 Malware, combofix, and hijack fails to run |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal > Misplaced HJT Logs  |
 Jul 2 2009, 03:43 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 4 Joined: 2-July 09 Member No.: 347,629  |
per the title, none of those work. symanetc refuses to update with a working internet connection and processexplorer shows nothing to my knowledge. safe mode could not be accessed through the bios (hitting f8 repeatedly). this is my built computer so it has nothing from hp or anything else. the way i accessed safe mode was using msconfig but it may not seem like the real safe mode as when entering mozilla, i get redirects using google like without google. go.google trojan or something... tried downloading and reinstalling the three programs but still failed to run. tried on my laptop and still fails. used a usb to copy a fresh install.exe but nothing, even in safe mode (that was safe mode with networking. without, none of the antiadware works.) so in other words, malwarebytes, combofix, hijack this, all failed to open after double clicking. no error messages. symantec shows no viruses, when clearly there are, and nor does adaware 7.0 the most recent update for symantec is 6/28/09 please advise  but dont be in a rush. im already considering gettin a new hard drive and repartitioning but i kinda want to fix it if i can
This post has been edited by MikeC07: Jul 2 2009, 03:46 PM |
 |
 
|
|
Jul 2 2009, 03:59 PM
Post
#2
|
|
|
New Member Group: Members Posts: 4 Joined: 2-July 09 Member No.: 347,629 |
lookin around some more, i found that you can run RSIT.
did and heres the log Logfile of random's system information tool 1.06 (written by random/random) Run by Mchang at 2009-07-02 15:56:55 Microsoft Windows XP Professional Service Pack 3 System drive C: has 30 GB (30%) free of 100 GB Total RAM: 3325 MB (84% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:57:05 PM, on 7/2/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\mmc.exe C:\Documents and Settings\Mchang\Desktop\RSIT.exe C:\Program Files\trend micro\Mchang.exe R3 - Default URLSearchHook is missing O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKUS\S-1-5-21-343818398-746137067-725345543-500\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (User 'Administrator') O9 - Extra button: (no name) - AutorunsDisabled - (no file) O17 - HKLM\System\CCS\Services\Tcpip\..\{9C075CDC-83BB-4BCF-8043-8DE1D62B2A84}: NameServer = 85.255.112.88,85.255.112.236 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe O24 - Desktop Component AutorunsDisabled: (no name) - (no file) -- End of file - 4999 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\Driver Robot.job C:\WINDOWS\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] SingleInstance Class - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-13 169984] "vptray"=C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe [2007-10-07 125368] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-05-14 17881088] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-05-01 86016] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272] "amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-06-17 414992] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2007-10-07 43448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\GAMES!\cod4\iw3mp.exe"="C:\GAMES!\cod4\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ " "C:\Program Files\Guild Wars\Gw.exe"="C:\Program Files\Guild Wars\Gw.exe:*:Enabled:Guild Wars" "C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam" "C:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe"="C:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:*:Enabled:Peggle Extreme" "C:\Program Files\Saints Row 2\SR2_pc.exe"="C:\Program Files\Saints Row 2\SR2_pc.exe:*:Enabled:SR2_pc" "C:\Program Files\Steam\steamapps\chickon_hunter\team fortress 2\hl2.exe"="C:\Program Files\Steam\steamapps\chickon_hunter\team fortress 2\hl2.exe:*:Enabled:hl2" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA" "G:\_games\Left 4 Dead\left4dead.exe"="G:\_games\Left 4 Dead\left4dead.exe:*:Enabled:left4dead" "C:\BF2\BF2.exe"="C:\BF2\BF2.exe:*:Enabled:Battlefield 2" "C:\Program Files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe"="C:\Program Files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:*:Enabled:Killing Floor" "C:\Program Files\Steam\steamapps\common\killingfloor\System\KFEd.exe"="C:\Program Files\Steam\steamapps\common\killingfloor\System\KFEd.exe:*:Enabled:Killing Floor SDK" "C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe" "D:\Games\Prototype\prototypef.exe"="D:\Games\Prototype\prototypef.exe:*:Enabled:Prototype™" "C:\Program Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe"="C:\Program Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:*:Enabled:America's Army 3" "C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead" "D:\OL2\Overlord2.exe"="D:\OL2\Overlord2.exe:*:Enabled:Overlord II" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] shell\AutoRun\command - E:\Launch.