Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Video Activex Access Trojan


  • This topic is locked This topic is locked
14 replies to this topic

#1 alt3rn1ty

alt3rn1ty

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 29 July 2007 - 07:46 AM

ah forgot Hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:44:26, on 29/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sleepy\service.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Sleepy\slptask.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\WTClient.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - (no file)
O4 - HKLM\..\Run: [AdmTask] C:\Program Files\AdmTask\admtask.exe /m
O4 - HKLM\..\Run: [StartupDelayer] "C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher GUI.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKLM\..\Run: [WService] WService.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\BleepinPuter\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascinstie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1182273228595
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sleepy - Sashazur, LLC - C:\Program Files\Sleepy\service.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--
End of file - 6828 bytes

BC AdBot (Login to Remove)

 


#2 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 30 July 2007 - 05:41 PM

My HJT log has been posted here by one of your moderators, my bad putting it in the wrong place

Anyway - My problem is MWAV reports I have

Video Activex Access Trojan
gain.gator spyware/adware
and possible fujacks worm

without subscribing to MWAV again can I clean these another way.


If it helps here are the offending entries in the MWAV log file

Sun Jul 29 12:45:59 2007 => System found infected with video activex access Trojan ({7e853d72-626a-48ec-a868-ba8d5e23e045})! Action taken: No Action Taken.
Sun Jul 29 12:46:01 2007 => Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gator.com !!!
Sun Jul 29 12:46:01 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Jul 29 12:46:01 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\p3p\history\gator.com !!!
Sun Jul 29 12:46:01 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Jul 29 12:46:01 2007 => Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\p3p\history\gator.com !!!
Sun Jul 29 12:46:01 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Jul 29 12:46:13 2007 => Checking MountPoints2 Registry Key...
Sun Jul 29 12:46:13 2007 => Executable Command Found in {50252a90-9d92-11da-98dc-806d6172696f}\Shell\AutoRun\command: J:\Setup\rsrc\Autorun.exe
Sun Jul 29 12:46:13 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50252a90-9d92-11da-98dc-806d6172696f} !!!
Sun Jul 29 12:46:13 2007 => Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.

Sun Jul 29 12:46:13 2007 => Executable Command Found in {50252a91-9d92-11da-98dc-806d6172696f}\GAME_EXE\GAME_GUID\GAME_NAME\Shell\AutoRun\command: K:\Autorun.exe
Sun Jul 29 12:46:13 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50252a91-9d92-11da-98dc-806d6172696f} !!!
Sun Jul 29 12:46:13 2007 => Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.

Sun Jul 29 12:46:13 2007 => Checking CLSID Reference Entries...
Sun Jul 29 12:46:17 2007 => Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.

Sun Jul 29 12:46:18 2007 => Checking Module Usage Entries...
Sun Jul 29 12:46:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.

Sun Jul 29 12:46:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.

#3 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 09:28 AM

Please ignore the two possible fujacks type worm entries - I believe these are known as false positives, they both refer to the autorun.exe on Neverwinter Nights 2 disk and Doom 3 disk (We keep them in the drives ready to play).

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 09:43 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum alt3rn1ty :thumbsup:
My name is Richie and i'll be helping you to fix your problems.

Please download Combofix and save to your desktop:
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window while it's running.
That may cause the program to freeze/hang.


Download SmitfraudFix (by S!Ri), to your desktop.
Double click on Smitfraudfix.cmd
Select option 1 – Search, by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy and paste the content of that report into your next reply.

*IMPORTANT*
Do NOT run any other options until you are asked to do so!
Posted Image
Posted Image

#5 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 10:45 AM

Hi RichieUK, as requested combofix and smitfraudfix logs:

Combofix

ComboFix 07-07-31 - "BleepinPuter" 2007-07-31 16:39:19.2 Input Error: There is no script engine for file extension ".vbs". - NTFS
Input Error: There is no script engine for file extension ".vbs".


