 Computer Running Really Slow |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 May 26 2007, 07:19 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074  |
I thought i removed them, but within a couple minutes, popups started to come, and my comp doesnt have rundll32 so I cant use the control panel functions. Also my comp is running at a much slower pace than before. Can anyone help me? Heres a Hijack This log Logfile of HijackThis v1.99.1 Scan saved at 5:14:03 PM, on 5/26/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe c:\program files\panda software\panda antivirus 2007\WebProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\Program Files\WinRAR\WinRAR.exe C:\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SManager] smanager.7.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310 O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe Thanks in advance :D |
 |
 
|
|
May 27 2007, 04:55 AM
Post
#2
|
|
 Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
Welcome to the BleepingComputer HijackThis Logs and Analysis forum evildonut
 Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 You are well advised to remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present: Viewpoint Viewpoint Manager Viewpoint Media Player Then restart your pc. ************************** Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. When VundoFix re-opens,click the "Scan for Vundo" button. Once it's done scanning,click the "Remove Vundo" button. You will receive a prompt asking if you want to remove the files, click "YES". Once you click yes, your desktop will go blank as it starts removing Vundo. When completed,it will prompt that it will reboot your computer,click "OK". Please post the contents of C:\vundofix.txt into your next reply. Note: It is possible that VundoFix encountered a file it could not remove. In this case,VundoFix will run on reboot,simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. ************************** Please download Combofix and save to your desktop: http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe Note: It is important that it is saved directly to your desktop Close any open browsers. Double click on combofix.exe and follow the prompts. When it's finished it will produce a log. Post the C:\ComboFix.txt into your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause the program to freeze/hang. ************************** Now go to: C:\HijackThis\HijackThis.exe Right click on Hijackthis.exe and select 'Rename', rename it to abc.bat Double click on abc.bat(which is still Hijackthis.exe),post that log into your next reply please. -------------------- If I have helped you in any way, please consider a donation:
 Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
May 27 2007, 02:05 PM
Post
#3
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
umm one thing i mentioned earlier is that my add/delete programs cant function due to my rundll32 missing (either from malware or i dont know what)
either way, i will try to follow the steps asap. -ok 2 done i manually deleted viewpt. used vundo fix here's the txt VundoFix V6.4.1 Checking Java version... Java version is 1.5.0.2 Old versions of java are exploitable and should be removed. Scan started at 12:08:58 PM 5/27/2007 Listing files found while scanning.... C:\WINDOWS\system32\byxyyaw.dll C:\WINDOWS\system32\ddccdbx.dll C:\WINDOWS\system32\dgjlm.ini C:\WINDOWS\system32\edeeg.ini C:\WINDOWS\system32\fcccdaw.dll C:\WINDOWS\system32\fccdbcc.dll C:\WINDOWS\system32\gebbyxu.dll C:\WINDOWS\system32\geede.dll C:\WINDOWS\system32\khfcyxu.dll C:\WINDOWS\system32\mljgd.dll C:\WINDOWS\system32\nqtss.bak1 C:\WINDOWS\system32\nqtss.bak2 C:\WINDOWS\system32\nqtss.ini C:\WINDOWS\system32\sstqn.dll C:\WINDOWS\system32\tuvuutu.dll C:\WINDOWS\system32\yeynkkqs.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\byxyyaw.dll C:\WINDOWS\system32\byxyyaw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ddccdbx.dll C:\WINDOWS\system32\ddccdbx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dgjlm.ini C:\WINDOWS\system32\dgjlm.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\edeeg.ini C:\WINDOWS\system32\edeeg.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\fcccdaw.dll C:\WINDOWS\system32\fcccdaw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fccdbcc.dll C:\WINDOWS\system32\fccdbcc.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\gebbyxu.dll C:\WINDOWS\system32\gebbyxu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\geede.dll C:\WINDOWS\system32\geede.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\khfcyxu.dll C:\WINDOWS\system32\khfcyxu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mljgd.dll C:\WINDOWS\system32\mljgd.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\nqtss.bak1 C:\WINDOWS\system32\nqtss.