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall Quick Heal --> C:\PROGRA~1\QUICKH~1\Uninst.exe QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Sify Broadband 3.22 --> "C:\Program Files\Sify Broadband\unins000.exe" Sony ACID Pro 6.0 --> MsiExec.exe /X{2956585F-DB2F-45C2-9363-F8CB0BB4F2A7} Sony Media Manager 2.2 --> MsiExec.exe /X{2B5A75F0-FD85-4094-AB00-94902398D192} SQL Anywhere 8 Documentation --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B095252-5EFC-4C63-B982-0519FEAB2F40}\setup.exe" -l0x9 UNINSTALLING SQL Anywhere Studio 8 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{05B613D1-7BD6-4DFA-B54F-1758CD7D71ED}\setup.exe" -l0x9 UNINSTALLING SQL Anywhere Studio 9 for Windows CE --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D8BD9719-E038-47D2-9CB3-6F4C5C310DE4}\setup.exe" -l0x9 -uninst SQL Anywhere Studio 9, Documentation --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D2B0FD55-03C2-4B7F-A67F-C042C260371F}\setup.exe" -l0x9 UNINSTALLING SQL Anywhere Studio 9, Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F653AB56-DB37-415B-8DDD-EF5BC1982150}\is_setup.exe" -l0x09 UNINSTALLING SWAT 4 --> C:\PROGRA~1\SIERRA\SWAT4~1\UNWISE.EXE C:\PROGRA~1\SIERRA\SWAT4~1\INSTALL.LOG Sybase InfoMaker 8.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{953BF5B8-7855-11D4-B53F-00C04F79501F}\Setup.exe" -uninst Sybase PowerDesigner 8.0.1 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Sybase\PowerDesigner 8\PD80inst.isu" Trojan Remover 6.7.0 --> "C:\Program Files\Trojan Remover\unins000.exe" URL Snooper v2.20.02 --> "C:\Program Files\URLSnooper2\unins000.exe" USB PC Camera --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{44D02D8B-FFB3-4245-8D26-68D10B4C4023}\Setup.exe" -l0x9 VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe Videora iPod Converter 3.07 --> C:\Program Files\Red Kawa\Video Converter 3\uninstaller.exe Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe WinZip --> "C:\Program Files\WinZip\WINZIP32.EXE" /uninstall XoftSpySE --> C:\Program Files\XoftSpySE\uninstall.exe Yahoo! Messenger --> C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG Zip Password Tool v. 1.5 --> "C:\Program Files\FDRLab\Zip Password Tool\unins000.exe" -- Application Event Log ------------------------------------------------------- Event Record #/Type5037 / Error Event Submitted/Written: 07/06/2008 03:03:52 AM Event ID/Source: 8193 / VSS Event Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206. Event Record #/Type5036 / Error Event Submitted/Written: 07/06/2008 03:03:52 AM Event ID/Source: 4609 / EventSystem Event Description: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error. Event Record #/Type5033 / Error Event Submitted/Written: 07/06/2008 03:01:25 AM Event ID/Source: 8193 / VSS Event Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206. Event Record #/Type5032 / Error Event Submitted/Written: 07/06/2008 03:01:25 AM Event ID/Source: 4609 / EventSystem Event Description: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070422 from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error. Event Record #/Type5029 / Error Event Submitted/Written: 07/06/2008 02:42:22 AM Event ID/Source: 1000 / Application Error Event Description: Faulting application iexplore.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Processing media-specific event for [iexplore.exe!ws!] -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type23083 / Error Event Submitted/Written: 07/06/2008 03:04:13 AM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Event Record #/Type23082 / Error Event Submitted/Written: 07/06/2008 03:04:09 AM Event ID/Source: 23 / Print Event Description: Printer Virtual PDF Printer failed to initialize because a suitable Virtual PDF Printer driver could not be found. Event Record #/Type23077 / Error Event Submitted/Written: 07/06/2008 03:03:52 AM Event ID/Source: 7001 / Service Control Manager Event Description: The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: %%1058 Event Record #/Type23076 / Error Event Submitted/Written: 07/06/2008 03:03:52 AM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Event Record #/Type23072 / Error Event Submitted/Written: 07/06/2008 03:03:02 AM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} -- End of Deckard's System Scanner: finished at 2008-07-06 03:22:17 ------------ Respect, Thanks in advance, Amandeep aka DjayAdx This post has been edited by DjayAdx: Jul 5 2008, 05:30 PM