((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-31 )))))))))))))))))))))))))))))))


2007-07-31 16:36 1,870 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-31 16:29 0 --a------ C:\WINDOWS\system32\sfsync02.dll
2007-07-31 16:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-29 12:29 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-19 22:11 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-06-27 00:12 <DIR> d-------- C:\DOCUME~1\BLEEPI~1\APPLIC~1\uTorrent
2007-06-27 00:11 177,152 --a------ C:\Program Files\utorrent.exe
2007-06-24 16:24 <DIR> d--h----- C:\WINDOWS\PIF
2007-06-20 00:35 <DIR> d-------- C:\DOCUME~1\BLEEPI~1\APPLIC~1\WinRAR
2007-06-19 18:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
2007-06-19 18:05 <DIR> d-------- C:\DOCUME~1\BLEEPI~1\APPLIC~1\Canon
2007-06-19 18:02 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
2007-06-19 18:02 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
2007-06-19 18:02 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
2007-06-19 17:59 <DIR> d-------- C:\DOCUME~1\BLEEPI~1\APPLIC~1\ScanSoft
2007-06-19 17:58 <DIR> d-------- C:\Program Files\ScanSoft
2007-06-19 17:58 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2007-06-19 17:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanWizard
2007-06-19 17:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
2007-06-19 17:56 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
2007-06-19 17:56 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
2007-06-19 17:56 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
2007-06-19 17:56 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
2007-06-19 17:56 <DIR> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
2007-06-19 17:56 <DIR> d--h----- C:\CanonMP
2007-06-19 17:56 <DIR> d-------- C:\WINDOWS\StartHtmico
2007-06-19 16:48 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-18 18:33 90,112 -ra------ C:\WINDOWS\system32\CNMCP7B.exe
2007-06-18 18:31 8,704 --a------ C:\WINDOWS\system32\CNMVS7B.DLL
2007-06-18 18:31 140,288 --a------ C:\WINDOWS\system32\CNMLM7B.DLL
2007-06-08 19:05 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-06-08 19:02 28,672 --a------ C:\WINDOWS\system32\WService.exe
2007-06-08 19:02 <DIR> d-------- C:\Program Files\GENIUS TABLET
2007-06-08 18:58 53,248 --a------ C:\WINDOWS\system32\UCMfg.exe
2007-06-08 18:58 53,248 --a------ C:\WINDOWS\system32\drivers\WTSrv.exe
2007-06-08 18:58 45,056 --a------ C:\WINDOWS\system32\ucinst32.dll
2007-06-08 18:58 40,960 --a------ C:\WINDOWS\system32\WTClient.exe
2007-06-08 18:58 315,392 --a------ C:\WINDOWS\SetupX32.EXE
2007-06-08 18:58 286,720 --a------ C:\WINDOWS\system32\tabcfg.exe
2007-06-08 18:58 24,576 --a------ C:\WINDOWS\system32\lhtool.exe
2007-06-08 18:58 23,202 --a------ C:\WINDOWS\system32\drivers\TClass2k.sys
2007-06-08 18:58 16,384 --a------ C:\WINDOWS\system32\drivers\PTSimBus.sys
2007-06-08 18:58 15,370 --a------ C:\WINDOWS\system32\drivers\Tablet2k.sys
2007-06-08 18:58 135,168 --a------ C:\WINDOWS\system32\WinTab32.dll
2007-06-08 18:58 11,090 --a------ C:\WINDOWS\system32\drivers\UCTblHid.sys
2007-06-08 18:58 10,752 --a------ C:\WINDOWS\system32\drivers\PTSimHid.sys
2007-06-08 18:58 <DIR> d-------- C:\Program Files\TABLET