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\nqtss.bak2 C:\WINDOWS\system32\nqtss.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\nqtss.ini C:\WINDOWS\system32\nqtss.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\sstqn.dll C:\WINDOWS\system32\sstqn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\tuvuutu.dll C:\WINDOWS\system32\tuvuutu.dll Has been deleted! Performing Repairs to the registry. Done! Here's combo fix Wei Tan" - 2007-05-27 12:21:34 Service Pack 2 ComboFix 07-05.27.V - Running from: "C:\Documents and Settings\Wei Tan\Desktop\" (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\ecbifsfv.dll C:\WINDOWS\system32\wingdm32.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) "C:\WINDOWS\retadpu1000272.exe" "C:\WINDOWS\system32\wnscpisv32.exe" "C:\Program Files\outerinfo\Terms.rtf" "C:\DOCUME~1\WEITAN~1\APPLIC~1.\macromedia\Flash Player\#SharedObjects\HC5SH9BK\www.inter-focus.cn\flashad_beta_1.01.swf\IFFLASHAD.sol" "C:\DOCUME~1\WEITAN~1\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.inter-focus.cn\settings.sol" "C:\WINDOWS\system32\instcat.dll" "C:\WINDOWS\system32\klikalka.exe" "C:\Program Files\outerinfo" "C:\DOCUME~1\WEITAN~1\APPLIC~1.\macromedia\Flash Player\#SharedObjects\HC5SH9BK\www.inter-focus.cn" "C:\DOCUME~1\WEITAN~1\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.inter-focus.cn" Purity Folders: C:\WINDOWS\system32\MCROSO~1.NET C:\WINDOWS\WNSXS~1 C:\WINDOWS\RACLE~1 C:\DOCUME~1\WEITAN~1\APPLIC~1\RACLE~1 ((((((((((((((((((((((((((((((( Files Created from 2007-04-27 to 2007-05-27 )))))))))))))))))))))))))))))))))) 2007-05-27 12:08 <DIR> d-------- C:\VundoFix Backups 2007-05-27 12:06 <DIR> d-------- C:\Program Files\Copy of Viewpoint 2007-05-26 22:28 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2007-05-26 17:13 <DIR> d-------- C:\HijackThis 2007-05-26 12:47 71,680 --------- C:\WINDOWS\system32\drivers\PAVDRV51.SYS 2007-05-26 12:47 45,056 --a------ C:\WINDOWS\system32\avldr.dll 2007-05-26 12:47 248 --a------ C:\WINDOWS\system32\PavCPL.dat 2007-05-26 12:47 <DIR> d-------- C:\WINDOWS\system32\PAV 2007-05-26 12:46 <DIR> d-------- C:\Program Files\Panda Software 2007-05-25 15:15 60,928 --a------ C:\WINDOWS\system32\ktpl.dll 2007-05-23 13:13 <DIR> d-------- C:\WINDOWS\fmuz 2007-05-23 13:13 <DIR> d-------- C:\Program Files\Common Files\fmuz 2007-05-23 13:03 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Google 2007-05-23 12:58 <DIR> d--hs---- C:\WINDOWS\V2VpIFRhbg 2007-05-22 18:10 65,536 --a------ C:\WINDOWS\IFinst27.exe 2007-05-22 18:10 <DIR> d-------- C:\Program Files\Gravity 2007-05-22 15:28 31,232 --a------ C:\vbwcjmy.exe 2007-05-22 15:28 153,205 --a------ C:\poweriso_keygen_exe.vir 2007-05-22 15:23 <DIR> d-------- C:\Program Files\PowerISO 2007-05-22 15:22 1,014,730 --a------ C:\PowerISO37.exe 2007-05-15 12:14 <DIR> dr------- C:\DOCUME~1\WEITAN~1\APPLIC~1\Brother 2007-05-14 20:23 <DIR> d-------- C:\ppt 2007-05-10 21:53 <DIR> d-------- C:\DOCUME~1\WEITAN~1\APPLIC~1\DivX 2007-05-10 21:39 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-05-10 21:39 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-05-10 21:39 129,784 --a------ C:\WINDOWS\system32\pxafs.dll 2007-05-10 21:39 <DIR> d-------- C:\Program Files\DivX 2007-05-03 21:58 <DIR> d-------- C:\Program Files\PeerGuardian2 2007-05-02 11:04 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-05-02 11:04 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-05-02 11:04 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-05-02 11:04 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-05-02 11:02 73,728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-05-02 11:02 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-05-02 11:02 57,344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-05-02 11:02 53,248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-05-02 11:02 344,064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-05-02 11:02 294,912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-05-02 11:02 294,912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-05-02 11:02 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-05-02 11:01 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-05-02 11:01 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-05-02 11:01 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-05-02 11:01 740,442 --a------ C:\WINDOWS\system32\DivX.dll 2007-05-01 19:33 124,472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-05-01 19:33 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-30 19:21 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-04-30 19:20 <DIR> d-------- C:\Program Files\Real 2007-04-30 19:20 <DIR> d-------- C:\Program Files\Common Files\Real 2007-04-30 19:17 <DIR> d-------- C:\DOCUME~1\WEITAN~1\APPLIC~1\Real 2007-04-30 19:11 <DIR> d-------- C:\My