Attached File(s)
DSS_Log___extra.txt ( 18.93k )
Number of downloads: 3
DSS_Log___main.txt ( 20.84k )
Number of downloads: 4 |
 |
 
|
|
Jul 6 2008, 02:34 PM
Post
#2
|
|
|
New Member Group: Members Posts: 9 Joined: 5-July 08 Member No.: 220,653 |
okayyy....so since I was unable to keep myself waiting I went ahead and did some more searching and found this article http://www.bleepingcomputer.com/malware-re...-antivirus-2009
I followed it and have seemed to solve the problem since neither Malwarebytes nor Xoftspy are able to find any trojans/malwares etc. on my PC. Does that mean I am all set  or is there anything left? 
This post has been edited by DjayAdx: Jul 6 2008, 02:36 PM |
|
|
|
|
Jul 6 2008, 06:41 PM
Post
#3
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you.
 I can't tell if you are clean unless you post a new log from DSS. Usually these type of infections require some manual removal. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 12:24 AM
Post
#4
|
|
|
New Member Group: Members Posts: 9 Joined: 5-July 08 Member No.: 220,653 |
Hi Sam, thanks for welcoming me
I have attached the new DSS main log. But for some reason I didn't get an extra log this time!! Is that ok?
Attached File(s)
|
|
|
|
|
Jul 7 2008, 08:03 AM
Post
#5
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Yes, that's ok. I do see some other issues in your log that we need to take care of.
Please download the OTMoveIt2 by OldTimer.
Also post a new log from DSS. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 09:40 AM
Post
#6
|
|
|
New Member Group: Members Posts: 9 Joined: 5-July 08 Member No.: 220,653 |
Hi Sam, I am at work right now and will give it a shot as soon as I reach back home.
Take care. |
|
|
|
|
Jul 7 2008, 10:56 AM
Post
#7
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Ok, sounds good.
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 7 2008, 07:45 PM
Post
#8
|
|
|
New Member Group: Members Posts: 9 Joined: 5-July 08 Member No.: 220,653 |
ok Sam, I followed the above instructions and posting the logs hereby; OTMoveIT log: CODE LoadLibrary failed for C:\WINDOWS\system32\emqvwcqi.dll C:\WINDOWS\system32\emqvwcqi.dll NOT unregistered. C:\WINDOWS\system32\emqvwcqi.dll moved successfully. LoadLibrary failed for C:\WINDOWS\system32\egvrijnh.dll C:\WINDOWS\system32\egvrijnh.dll NOT unregistered. C:\WINDOWS\system32\egvrijnh.dll moved successfully. < HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run > Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run\\ deleted successfully. < HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load > Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load\\ deleted successfully. < HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus > Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus\\ deleted successfully. < HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr > Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr\\ deleted successfully. < HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\681f9ed8 > Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\681f9ed8\\ deleted successfully. OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07082008_060638 DSS main log: CODE Deckard's System Scanner v20071014.68 Run by Amandeep Singh on 2008-07-08 06:08:55 Computer is in Normal Mode. -------------------------------------------------------------------------------- [color=red]System Drive C: has 1.49 GiB (less than 15%) free.[/color] -- HijackThis (run as Amandeep Singh.exe) -------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:08:58 AM, on 7/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Amandeep Singh\Desktop\Help\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\AMANDE~1.EXE R0 - HKCU& |