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 16:10 --------- d-------- C:\Program Files\Mozilla Thunderbird
2007-07-31 01:43 --------- d-------- C:\Program Files\a-squared Free
2007-07-27 23:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-27 23:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-27 23:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-27 23:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-27 22:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-27 22:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-27 22:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-07-25 14:20 --------- d-------- C:\Program Files\GIMP-2.0
2007-07-19 18:11 --------- d-------- C:\Program Files\TED Notepad
2007-06-25 19:05 --------- d-------- C:\Program Files\SpeedFan
2007-06-24 12:37 --------- d-------- C:\Program Files\Ricochet Lost Worlds Recharged
2007-06-21 20:15 --------- d-------- C:\Program Files\Canon
2007-06-18 18:34 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-06-17 12:46 --------- d-------- C:\Program Files\RegScrubXP
2007-06-11 18:03 --------- d-------- C:\Program Files\Throttle
2007-06-11 18:03 --------- d-------- C:\Program Files\GameGain
2007-06-11 18:02 --------- d-------- C:\Program Files\PcMedik
2007-06-09 14:50 --------- d-------- C:\Program Files\Foxit Software
2007-06-08 19:17 --------- d-------- C:\Program Files\Paint.NET
2007-06-05 22:16 17118 --a------ C:\WINDOWS\mozver.dat
2007-05-22 18:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-05-16 16:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-02 19:22 1029833 --a------ C:\Program Files\cpuz.exe
2007-05-02 15:14 10681 --a------ C:\Program Files\cpuz-readme.txt
2007-04-14 17:32 14939528 --a------ C:\Program Files\mwav.exe
2007-03-19 16:20 124288 --a------ C:\Program Files\Contig.exe
2007-03-04 18:23 187392 --a------ C:\Program Files\wavplayer.exe
2007-02-13 19:56 156 --a------ C:\Program Files\cpuz.ini
2006-11-01 14:05 113464 --a------ C:\Program Files\Tcpview.exe
2006-09-27 11:21 1973 --a------ C:\Program Files\sg_backup_2006-09-27-1121.spg
2006-09-27 10:41 1973 --a------ C:\Program Files\sg_backup_2006-09-27-1041.spg
2006-09-24 12:18 1976 --a------ C:\Program Files\sg_backup_2006-09-24-1218.spg
2006-08-29 19:46 1973 --a------ C:\Program Files\sg_backup_2006-08-29-1946.spg
2006-08-29 19:39 1976 --a------ C:\Program Files\sg_backup_2006-08-29-1939.spg
2006-07-29 15:52 1973 --a------ C:\Program Files\sg_backup_2006-07-29-1552.spg
2006-07-28 10:14 1976 --a------ C:\Program Files\sg_backup_2006-07-28-1014.spg
2006-07-27 18:35 1976 --a------ C:\Program Files\sg_backup_2006-07-27-1835.spg
2006-07-17 00:00 1973 --a------ C:\Program Files\sg_backup_2006-07-17-0000.spg
2006-07-12 14:18 1975 --a------ C:\Program Files\sg_backup_2006-07-12-1418.spg
2006-07-12 14:04 1976 --a------ C:\Program Files\sg_backup_2006-07-12-1404.spg
2006-07-12 00:01 1973 --a------ C:\Program Files\sg_backup_2006-07-12-0001.spg
2006-07-11 22:16 1976 --a------ C:\Program Files\sg_backup_2006-07-11-2216.spg
2006-07-11 13:02 1976 --a------ C:\Program Files\sg_backup_2006-07-11-1302.spg
2006-06-22 13:54 1973 --a------ C:\Program Files\sg_backup_2006-06-22-1354.spg
2006-06-21 12:36 1973 --a------ C:\Program Files\sg_backup_2006-06-21-1236.spg
2006-05-21 10:09 1976 --a------ C:\Program Files\sg_backup_2006-05-21-1009.spg
2006-03-29 17:57 6986 --a------ C:\Program Files\hijackthis.log
2006-03-06 16:06 1973 --a------ C:\Program Files\sg_backup_2006-03-06-1506.spg
2006-03-06 15:45 1980 --a------ C:\Program Files\sg_backup_2006-03-06-1445.spg
2006-03-06 15:45 1980 --a------ C:\Program Files\FirstBackup.spg
2006-03-06 15:41 610304 --a------ C:\Program Files\TCPOptimizer.exe
2005-10-05 13:17 494533 --a------ C:\Program Files\Power Defragmenter GUI.exe
2005-08-27 04:06 446464 --a------ C:\Program Files\Filemon.exe
2005-08-09 13:58 275456 --a------ C:\Program Files\DSFMgr.exe
2005-07-14 06:06 98361 --a------ C:\Program Files\pagedfrg.exe
2005-03-25 17:08 49152 --a------ C:\Program Files\latency.exe
2005-02-16 11:06 218112 --a------ C:\Program Files\HijackThis.exe
2004-09-30 16:05 65536 --a------ C:\Program Files\InCurso.exe
2004-02-19 06:00 1298 --a------ C:\Program Files\README.txt
2004-02-19 05:40 87 --a------ C:\Program Files\Find more cursors.url
2004-02-18 03:06 137708 --a------ C:\Program Files\XZ-B-ONE_linkselect.ani
2004-02-18 02:39 270956 --a------ C:\Program Files\XZ-B-ONE_background.ani
2004-02-18 02:07 270954 --a------ C:\Program Files\XZ-B-ONE_altselect.ani
2004-02-17 15:17 270950 --a------ C:\Program Files\XZ-B-ONE_vertsize.ani
2004-02-17 15:17 270946 --a------ C:\Program Files\XZ-B-ONE_unavailable.ani
2004-02-17 15:14 270942 --a------ C:\Program Files\XZ-B-ONE_pointer.ani
2004-02-17 15:14 270940 --a------ C:\Program Files\XZ-B-ONE_move.ani
2004-02-17 15:13 270952 --a------ C:\Program Files\XZ-B-ONE_horzresize.ani
2004-02-17 15:13 137708 --a------ C:\Program Files\XZ-B-ONE_help.ani
2004-02-17 15:12 270946 --a------ C:\Program Files\XZ-B-ONE_handwriting.ani
2004-02-17 15:11 270952 --a------ C:\Program Files\XZ-B-ONE_diagresize_2.ani
2004-02-17 15:10 137708 --a------ C:\Program Files\XZ-B-ONE_busy.ani
2004-02-16 22:59 270850 --a------ C:\Program Files\XZ-B-ONE_diagresize_1.ani
2004-02-15 04:14 270850 --a------ C:\Program Files\XZ-B-ONE_precisionselect.ani
2004-02-11 20:12 275148 --a------ C:\Program Files\XZ-B-ONE_textselect.ani
2003-03-20 16:26 14619 --a------ C:\Program Files\FILEMON.HLP
2002-09-02 13:13 7983 --a------ C:\Program Files\TCPVIEW.HLP
2000-07-23 18:58 8419 --a------ C:\Program Files\pagedfrg.hlp