Downloads 2007-04-30 00:35 <DIR> d-------- C:\Program Files\Lux (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-27 00:09:48 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-05-27 00:09:46 -------- d-----w C:\Program Files\Symantec 2007-05-26 19:46:54 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-05-23 00:26:48 -------- d-----w C:\Program Files\Warcraft III 2007-05-22 23:49:01 -------- d-----w C:\DOCUME~1\WEITAN~1\APPLIC~1\Azureus 2007-05-17 06:36:31 -------- d-----w C:\DOCUME~1\WEITAN~1\APPLIC~1\Hamachi 2007-05-02 18:04:15 36,624 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-05-02 18:04:14 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe 2007-05-02 18:04:14 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe 2007-04-24 00:48:52 4,620 ----a-w C:\WINDOWS\XChange.dat 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-12 05:45:02 -------- d-----w C:\DOCUME~1\WEITAN~1\APPLIC~1\Apple Computer 2007-04-11 06:42:22 -------- d-----w C:\DOCUME~1\WEITAN~1\APPLIC~1\Xfire 2007-04-11 05:16:35 -------- d-s---w C:\Program Files\Xfire 2007-04-10 23:25:38 2,450,128 ----a-w C:\xfire_installer_25432.exe 2007-04-09 12:27:07 31,548 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys 2007-04-08 21:34:02 -------- d-----w C:\Program Files\IrfanView 2007-04-05 23:07:06 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-04-02 18:45:45 -------- d-----w C:\Program Files\MSECache 2007-03-27 07:56:06 -------- d-----w C:\Program Files\Hamachi 2007-03-27 07:55:51 17,480 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-03-27 07:47:27 -------- d-----w C:\DOCUME~1\WEITAN~1\APPLIC~1\Ventrilo 2007-03-27 07:35:28 -------- d-----w C:\Program Files\VentSrv 2007-03-27 07:29:50 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-03-27 07:16:16 -------- d-----w C:\Program Files\Ventrilo 2007-03-25 18:15:04 249,856 ------w C:\WINDOWS\Setup1.exe 2007-03-24 01:53:39 34 ----a-w C:\WINDOWS\system32\BD2070N.DAT 2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-17 04:38:55 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-03-15 18:23:16 497,496 ----a-w C:\WINDOWS\system32\XceedZip.dll 2007-03-15 18:19:58 526,184 ----a-w C:\WINDOWS\system32\XceedCry.dll 2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38] {100C9564-C5F5-41CF-83E9-0F78CB11750B}=C:\WINDOWS\system32\sstqn.dll [] {4B646AFB-9341-4330-8FD1-C32485AEE619}=C:\WINDOWS\system32\ecbifsfv.dll [] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {A5366673-E8CA-11D3-9CD9-0090271D075B}=C:\PROGRA~1\FlashGet\jccatch.dll [2002-01-16 19:12] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar3.dll [2007-01-20 00:55] {CC053D3E-D387-EB26-DD07-8AADA8CD77E0}=C:\WINDOWS\system32\ktpl.dll [2007-05-21 06:59] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-08 21:05] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 05:12] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 05:11] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-10-22 12:18] "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 13:24] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54] "Wise-FTP Scheduler"="" [] "WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2005-07-04 16:47] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 13:54] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 15:11] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11] "GhostStartTrayApp"="C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" [2002-08-14 15:21] "APVXDWIN"="C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.exe" [2007-01-25 18:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-14 17:49] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:00] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"=1 (0x1) "AllowUnhashedWebView"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\°À] °À [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ÀÐ] ÀÐ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\instcat] instcat.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkijgf] jkkijgf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingdm32] wingdm32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\°Xh] °Xh [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Ø€] Ø€ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2439f64e-7e98-11db-91c0-0010c6fae897}] AutoRun\command- E:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f00fde6d-9e9d-11db-ad7e-0014a569018a}] AutoRun\command- H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6631bbd-14ae-11da-9181-0010c6fae897}] AutoRun\command- G:\setupSNK.exe *Newly Created Service* -PROCEXP90 Contents of the 'Scheduled Tasks' folder 2007-05-27 19:24:00 C:\WINDOWS\tasks\Symantec NetDetect.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-27 12:24:08 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... cmd.exe [2972] scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????7?5?7?5??????? ???B?????????????H<C? