Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help With Smitfraud!


  • Please log in to reply
5 replies to this topic

#1 figman

figman

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:49 PM

Posted 31 July 2007 - 07:48 PM

Spybot cannot get rid of it completely, Avast! can't even see it, and smitfraudfix won't work. Right now my only symptoms are popups (that i'm aware of). Can anyone please help me?


Logfile of HijackThis v1.99.1
Scan saved at 6:18:54 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\HPZipm12.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
D:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Nitro5x] c:\nitro5x\nitro5x.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Metrics] C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe a
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [50ro7l87] C:\WINDOWS\System32\50ro7l87.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Startup: LifeDrive™ Manager.lnk = C:\Program Files\palmOne\LifeDriveMgrTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.9.3.39/bingo/bingoe-en_US.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www104.coolsavings.com/download/cscmv5X.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://encarta.msn.com/encnet/external/MSSurVid.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

BC AdBot (Login to Remove)

 


m

#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:07:49 PM

Posted 01 August 2007 - 10:03 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum figman :thumbsup:
My name is Richie and i'll be helping you to fix your problems.

Please download Combofix and save to your desktop:
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window while it's running.
That may cause the program to freeze/hang.


Also post a new Hijackthis log.
Posted Image
Posted Image

#3 figman

figman
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:49 PM

Posted 04 August 2007 - 12:02 PM

Thanks Richie, your help is much appreciated. Here is the info you requested:

ComboFix 07-08-04.3 - "Figman" 2007-08-04 10:45:12.1 [GMT -6:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Figman\APPLIC~1.\macromedia\Flash Player\#SharedObjects\X25EYGEH\www.broadcaster.com
C:\DOCUME~1\Figman\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\Figman\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\DOCUME~1\Figman\Desktop.\internet explorer.lnk
C:\Program Files\screensavers.com
C:\Program Files\screensavers.com\SSSInst\bin\SSSUninst.exe
C:\Program Files\screensavers.com\Wallpaper\Magic - The Gathering - Gravestorm.jpg
C:\Program Files\screensavers.com\Wallpaper\swpstart.exe
C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CORE
-------\core


((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))


2007-08-04 10:43 51,200 --a--c--- C:\WINDOWS\nircmd.exe
2007-07-13 22:21 <DIR> d----c--- C:\Program Files\Windows Media Connect 2
2007-07-13 22:17 <DIR> d----c--- C:\WINDOWS\system32\drivers\UMDF


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 20:49 1848 --a--c--- C:\WINDOWS\system32\d3d8caps.dat
2007-07-18 19:07 --------- d----c--- C:\DOCUME~1\Figman\APPLIC~1\Aventail
2007-07-01 15:08 --------- d----c--- C:\DOCUME~1\Figman\APPLIC~1\BitTorrent
2007-06-23 10:51 --------- d----c--- C:\DOCUME~1\Figman\APPLIC~1\AdobeAUM
2007-06-19 19:48 --------- d----c--- C:\DOCUME~1\Figman\APPLIC~1\AdobeUM
2007-06-17 22:49 --------- d----c--- C:\Program Files\Freeze.com
2007-06-11 18:53 2966 --a--c--- C:\WINDOWS\system32\tmp.reg
2007-05-16 09:12 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 09:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 09:12 683520 --a--c--- C:\WINDOWS\system32\inetcomm.dll
2007-05-16 09:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 09:12 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 09:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-04 06:29 3058688 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll
2005-07-15 23:46 774144 --a--c--- C:\Program Files\RngInterstitial.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nitro5x"="c:\nitro5x\nitro5x.exe" []
"PCTVOICE"="pctspk.exe" [2003-04-24 20:15 C:\WINDOWS\system32\pctspk.exe]
"PV92TRAY"="PV92Tray.exe" [2003-04-24 20:35 C:\WINDOWS\system32\PV92Tray.exe]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-05-04 01:21]
"HPHUPD05"="C:\Program Files\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2004-03-31 22:34]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2004-05-04 16:17]
"HP Metrics"="C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe" [2004-01-16 14:11]
"Media Gateway"="C:\Program Files\Media Gateway\MediaGateway.exe" []
"50ro7l87"="C:\WINDOWS\System32\50ro7l87.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-16 21:51]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-04-05 15:41]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 19:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2005-03-02 20:19]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-03-18 21:28]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-13 22:36]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-17 20:10]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 09:42]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-06-16 14:38]
"Creative Detector"="D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 17:49]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-03-01 17:11]