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdmTask"="C:\Program Files\AdmTask\admtask.exe" [2006-08-15 17:55]
"StartupDelayer"="C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher GUI.exe" [2007-03-16 02:16]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"WTClient"="WTClient.exe" [2007-04-11 16:27 C:\WINDOWS\system32\WTClient.exe]
"WService"="WService.exe" [2002-09-07 18:23 C:\WINDOWS\system32\WService.exe]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=01000000
"NoUserNameInStartMenu"=01000000

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxClock]
C:\Program Files\WFCLOCK.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ZRYJVY"=3 (0x3)
"SSScsiSV"=3 (0x3)
"SPTISRV"=3 (0x3)
"iPod Service"=3 (0x3)


*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 16:40:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 16:40:48
C:\ComboFix-quarantined-files.txt ... 2007-07-31 16:40

--- E O F ---

Smitfraudfix

SmitFraudFix v2.207

Scan done at 16:44:37.18, 31/07/2007
Run from H:\My Documents\Downloads\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\BleepinPuter


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\BleepinPuter\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

#6 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 10:59 AM

Download\install 'SuperAntiSpyware Home Edition Free Version' from here:
http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

Launch SuperAntiSpyware and click on 'Check for updates'.
Once the updates have been installed,exit SuperAntiSpyware.

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - (no file)


Exit Hijackthis.

Start SuperAntiSpyware.
On the main screen click on 'Scan your computer'.
Check: 'Perform Complete Scan'.
Click 'Next' to start the scan.

Superantispyware will now scan your computer,when it's finished it will list all/any infections found.
Make sure everything found has a checkmark next to it,then press 'Next'.
Click on 'Finish' when you've done.

It's possible that the program will ask you to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
Click on 'Preferences'.
Click on the 'Statistics/Logs' tab.
Under 'Scanner Logs' double click on 'SuperAntiSpyware Scan Log'.
It will then open in your default text editor,such as Notepad.
Copy and paste the contents of that report into your next reply.
Also post a new Hijackthis log,let me know how your pc is running now.