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-27 12:24:33 C:\ComboFix-quarantined-files.txt ... 2007-05-27 12:24 --- E O F --- heres hijackthis log as abc.bat Logfile of HijackThis v1.99.1 Scan saved at 12:35:55 PM, on 5/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\svchost.exe c:\program files\panda software\panda antivirus 2007\WebProxy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\HijackThis\abc.bat R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {100C9564-C5F5-41CF-83E9-0F78CB11750B} - C:\WINDOWS\system32\sstqn.dll (file missing) O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\ecbifsfv.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {CC053D3E-D387-EB26-DD07-8AADA8CD77E0} - C:\WINDOWS\system32\ktpl.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: °À - °À (file missing) O20 - Winlogon Notify: ÀÐ - ÀÐ (file missing) O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O20 - Winlogon Notify: instcat - instcat.dll (file missing) O20 - Winlogon Notify: jkkijgf - jkkijgf.dll (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: opnolll - C:\WINDOWS\SYSTEM32\opnolll.dll O20 - Winlogon Notify: wingdm32 - wingdm32.dll (file missing) O20 - Winlogon Notify: °Xh - °Xh (file missing) O20 - Winlogon Notify: Ø€ - Ø€ (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) :D This post has been edited by evildonut: May 27 2007, 02:40 PM |
|
|
|
|
May 27 2007, 02:40 PM
Post
#4
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
Note
My comps about normal speed now and i havent encountered popups as of yet! bad thing is, my rundll32 is still missing, and i cant use anything from the control panel... btw thanks for helping out at like.. 3am :D saved my comp This post has been edited by evildonut: May 27 2007, 02:41 PM |
|
|
|
|
May 27 2007, 03:26 PM
Post
#5
|
|
|
Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
Download Avenger from the link below:
http://swandog46.geekstogo.com/avenger.zip Unzip/extract it to your desktop. Start up Avenger. Check the 'Input script manually' option. Click the Magnifying Glass icon. In the box that opens,copy and paste ALL the following bold blue text in the Quote box below: QUOTE Files to delete: C:\vbwcjmy.exe C:\poweriso_keygen_exe.vir C:\WINDOWS\IFinst27.exe C:\WINDOWS\system32\ktpl.dll C:\WINDOWS\SYSTEM32\opnolll.dll Then click on 'Done'. Click the Traffic Light icon to start the program. Then press OK at the prompts to reboot your PC. Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply. Also post a new Hijackthis log please. -------------------- If I have helped you in any way, please consider a donation:
Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
May 27 2007, 04:11 PM
Post
#6
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
sorry for the slow reply
Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\iiuidxha ******************* Script file located at: \??\C:\vbmfwari.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\vbwcjmy.exe deleted successfully. File C:\poweriso_keygen_exe.vir deleted successfully. File C:\WINDOWS\IFinst27.exe deleted successfully. File C:\WINDOWS\system32\ktpl.dll deleted successfully. File C:\WINDOWS\SYSTEM32\opnolll.dll deleted successfully. Completed script processing. ******************* Finished! Terminate. hijack this log Logfile of HijackThis v1.99.1 Scan saved at 2:07:01 PM, on 5/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe c:\program files\panda software\panda antivirus 2007\WebProxy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\wuauclt.exe C:\HijackThis\abc.bat R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {100C9564-C5F5-41CF-83E9-0F78CB11750B} - C:\WINDOWS\system32\sstqn.dll O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\ecbifsfv.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {8071E65A-3F56-4426-8372-8667CD213057} - C:\WINDOWS\system32\opnolll.dll (file missing) O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {CC053D3E-D387-EB26-DD07-8AADA8CD77E0} - C:\WINDOWS\system32\ktpl.dll (file missing) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: °À - °À (file missing) O20 - Winlogon Notify: ÀÐ - ÀÐ (file missing) O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O20 - Winlogon Notify: instcat - instcat.dll (file missing) O20 - Winlogon Notify: jkkijgf - jkkijgf.dll (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: opnolll - opnolll.dll (file missing) O20 - Winlogon Notify: wingdm32 - wingdm32.dll (file missing) O20 - Winlogon Notify: °Xh - °Xh (file missing) O20 - Winlogon Notify: Ø€ - Ø€ (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) |
|
|
|
|
May 27 2007, 04:20 PM
Post
#7
|
|
|
Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
Start up Avenger.