C:\Documents and Settings\Figman\Start Menu\Programs\Startup\
LifeDriveT Manager.lnk - C:\Program Files\palmOne\LifeDriveMgrTray.exe [2005-04-21 16:05:06]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
DataViz Inc Messenger.lnk - C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe [2005-10-28 00:19:34]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 14:16:08]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-03-15 20:08:06]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-03-15 20:45:34]

R1 MPFIREWL;MPFIREWL;C:\WINDOWS\system32\Drivers\MpFirewall.sys
R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
R3 admjoy;Aureal Game Port Enumerator;C:\WINDOWS\system32\DRIVERS\admjoy.sys
R3 mf;mf;C:\WINDOWS\system32\DRIVERS\mf.sys
R3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
R3 perm2;perm2;C:\WINDOWS\system32\DRIVERS\perm2.sys
R3 USBCM;Scientific-Atlanta USB Cable Modem Driver;C:\WINDOWS\system32\DRIVERS\Sacm2A.sys
R3 wdm_au8820;Aureal Vortex 8820 Audio Driver (WDM);C:\WINDOWS\system32\drivers\adm8820.sys
S3 HPUATA;HP CD Writer Plus Controller Driver;C:\WINDOWS\system32\DRIVERS\HPUATA.sys
S3 PalmUSBD;PalmUSBD;C:\WINDOWS\system32\drivers\PalmUSBD.sys
S3 wandrv;WAN Network Driver;C:\WINDOWS\system32\DRIVERS\wandrv.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


Contents of the 'Scheduled Tasks' folder
2007-08-03 02:27:05 C:\WINDOWS\Tasks\HP Usg Daily.job
2007-08-04 16:57:28 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (COMPUTERUSER-Figman).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe
2007-07-14 05:34:00 C:\WINDOWS\Tasks\WebReg 20051001233442.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 10:56:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000228

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 11:02:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-04 11:01

--- E O F ---





Logfile of HijackThis v1.99.1
Scan saved at 11:04:25 AM, on 8/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\HPZipm12.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\notepad.exe
D:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Nitro5x] c:\nitro5x\nitro5x.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Metrics] C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe a
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [50ro7l87] C:\WINDOWS\System32\50ro7l87.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Startup: LifeDrive™ Manager.lnk = C:\Program Files\palmOne\LifeDriveMgrTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.9.3.39/bingo/bingoe-en_US.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www104.coolsavings.com/download/cscmv5X.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://encarta.msn.com/encnet/external/MSSurVid.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:07:49 PM

Posted 04 August 2007 - 01:39 PM

Download\install 'SuperAntiSpyware Home Edition Free Version' from here:
http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

Launch SuperAntiSpyware and click on 'Check for updates'.
Once the updates have been installed,exit SuperAntiSpyware.

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [50ro7l87] C:\WINDOWS\System32\50ro7l87.exe
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www104.coolsavings.com/download/cscmv5X.cab

Exit Hijackthis.

Find and delete if present:
C:\Program Files\Media Gateway

Start SuperAntiSpyware.
On the main screen click on 'Scan your computer'.
Check: 'Perform Complete Scan'.
Click 'Next' to start the scan.

Superantispyware will now scan your computer,when it's finished it will list all/any infections found.
Make sure everything found has a checkmark next to it,then press 'Next'.
Click on 'Finish' when you've done.

It's possible that the program will ask you to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
Click on 'Preferences'.
Click on the 'Statistics/Logs' tab.
Under 'Scanner Logs' double click on 'SuperAntiSpyware Scan Log'.
It will then open in your default text editor,such as Notepad.
Copy and paste the contents of that report into your next reply.
Also post a new Hijackthis log,let me know how your pc is running now.