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88291625-6134-11de-a0de-00241d2528a3}] shell\AutoRun\command - G:\WDSetup.exe ======List of files/folders created in the last 1 months====== 2009-12-28 00:21:18 ----A---- C:\WINDOWS\system32\11958not-a-zirus47c.exe 2009-12-24 21:32:16 ----A---- C:\WINDOWS\system32\54088no9-a-virusz94.exe 2009-12-21 03:26:05 ----A---- C:\WINDOWS\system32\1226sp5mzot249.dll 2009-12-19 01:35:06 ----A---- C:\WINDOWS\system32\279789ackzool56.dll 2009-12-18 16:53:29 ----A---- C:\WINDOWS\system32\5ez1spywa592184.exe 2009-12-15 18:41:36 ----A---- C:\WINDOWS\system32\z5e5addwa5e1299.dll 2009-11-19 13:49:19 ----A---- C:\WINDOWS\system32\9745rzj39a.dll 2009-11-18 06:06:27 ----A---- C:\WINDOWS\system32\1e0z5ddwa9e2744.dll 2009-11-11 17:18:07 ----A---- C:\WINDOWS\system32\6z7cthreat5689.exe 2009-11-11 04:58:24 ----A---- C:\WINDOWS\system32\6f459hief54z7.dll 2009-11-10 19:41:53 ----A---- C:\WINDOWS\system32\57z9ddware969.dll 2009-10-19 02:49:24 ----A---- C:\WINDOWS\system32\5a96sparsez592.exe 2009-10-19 02:48:42 ----A---- C:\WINDOWS\system32\39368ha5ktzol547.dll 2009-10-09 15:51:46 ----A---- C:\WINDOWS\system32\142zstea921045.exe 2009-10-04 04:32:35 ----A---- C:\WINDOWS\system32\245z4s5ambot95f.dll 2009-10-02 05:11:38 ----A---- C:\WINDOWS\system32\6698sza9se975.exe 2009-09-27 04:10:44 ----A---- C:\WINDOWS\system32\7fadth9za520670.exe 2009-09-23 09:30:40 ----A---- C:\WINDOWS\system32\3a29sp9zare758.exe 2009-09-15 10:45:00 ----A---- C:\WINDOWS\system32\6d4edownlza59r92.dll 2009-09-13 09:10:32 ----A---- C:\WINDOWS\system32\94zaspy5are2400.exe 2009-08-16 07:49:19 ----A---- C:\WINDOWS\system32\12z71vir9s5fd.dll 2009-08-04 14:37:04 ----A---- C:\WINDOWS\system32\27550spzmbot390.dll 2009-07-27 21:36:00 ----A---- C:\WINDOWS\system32\75aaspzw9re1758.exe 2009-07-13 06:20:06 ----A---- C:\WINDOWS\system32\4a3dv5rz8339.exe 2009-07-11 03:17:08 ----A---- C:\WINDOWS\system32\7z6aspy5are2669.exe 2009-07-08 04:00:27 ----A---- C:\WINDOWS\system32\27846ha95tool3z5.exe 2009-07-02 15:56:55 ----D---- C:\rsit 2009-07-02 15:18:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-07-02 15:18:39 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2009-07-02 14:30:29 ----SHD---- C:\WINDOWS\CSC 2009-07-02 14:12:04 ----D---- C:\hj 2009-07-02 14:03:56 ----D---- C:\WINDOWS\pss 2009-07-02 13:38:10 ----D---- C:\Documents and Settings\All Users\Application Data\Avg7 2009-07-02 13:31:23 ----D---- C:\Program Files\Trend Micro 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 960bthzef11255.dll 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 91567szy61e.exe 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 5999vir3571z.exe 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 4a319d5wzre3015.dll 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 3abfth5zf2591.dll 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 19559spambot54fz.exe 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 1394z59y3fe.dll 2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of {789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini 2009-07-02 13:06:18 ----A---- C:\WINDOWS\Copy of RTHDCPL.EXE 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\9e0fdo5nloadez767.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\9d85zddware3210.dll 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\97024zro51c4.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\96aathiefz955.dll 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\7e1downzoader2955.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\7697zparse5225.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\6cd0ad5w9rz3242.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\59a5zt5a92265.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\552sparse6z99.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\53z0back9o5r429.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\4b7zspyw9re1051.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\32382spam9zt7075.dll 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\322z89acktool635.