Check the 'Input script manually' option. Click the Magnifying Glass icon. In the box that opens,copy and paste ALL the following bold blue text in the Quote box below: QUOTE Files to delete: C:\WINDOWS\system32\sstqn.dll Then click on 'Done'. Click the Traffic Light icon to start the program. Then press OK at the prompts to reboot your PC. Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply. ********************************* Download/install AVG Anti-Spyware 7.5. Please follow these instructions very carefully. Launch/start up AVG Anti-Spyware. On the main page click the 'Update' tab,and then 'Start Update'. Note: If you have any problems running the update process prior to running the scan,download/install the 'Full Database' from here: http://download.ewido.net/avgas-signatures-full-current.exe Once the updates have been installed,do the following: Select the 'Scanner' icon at the top of the screen, then select the 'Settings' tab. Once in the 'Settings' screen,under 'How to act?',then under 'Set default action for detected malware to:', click on 'Recommended actions',then click on 'Quarantine'. Under 'Reports' select 'Automatically generate report after every scan' and unselect 'Only if threats were found'. Exit AVG Anti-Spyware,don't run the scan just yet. You might want to print/copy the following as you need to be in Safe Mode from here on. Reboot your computer into SAFE MODE using the F8 method. To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode". Have Hijack This fix the following [If still present], by placing a check in the appropriate boxes and selecting 'Fix checked'. Make sure all browser and all Windows Explorer windows are closed before fixing: O2 - BHO: (no name) - {100C9564-C5F5-41CF-83E9-0F78CB11750B} - C:\WINDOWS\system32\sstqn.dll O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\ecbifsfv.dll (file missing) O2 - BHO: (no name) - {8071E65A-3F56-4426-8372-8667CD213057} - C:\WINDOWS\system32\opnolll.dll (file missing) O2 - BHO: (no name) - {CC053D3E-D387-EB26-DD07-8AADA8CD77E0} - C:\WINDOWS\system32\ktpl.dll (file missing) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O20 - Winlogon Notify: °À - °À (file missing) O20 - Winlogon Notify: ÀÐ - ÀÐ (file missing) O20 - Winlogon Notify: instcat - instcat.dll (file missing) O20 - Winlogon Notify: jkkijgf - jkkijgf.dll (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: opnolll - opnolll.dll (file missing) O20 - Winlogon Notify: wingdm32 - wingdm32.dll (file missing) O20 - Winlogon Notify: °Xh - °Xh (file missing) O20 - Winlogon Notify: Ø€ - Ø€ (file missing) Still in Safe Mode launch AVG Anti-Spyware. Click the 'Scanner' icon at the top. To start the scan click on 'Complete System Scan'. Please be patient,it takes a while for the scan to finish. Once the scan is complete,do the following. If AVG Anti-Spyware detected any infected objects:,click on 'Apply All Actions'. Next click on 'Save Report'. Copy and paste that report into your next reply. The report can be found under the 'Reports' tab at the top. Close AVG Anti-Spyware when you've done. Reboot normally. Post the AVG Anti Spyware report and a new Hijackthis log into your next reply. Let me know how your pc is running now please. -------------------- If I have helped you in any way, please consider a donation:
Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
May 27 2007, 07:26 PM
Post
#8
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
wow..