Posted Image
Posted Image

#5 figman

figman
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:49 PM

Posted 05 August 2007 - 11:24 AM

I am pleased to report that my popups have disappeared. Here are the logs, if you happen to see anything else please let me know:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/04/2007 at 04:48 PM

Application Version : 3.9.1008

Core Rules Database Version : 3279
Trace Rules Database Version: 1290

Scan type : Complete Scan
Total Scan Time : 02:47:35

Memory items scanned : 550
Memory threats detected : 0
Registry items scanned : 4893
Registry threats detected : 124
File items scanned : 41862
File threats detected : 230

Adware.Tracking Cookie
C:\Documents and Settings\Figman\Cookies\figman@ad.xplusone[2].txt
C:\Documents and Settings\Figman\Cookies\figman@smileycentral[2].txt
C:\Documents and Settings\Figman\Cookies\figman@78221172[2].txt
C:\Documents and Settings\Figman\Cookies\figman@msnportal.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@atdmt[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adrevolver[3].txt
C:\Documents and Settings\Figman\Cookies\figman@cgi-bin[2].txt
C:\Documents and Settings\Figman\Cookies\figman@feeds.pornication[1].txt
C:\Documents and Settings\Figman\Cookies\figman@feeds.directsex[2].txt
C:\Documents and Settings\Figman\Cookies\figman@ads3.blastro[1].txt
C:\Documents and Settings\Figman\Cookies\figman@3.adbrite[2].txt
C:\Documents and Settings\Figman\Cookies\figman@partner2profit[2].txt
C:\Documents and Settings\Figman\Cookies\figman@mms[1].txt
C:\Documents and Settings\Figman\Cookies\figman@webpower[1].txt
C:\Documents and Settings\Figman\Cookies\figman@exitexchange[2].txt
C:\Documents and Settings\Figman\Cookies\figman@qksrv[2].txt
C:\Documents and Settings\Figman\Cookies\figman@ad2.adnetinteractive[2].txt
C:\Documents and Settings\Figman\Cookies\figman@ads2.blastro[1].txt
C:\Documents and Settings\Figman\Cookies\figman@electronicarts.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@buycom.122.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@bluestreak[1].txt
C:\Documents and Settings\Figman\Cookies\figman@image.masterstats[1].txt
C:\Documents and Settings\Figman\Cookies\figman@entrepreneur[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ehg-zoom.hitbox[1].txt
C:\Documents and Settings\Figman\Cookies\figman@list[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ehg-comcast.hitbox[1].txt
C:\Documents and Settings\Figman\Cookies\figman@www.burstnet[1].txt
C:\Documents and Settings\Figman\Cookies\figman@click.payserve[1].txt
C:\Documents and Settings\Figman\Cookies\figman@adopt.euroclick[2].txt
C:\Documents and Settings\Figman\Cookies\figman@revenuegateway.directtrack[2].txt
C:\Documents and Settings\Figman\Cookies\figman@revsci[1].txt
C:\Documents and Settings\Figman\Cookies\figman@questionmarket[2].txt
C:\Documents and Settings\Figman\Cookies\figman@hotlog[2].txt
C:\Documents and Settings\Figman\Cookies\figman@anad.tacoda[1].txt
C:\Documents and Settings\Figman\Cookies\figman@anat.tacoda[2].txt
C:\Documents and Settings\Figman\Cookies\figman@advertising[1].txt
C:\Documents and Settings\Figman\Cookies\figman@keywordmax[1].txt
C:\Documents and Settings\Figman\Cookies\figman@apmebf[2].txt
C:\Documents and Settings\Figman\Cookies\figman@keomarketing.122.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@primedia.us.intellitxt[1].txt
C:\Documents and Settings\Figman\Cookies\figman@yadro[1].txt
C:\Documents and Settings\Figman\Cookies\figman@valueclick[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad1.clickhype[1].txt
C:\Documents and Settings\Figman\Cookies\figman@burstnet[2].txt
C:\Documents and Settings\Figman\Cookies\figman@coolsavings[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ads.adbrite[1].txt
C:\Documents and Settings\Figman\Cookies\figman@dealtime[2].txt
C:\Documents and Settings\Figman\Cookies\figman@findwhat[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ads4.blastro[1].txt