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\2d9zvi53973.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\2515zno9-a-virus653.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\23z3viru985.dll 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\1fbb9tzal17805.exe 2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\1517do9n5oaderz026.exe 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\z732spa9s52094.dll 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\z1da5own9oader874.exe 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\932z9i5us3e.dll 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\900zw9rm5f4.dll 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\7000sp559cz.dll 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\619zspambot591.exe 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\490zsteal185.exe 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\31132vi5usz94.dll 2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\2f1fthiez925.exe 2009-06-28 15:20:45 ----D---- C:\Program Files\DAEMON Tools Lite 2009-06-24 05:40:14 ----A---- C:\WINDOWS\system32\2990not5a-viruszf4.dll 2009-06-23 14:48:47 ----A---- C:\WINDOWS\system32\5259baczd5or609.dll 2009-06-22 13:53:00 ----A---- C:\WINDOWS\91567szy61e.exe 2009-06-20 11:25:11 ----A---- C:\WINDOWS\system32\ba59hreat7z735.dll 2009-06-14 12:27:37 ----A---- C:\WINDOWS\system32\d3dx10_40.dll 2009-06-14 12:27:37 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll 2009-06-14 12:27:36 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll 2009-06-14 12:27:36 ----A---- C:\WINDOWS\system32\D3DX9_40.dll 2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\XAudio2_3.dll 2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\xactengine3_3.dll 2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll 2009-06-14 12:27:34 ----A---- C:\WINDOWS\system32\XAudio2_2.dll 2009-06-14 12:27:34 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll 2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\xactengine3_2.dll 2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\d3dx10_39.dll 2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll 2009-06-14 12:27:32 ----A---- C:\WINDOWS\system32\D3DX9_39.dll 2009-06-12 23:05:19 ----D---- C:\Documents and Settings\Mchang\Application Data\Ventrilo 2009-06-12 23:05:07 ----D---- C:\Program Files\Ventrilo 2009-06-12 23:05:02 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini 2009-06-12 18:07:45 ----A---- C:\WINDOWS\system32\D3DX81ab.dll 2009-06-12 18:05:04 ----D---- C:\Program Files\WC3Banlist 2009-06-12 03:01:53 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$ 2009-06-12 03:01:42 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$ 2009-06-12 03:01:36 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$ 2009-06-12 03:00:37 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$ 2009-06-12 03:00:28 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$ 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nwiz.exe 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvwimg.dll 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvshell.dll 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvappbar.exe 2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\keystone.exe 2009-06-10 08:29:32 ----A---- C:\WINDOWS\system32\nview.dll 2009-06-10 08:29:30 ----A---- C:\WINDOWS\system32\nvcplui.exe 2009-06-10 08:29:20 ----A---- C:\WINDOWS\system32\nvwddi.dll 2009-06-10 08:29:12 ----A---- C:\WINDOWS\system32\nvwss.dll 2009-06-10 08:29:06 ----A---- C:\WINDOWS\system32\nvvitvs.dll 2009-06-10 08:29:02 ----A---- C:\WINDOWS\system32\nvmobls.dll 2009-06-10 08:29:00 ----A---- C:\WINDOWS\system32\nvmccss.dll 2009-06-10 08:28:58 ----A---- C:\WINDOWS\system32\nvgames.dll 2009-06-10 08:28:52 ----A---- C:\WINDOWS\system32\nvdisps.dll 2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvsvc32.exe 2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvmctray.dll 2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvcpl.dll 2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvcolor.exe 2009-06-10 08:28:48 ----A---- C:\WINDOWS\system32\nvmccs.dll ======List of files/folders modified in the last 1 months====== 2009-07-02 15:30:56 ----D---- C:\Program Files\Mozilla Firefox 2009-07-02 15:26:52 ----D---- C:\WINDOWS\system32 2009-07-02 15:18:40 ----D---- C:\WINDOWS\system32\drivers 2009-07-02 15:18:39 ----RD---- C:\Program Files 2009-07-02 14:53:27 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-02 