Posted Image
Posted Image

#7 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 11:02 AM

Ok will get back to you on this one, a full system scan will take a while on ours. :thumbsup:

#8 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 11:58 AM

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/31/2007 at 05:51 PM

Application Version : 3.9.1008

Core Rules Database Version : 3276
Trace Rules Database Version: 1287

Scan type : Complete Scan
Total Scan Time : 00:39:37

Memory items scanned : 388
Memory threats detected : 0
Registry items scanned : 6786
Registry threats detected : 0
File items scanned : 51472
File threats detected : 10

Adware.Tracking Cookie
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@allyours.virginmedia[2].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@partypoker[1].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@virginmedia[2].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@virginmedia[3].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@virginmedia[4].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@www.googleadservices[1].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@www.googleadservices[2].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@www.virginmedia[1].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@www.virginmedia[2].txt
C:\Documents and Settings\BleepinPuter\Cookies\bleepinputer@www.virginmedia[3].txt


HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:57:47, on 31/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTClient.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sleepy\service.exe
C:\Program Files\Sleepy\slptask.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AdmTask] C:\Program Files\AdmTask\admtask.exe /m
O4 - HKLM\..\Run: [StartupDelayer] "C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher GUI.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKLM\..\Run: [WService] WService.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\BleepinPuter\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascinstie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1182273228595
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sleepy - Sashazur, LLC - C:\Program Files\Sleepy\service.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--
End of file - 6721 bytes

#9 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 12:18 PM

Find and delete:
Combofix.exe
SmitfraudFix


Download ATF Cleaner by Atribune:
http://www.atribune.org/ccount/click.php?id=1

Double-click ATF-Cleaner.exe to run the program.
Click 'Select All' found at the bottom of the list.
Click the 'Empty Selected' button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

If you use Opera browser,do this also:
Click Opera at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

Click 'Exit' on the Main menu to close the program.

-------------------------------------------------

Your version of Sun Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older versions of Sun Java,and then update.
1. Download the latest version of Java Runtime Environment (JRE)
2. Scroll down to where it says 'Java Runtime Environment (JRE) 6u2'.
3. Click the "Download" button to the right.
4. Check the box that says: "Accept License Agreement".
5. The page will refresh.
6. Click on the link to download 'Windows Offline Installation, Multi-language' and save to your desktop.
7. Close any programs you may have running - especially your web browser.
8. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
9. Check any item with Java Runtime Environment (JRE or J2SE) in the name.
10. Click the Change/Remove button.
11. Repeat as many times as necessary to remove each Java versions.
12. Reboot your computer once all Java components are removed.
13. Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.

Your Hijackthis log is clean,hows your pc running now.
Is MWav still detecting anything.
Posted Image
Posted Image

#10 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 01:11 PM

Wow didnt know I had so many overlayed java installations and updates.

Anyway, MWAV reports still have gain.gator, 3 occurences. Had a search through my registry for key words gain and gator, could this be related to Spywareblaster installation?.

Heres MWAV log file (Just produced after java install, reset, and cleaned registry with regscrubxp and CCleaner)

EDIT: I did use your suggested temp cleaner ATF also prior to java install.

I have only included the errors/offending parts of the log file because Bleeping Computers forum entry wont allow such a long post for the whole log file:

<Thought this next error may be interesting>

Tue Jul 31 18:48:16 2007 => ERROR!!! Invalid Entry \??\C:\DOCUME~1\BLEEPI~1\LOCALS~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme...

<and the offending entries>

Tue Jul 31 18:48:22 2007 => ***** Scanning Registry and File system for Adware/Spyware *****
Tue Jul 31 18:48:22 2007 => Loading Spyware Signatures from new External Database [Name: C:\DOCUME~1\BLEEPI~1\LOCALS~1\Temp\spydb.avs, Size: 243375].
Tue Jul 31 18:48:22 2007 => Indexed Spyware Databases Successfully Created...