C:\Documents and Settings\Figman\Cookies\figman@adserver3.teracent[1].txt
C:\Documents and Settings\Figman\Cookies\figman@trafficmp[2].txt
C:\Documents and Settings\Figman\Cookies\figman@stat.dealtime[1].txt
C:\Documents and Settings\Figman\Cookies\figman@interclick[1].txt
C:\Documents and Settings\Figman\Cookies\figman@banners.guns[1].txt
C:\Documents and Settings\Figman\Cookies\figman@perf.overture[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad.yieldmanager[2].txt
C:\Documents and Settings\Figman\Cookies\figman@overture[1].txt
C:\Documents and Settings\Figman\Cookies\figman@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@adecn[1].txt
C:\Documents and Settings\Figman\Cookies\figman@entrepreneur.122.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@teenieboppers.xamocontent[2].txt
C:\Documents and Settings\Figman\Cookies\figman@cpvfeed[2].txt
C:\Documents and Settings\Figman\Cookies\figman@data3.perf.overture[1].txt
C:\Documents and Settings\Figman\Cookies\figman@pch.122.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@17859531[2].txt
C:\Documents and Settings\Figman\Cookies\figman@login.tracking101[1].txt
C:\Documents and Settings\Figman\Cookies\figman@sextracker[1].txt
C:\Documents and Settings\Figman\Cookies\figman@2o7[2].txt
C:\Documents and Settings\Figman\Cookies\figman@tacoda[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ads.monster[1].txt
C:\Documents and Settings\Figman\Cookies\figman@counter1.sextracker[1].txt
C:\Documents and Settings\Figman\Cookies\figman@brightcove.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@cupolaventures.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad.creafi[2].txt
C:\Documents and Settings\Figman\Cookies\figman@onetoone.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ads.pointroll[2].txt
C:\Documents and Settings\Figman\Cookies\figman@tremor.adbureau[2].txt
C:\Documents and Settings\Figman\Cookies\figman@zedo[2].txt
C:\Documents and Settings\Figman\Cookies\figman@hitbox[1].txt
C:\Documents and Settings\Figman\Cookies\figman@cgi-bin[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad.uolmg[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adserver[1].txt
C:\Documents and Settings\Figman\Cookies\figman@bs.serving-sys[2].txt
C:\Documents and Settings\Figman\Cookies\figman@statcounter[1].txt
C:\Documents and Settings\Figman\Cookies\figman@edge.ru4[2].txt
C:\Documents and Settings\Figman\Cookies\figman@29572143[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adlegend[1].txt
C:\Documents and Settings\Figman\Cookies\figman@revenue[1].txt
C:\Documents and Settings\Figman\Cookies\figman@mediaplex[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adultfriendfinder[2].txt
C:\Documents and Settings\Figman\Cookies\figman@serving-sys[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad[1].txt
C:\Documents and Settings\Figman\Cookies\figman@www.teen-flicks[1].txt
C:\Documents and Settings\Figman\Cookies\figman@azjmp[1].txt
C:\Documents and Settings\Figman\Cookies\figman@realmedia[2].txt
C:\Documents and Settings\Figman\Cookies\figman@1072565089[1].txt
C:\Documents and Settings\Figman\Cookies\figman@shopping.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@www.burstbeacon[1].txt
C:\Documents and Settings\Figman\Cookies\figman@try.starware[1].txt
C:\Documents and Settings\Figman\Cookies\figman@lynxtrack[1].txt
C:\Documents and Settings\Figman\Cookies\figman@realnetworks.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@adbrite[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ehg-ifilm.hitbox[2].txt
C:\Documents and Settings\Figman\Cookies\figman@4.adbrite[2].txt
C:\Documents and Settings\Figman\Cookies\figman@audit.median[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ads.addynamix[2].txt
C:\Documents and Settings\Figman\Cookies\figman@server.iad.liveperson[2].txt
C:\Documents and Settings\Figman\Cookies\figman@doubleclick[1].txt