14:52:16 ----RSH---- C:\boot.ini 2009-07-02 14:52:16 ----A---- C:\WINDOWS\win.ini 2009-07-02 14:52:16 ----A---- C:\WINDOWS\system.ini 2009-07-02 14:32:13 ----SHD---- C:\RECYCLER 2009-07-02 14:31:38 ----D---- C:\Documents and Settings 2009-07-02 14:30:29 ----D---- C:\WINDOWS 2009-07-02 14:15:00 ----D---- C:\WINDOWS\Prefetch 2009-07-02 14:14:59 ----D---- C:\WINDOWS\Temp 2009-07-02 14:03:31 ----D---- C:\Program Files\Common Files\Symantec Shared 2009-07-02 13:38:09 ----D---- C:\WINDOWS\system 2009-07-02 13:37:46 ----SD---- C:\Documents and Settings\Mchang\Application Data\Microsoft 2009-07-02 13:37:21 ----D---- C:\Documents and Settings\Mchang\Application Data\Move Networks 2009-07-02 13:34:21 ----D---- C:\WINDOWS\Minidump 2009-07-02 13:34:21 ----D---- C:\WINDOWS\Debug 2009-07-02 13:23:58 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-02 13:19:32 ----SHD---- C:\System Volume Information 2009-07-02 13:19:32 ----D---- C:\WINDOWS\system32\Restore 2009-07-02 00:14:03 ----D---- C:\Program Files\Warcraft III 2009-06-29 14:20:37 ----HD---- C:\Program Files\InstallShield Installation Information 2009-06-29 14:04:06 ----D---- C:\Documents and Settings\Mchang\Application Data\uTorrent 2009-06-28 17:36:55 ----D---- C:\Program Files\Steam 2009-06-28 15:46:05 ----SHD---- C:\WINDOWS\Installer 2009-06-28 15:46:05 ----SHD---- C:\Config.Msi 2009-06-28 15:46:00 ----D---- C:\Program Files\AMD 2009-06-28 15:37:30 ----SD---- C:\WINDOWS\Tasks 2009-06-28 14:23:29 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-06-28 14:23:29 ----D---- C:\Program Files\AGEIA Technologies 2009-06-28 01:15:13 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-06-28 01:13:56 ----HD---- C:\WINDOWS\inf 2009-06-28 01:13:19 ----D---- C:\NVIDIA 2009-06-23 20:17:44 ----A---- C:\WINDOWS\system32\PnkBstrB.exe 2009-06-23 18:11:59 ----D---- C:\WINDOWS\system32\DirectX 2009-06-23 18:11:47 ----RSD---- C:\WINDOWS\assembly 2009-06-17 23:54:47 ----D---- C:\Documents and Settings\Mchang\Application Data\DNA 2009-06-16 21:21:40 ----D---- C:\GAMES! 2009-06-13 18:57:07 ----D---- C:\Program Files\Crayon Physics Deluxe 2009-06-12 18:12:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-06-12 03:01:36 ----HD---- C:\WINDOWS\$hf_mig$ 2009-06-10 06:03:00 ----A---- C:\WINDOWS\system32\nv4_disp(2).dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592] R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:\WINDOWS\System32\DRIVERS\NVTcp.sys [2005-02-24 99840] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12160] R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-08-07 111360] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] S1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792] S1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] S1 SAVRT;SAVRT; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys [] S1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys [] S1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-08-27 189320] S3 agqhsdfp;agqhsdfp; C:\WINDOWS\system32\drivers\agqhsdfp.sys [] S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-01-24 4127488] S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736] S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] S3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys [] S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-05-15 5080064] S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056] S3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090628.006\naveng.sys [] S3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090628.006\navex15.sys [] S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584] S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-02-24 33408] S3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-02-24 12928] S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys [] S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [] S3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-08-27 12680] S3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [] S3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-08-27 97672] S3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-08-27 31624] S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20090618.001\symidsco.sys [] S3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-08-27 28040] S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-08-27 23944] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-13 73472] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2008-01-04 