Tue Jul 31 18:48:24 2007 => Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gator.com !!!
Tue Jul 31 18:48:26 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Tue Jul 31 18:48:27 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\p3p\history\gator.com !!!
Tue Jul 31 18:48:27 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Tue Jul 31 18:48:27 2007 => Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\p3p\history\gator.com !!!
Tue Jul 31 18:48:27 2007 => Object "gain.gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Tue Jul 31 18:49:06 2007 => Checking MountPoints2 Registry Key...
Tue Jul 31 18:49:06 2007 => Checking CLSID Reference Entries...
Tue Jul 31 18:49:10 2007 => Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.

Tue Jul 31 18:49:11 2007 => Checking Module Usage Entries...
Tue Jul 31 18:49:11 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.

Tue Jul 31 18:49:11 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.

Edited by alt3rn1ty, 31 July 2007 - 01:14 PM.


#11 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 02:12 PM

could this be related to Spywareblaster installation?.

The “Immunize” feature of Spybot Search and Destroy adds those entries to the system Registry,so you've nothing to be concerned about.
This blocks cookies from some sites, places other sites in the restricted zone and blocks the download/execution of selected ActiveX scripts.

If all's ok,please do the following:

Click on Start/All Programs/Accessories/System Tools/System Restore.
In the 'System Restore' window,click on the 'Create a Restore Point' button,then click 'Next'.
In the window that appears,enter a description\name for the Restore Point,then click on 'Create',wait,then click 'Close'.
The date and time will be created automatically.

Next click on Start/All Programs/Accessories/System Tools/Disk Cleanup.
The 'Select Drive' box will appear,click on Ok.
The 'Disk Cleanup for [C:]' box will appear,click on the 'More Options' tab.
At the bottom in the 'System Restore' window,click on the 'Clean up...' button.
A box will pop up 'Are you sure you want to delete all but the most recent restore point?',click on 'Yes'.
Click on 'Yes' at 'Are you sure you want to perform these actions?'.
Now wait until 'Disk Cleanup' finishes and the box disappears.

Read through the information found here,to help you prevent any possible future infections.
'How to prevent Malware' by miekiemoes:
http://users.telenet.be/bluepatchy/miekiem...prevention.html
Posted Image
Posted Image

#12 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 02:36 PM

I had a feeling it was something to do with immunization, but wanted to be sure because my youngest daughter is now getting adventurous with computers, and a trace find could be the onset of a messy infiltration. My eldest is superb now at housekeeping the system but we have to go through the learning process again with the youngest.... no doubt we will have a few hiccups along the way.

Most grateful for your help and time, and helping to ensure the protection of my families online experiences. I hope one day to spend some time becoming a little more expert and precise in helping others out too.

:flowers: :huh: :huh: :thumbsup: :huh: :huh:


EDIT: FORGOT TO MENTION EARLIER I HAD ALREADY TURNED OFF SYSTEM RESTORE ON ALL DRIVES AS A PRECAUTION BEFORE MY INTITIAL SAFEBOOT AND SCAN, PRIOR TO CONTACTING YOU GUYZ.

Edited by alt3rn1ty, 31 July 2007 - 02:41 PM.


#13 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 02:48 PM

EDIT: FORGOT TO MENTION EARLIER I HAD ALREADY TURNED OFF SYSTEM RESTORE ON ALL DRIVES AS A PRECAUTION BEFORE MY INTITIAL SAFEBOOT AND SCAN, PRIOR TO CONTACTING YOU GUYZ.

I trust you've now turned it back on again.
Posted Image
Posted Image

#14 alt3rn1ty

alt3rn1ty
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 31 July 2007 - 03:14 PM

Yup, and created a new one. I think my best practise now after following some of your links would be to create a limited user account for my youngest, and installing the glubble plugin for firefox.

Many thanx again, you have been helpful in a lot of ways this session, should be an MVP if your not already.

Edit: By the way, how do I get rid of this sites reference to me as a 'member' :thumbsup:

Edited by alt3rn1ty, 31 July 2007 - 03:16 PM.


#15 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 31 July 2007 - 05:26 PM

You're welcome,glad to help :thumbsup:

This thread will now be closed.
If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you.
Include the address of this thread in your request.
If you should have a new issue, please start a new topic.
This applies only to the original topic starter.
Everyone else please begin a New Topic.
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users