that was a long scan haha it took even longer because i was vacuuming and accidently bumped into the power cord>.< anyways avg report -------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 5:15:40 PM 5/27/2007 + Scan result: C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041143.dll -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041144.exe -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP318\A0040023.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041146.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041277.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041370.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\avenger\backup.zip/avenger/ktpl.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP317\A0039970.exe -> Adware.SpyHunter : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041131_exe.vir/crack.exe -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041148.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041236.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\gebbyxu.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\avenger\backup.zip/avenger/poweriso_keygen_exe.vir/crack.exe -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\retadpu1000272.exe.vir -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP319\A0041114.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041266.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041131_exe.vir/keygen.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined). C:\avenger\backup.zip/avenger/poweriso_keygen_exe.vir/keygen.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP317\A0040007_exe.vir -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041142.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\Program Files\Common Files\fmuz\fmuzd\vocabulary -> Downloader.TSUpdate.j : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041141.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined). :mozilla.152:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.157:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.199:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.308:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@cupolaventures.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@pch.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@arn.aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned. :mozilla.88:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.89:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.90:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@3.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.357:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.358:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.359:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.519:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.520:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.91:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.489:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Cnn : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@ads.cnn[1].txt -> TrackingCookie.Cnn : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@news.com[1].txt -> TrackingCookie.Com : Cleaned. :mozilla.46:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.49:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.52:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.53:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned. C:\Documents and Settings\LocalService\Cookies\system@enhance[1].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@enhance[1].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@epilot[1].txt -> TrackingCookie.Epilot : Cleaned. :mozilla.183:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.184:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.185:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.186:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.535:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@ehg-hollywood.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.252:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.253:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.361:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.362:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.363:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@navrcholu[1].txt -> TrackingCookie.Navrcholu : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@data2.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned. :mozilla.58:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@www.paypal[2].txt -> TrackingCookie.Paypal : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@realguide.real[1].txt -> TrackingCookie.Real : Cleaned. :mozilla.346:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.347:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.348:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.349:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.350:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.351:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.352:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.353:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.491:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@revsci[1].txt -> TrackingCookie.Revsci : Cleaned. :mozilla.195:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.196:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Guest\Cookies\guest@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.380:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.381:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.382:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.383:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.384:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.94:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.95:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.96:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.97:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.98:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@h.starware[1].txt -> TrackingCookie.Starware : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@try.starware[1].txt -> TrackingCookie.Starware : Cleaned. :mozilla.33:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.34:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.35:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.36:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.37:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.38:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned. :mozilla.406:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Trafic : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@trafic[1].txt -> TrackingCookie.Trafic : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@a.tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.337:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.338:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.339:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.340:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.341:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.271:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.510:C:\Documents and Settings\Wei Tan\Application Data\Mozilla\Firefox\Profiles\yamuon6h.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\Wei Tan\Cookies\wei tan@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned. C:\QooBox\Quarantine\C\WINDOWS\system32\wingdm32.dll.vir -> Trojan.Dialer.qn : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041271.dll -> Trojan.Dialer.qn : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\wnscpisv32.exe.vir -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP317\A0040013.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041145.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041267.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041372.exe -> Worm.Locksky.aw : Cleaned with backup (quarantined). C:\avenger\backup.zip/avenger/vbwcjmy.exe -> Worm.Locksky.aw : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\instcat.dll.vir -> Worm.Locksky.bh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP320\A0041268.dll -> Worm.Locksky.bh : Cleaned with backup (quarantined). ::Report end Hijack this report Logfile of HijackThis v1.99.1 Scan saved at 5:22:18 PM, on 5/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\qttask.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe c:\program files\panda software\panda antivirus 2007\WebProxy.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\HijackThis\abc.bat R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) rundll32 still cant be found, and i still cant run control panel functions, but as of now, i dont see popups:D oh and for some wierd reason my cd drives arent showing This post has been edited by evildonut: May 28 2007, 12:26 AM |
|
|
|
|
May 28 2007, 02:02 AM
Post
#9
|
|
|
Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
Click on Start>Run and type Services.msc then hit Ok.