587096] S2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2007-05-29 192104] S2 ccProxy;Symantec Network Proxy; C:\Program Files\Common Files\Symantec Shared\ccProxy.exe [2007-05-29 202344] S2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2007-05-29 169576] S2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe [2007-10-07 31160] S2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2005-02-24 139264] S2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2004-11-30 20543] S2 ISSVC;IS Service; C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe [2007-09-07 87416] S2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2005-02-24 131133] S2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2005-02-24 57409] S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004] S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-05-31 75064] S2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-06-23 189288] S2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe [2007-10-07 1822648] S2 SymSecurePort;Symantec SecurePort; C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe [2007-09-07 173432] S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376] S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-08-28 2999664] S3 SavRoam;SAVRoam; C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [2007-10-07 116664] S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-08-27 214408] S3 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2007-07-26 1181016] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880] -----------------EOF----------------- |
|
|
|
|
Jul 2 2009, 07:16 PM
Post
#3
|
|
 Computer Masochist Group: Moderator Posts: 22,937 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
I'm sorry, but you need to repost you log.
I have moved your Topic that included a HijackThis/DDS log here to the Misplaced HJT Logs forum. You posted your log in a forum not intended for HijackThis/DDS logs analysis. We can only allow topics with such logs in the HijackThis Logs and Malware Removal forum. This restriction is to ensure you get the best help available, from those who specialize in malware anlaysis and removal. It also should prevent you from receiving ineffective or even potentially dangerous advice, whether well meaning or not. We understand that dealing with malware issues and getting help can be frustrating but improperly posting a log usually happens if you missed the directions we provide to those who require malware removal assistance. Prior to posting a log, we ask that you please read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log. Following the steps in this Guide will allow the HJT Team to quickly help you with specific fixes for what may remain on your system. Please complete all the steps in the Guide. If you can't perform a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log. When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Prep Guide to post a new log. Please do not post any more logs to this topic as it just a placeholder to be used to help you post the information in the proper way and in the proper forum. Going forward, HijackThis logs should only be posted in the HijackThis Logs and Virus/Trojan/Spyware/Malware Removal in order to make it easier for our helpers to respond to your topic The Misplaced HJT Logs forum is strictly a holding area where the BC Staff can assist you with preparations for and to properly post your log. If you have a question or encounter a problem in the Prep Guide, please do post back to this topic; that is what it is here for. When your new DDS/HJT log is posted in the proper forum, please reply to this topic with a link to your new topic. Once that is done, a Member of the HJT Team will analyze your log and assist you with step by step instructions to clean your computer or otherwise advise what needs to be done. Thanks for your cooperation and good luck. The BC Staff -------------------- Mark
 why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
|
Jul 2 2009, 11:13 PM
Post
#4
|
|
 OBleepin Investigator Group: Moderator Posts: 17,441 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150 |
Hello
Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer. From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean. Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible To avoid confusion, I am closing this topic. Good luck with your log. The BC Staff -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 8th November 2009 - 06:38 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.