Scroll down and find the service called: Viewpoint Manager Service When you find it, double-click on it. In the next window that opens, click the 'Stop' button. Then change the 'Startup Type:' to 'Disabled'. Now press Apply and then Ok and close any open windows. Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'. Make sure all browser and all Windows Explorer windows are closed before fixing: O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) ************************* Place your Microsoft Windows XP installation disk into your cd-rom drive. Click on Start/Run,type CMD then press Ok. At the Command Prompt copy and paste the following bold text,then press Enter. First replace the X below with the actual letter of your cd-rom drive. expand X:\i386\rundll32.ex_ c:\windows\system32\rundll32.exe Restart your pc. ************************* If the above did'nt work,i've attached rundll32.exe below. Download it and then unzip/extract it to your C:\WINDOWS\System32 folder overwriting any existing copy. Restart your pc when you've done. QUOTE oh and for some wierd reason my cd drives arent showing Backup the registry first by doing the following. Click on Start>Run,type regedit then press Enter. Click on 'File' at the top,then 'Export'. In the opening 'Export Registry File' box,place a check in 'ALL' at the bottom left. In the 'File name:' space,type backup.reg Make sure 'Desktop' is selected in the left hand column. Then press 'Save'. Click on Start>Run and type regedit then press Enter, then navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\ {4D36E965-E325-11CE-BFC1-08002BE10318} Highlight the above key by left clicking on it once. In the right hand side window delete the values 'Upperfilters' and 'Lowerfilters' if either or both are present. Restart your pc. Post a new Hijackthis log please. Let me know whats happening now. This post has been edited by RichieUK: May 28 2007, 02:31 AM -------------------- If I have helped you in any way, please consider a donation:
Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
May 28 2007, 02:53 AM
Post
#10
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
This computer i believe, is fixed thanks to you man.
Control panel functions work, havent seen a popup in ages comp is running at regular speed and i can see my disk drives heres the log Logfile of HijackThis v1.99.1 Scan saved at 12:47:17 AM, on 5/28/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE C:\Program Files\internet explorer\iexplore.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe c:\program files\panda software\panda antivirus 2007\WebProxy.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\HijackThis\abc.bat R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer...DataManager.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsCtrls.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe Thanks for taking time out of your schedule to help me out! |
|
|
|
|
May 28 2007, 03:48 AM
Post
#11
|
|
|
Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
Your log is clean
If all's ok,please do the following: Find and delete: VundoFix.exe Combofix Avenger C:\VundoFix Backups C:\Avenger C:\QooBox Click on Start/All Programs/Accessories/System Tools/System Restore. In the 'System Restore' window,click on the 'Create a Restore Point' button,then click 'Next'. In the window that appears,enter a description\name for the Restore Point,then click on 'Create',wait,then click 'Close'. The date and time will be created automatically. Next click on Start/All Programs/Accessories/System Tools/Disk Cleanup. The 'Select Drive' box will appear,click on Ok. The 'Disk Cleanup for [C:]' box will appear,click on the 'More Options' tab. At the bottom in the 'System Restore' window,click on the 'Clean up...' button. A box will pop up 'Are you sure you want to delete all but the most recent restore point?',click on 'Yes'. Click on 'Yes' at 'Are you sure you want to perform these actions?'. Now wait until 'Disk Cleanup' finishes and the box disappears. Read through the information found here,to help you prevent any possible future infections. 'How to prevent Malware' by miekiemoes: http://users.telenet.be/bluepatchy/miekiem...prevention.html -------------------- If I have helped you in any way, please consider a donation:
Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
May 28 2007, 10:25 PM
Post
#12
|
|
|
New Member Group: Members Posts: 7 Joined: 26-May 07 Member No.: 133,074 |
well
everything is swell and complete thanks again :D |
|
|
|
|
May 29 2007, 06:10 AM
Post
#13
|
|
|
Malware Assassin Group: HJT Team Posts: 13,611 Joined: 13-July 06 Member No.: 75,975 |
You're welcome.
This thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic. -------------------- If I have helped you in any way, please consider a donation:
Proud Member of ASAP (Alliance of Security Analysis Professionals). Proud Member of U-N-I-T-E (Unified Network of Instructors and Trusted Eliminators). |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 8th November 2009 - 12:15 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.