C:\Documents and Settings\Figman\Cookies\figman@specificclick[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adopt.specificclick[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adrevolver[1].txt
C:\Documents and Settings\Figman\Cookies\figman@tribalfusion[2].txt
C:\Documents and Settings\Figman\Cookies\figman@fastclick[1].txt
C:\Documents and Settings\Figman\Cookies\figman@stats[1].txt
C:\Documents and Settings\Figman\Cookies\figman@spylog[2].txt
C:\Documents and Settings\Figman\Cookies\figman@adserver.easyad[2].txt
C:\Documents and Settings\Figman\Cookies\figman@ad.directanetworks[2].txt
C:\Documents and Settings\Figman\Cookies\figman@casalemedia[1].txt
C:\Documents and Settings\Figman\Cookies\figman@ad.adnetinteractive[2].txt
C:\Documents and Settings\Figman\Cookies\figman@clicktorrent[2].txt
C:\Documents and Settings\Figman\Cookies\figman@pro-market[2].txt
C:\Documents and Settings\Figman\Cookies\figman@onlinerewardcenter[2].txt
C:\Documents and Settings\Figman\Cookies\figman@MobileRingDownloads[2].txt
C:\Documents and Settings\Figman\Cookies\figman@h.starware[2].txt
C:\Documents and Settings\Figman\Cookies\figman@ehg-cardomain.hitbox[1].txt
C:\Documents and Settings\Figman\Cookies\figman@amsterdamlivexxx[2].txt
C:\Documents and Settings\Figman\Cookies\figman@buzznet.112.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@phhmortgage.122.2o7[1].txt
C:\Documents and Settings\Figman\Cookies\figman@adserving.cpxinteractive[2].txt
C:\Documents and Settings\Figman\Cookies\figman@goclick[1].txt
C:\Documents and Settings\Figman\Cookies\figman@hit[1].txt
C:\Documents and Settings\Figman\Cookies\figman@directtrack[1].txt
C:\Documents and Settings\Figman\Cookies\figman@statse.webtrendslive[1].txt
C:\Documents and Settings\Neez\Cookies\neez@2o7[2].txt
C:\Documents and Settings\Neez\Cookies\neez@ad.yieldmanager[2].txt
C:\Documents and Settings\Neez\Cookies\neez@adbrite[1].txt
C:\Documents and Settings\Neez\Cookies\neez@adopt.specificclick[1].txt
C:\Documents and Settings\Neez\Cookies\neez@adrevolver[2].txt
C:\Documents and Settings\Neez\Cookies\neez@adrevolver[3].txt
C:\Documents and Settings\Neez\Cookies\neez@ads.adbrite[1].txt
C:\Documents and Settings\Neez\Cookies\neez@ads.pointroll[2].txt
C:\Documents and Settings\Neez\Cookies\neez@adultmovienetwork[1].txt
C:\Documents and Settings\Neez\Cookies\neez@advertising[1].txt
C:\Documents and Settings\Neez\Cookies\neez@apmebf[1].txt
C:\Documents and Settings\Neez\Cookies\neez@atdmt[1].txt
C:\Documents and Settings\Neez\Cookies\neez@ath.belnk[2].txt
C:\Documents and Settings\Neez\Cookies\neez@atwola[1].txt
C:\Documents and Settings\Neez\Cookies\neez@azjmp[2].txt
C:\Documents and Settings\Neez\Cookies\neez@belnk[1].txt
C:\Documents and Settings\Neez\Cookies\neez@bluestreak[1].txt
C:\Documents and Settings\Neez\Cookies\neez@burstnet[2].txt
C:\Documents and Settings\Neez\Cookies\neez@c1.zedo[1].txt
C:\Documents and Settings\Neez\Cookies\neez@casalemedia[1].txt
C:\Documents and Settings\Neez\Cookies\neez@citi.bridgetrack[1].txt
C:\Documents and Settings\Neez\Cookies\neez@coolsavings[1].txt
C:\Documents and Settings\Neez\Cookies\neez@csavings.adbureau[2].txt
C:\Documents and Settings\Neez\Cookies\neez@cts.metricsdirect[2].txt
C:\Documents and Settings\Neez\Cookies\neez@dist.belnk[2].txt
C:\Documents and Settings\Neez\Cookies\neez@doubleclick[1].txt
C:\Documents and Settings\Neez\Cookies\neez@edge.ru4[2].txt
C:\Documents and Settings\Neez\Cookies\neez@ehg-cbs.hitbox[2].txt
C:\Documents and Settings\Neez\Cookies\neez@fastclick[2].txt
C:\Documents and Settings\Neez\Cookies\neez@focalex[2].txt
C:\Documents and Settings\Neez\Cookies\neez@h.starware[2].txt
C:\Documents and Settings\Neez\Cookies\neez@hitbox[1].txt
C:\Documents and Settings\Neez\Cookies\neez@icc.intellisrv[2].txt
C:\Documents and Settings\Neez\Cookies\neez@indextools[1].txt
C:\Documents and Settings\Neez\Cookies\neez@login.tracking101[1].txt
C:\Documents and Settings\Neez\Cookies\neez@lsfnetwork.122.2o7[1].txt
C:\Documents and Settings\Neez\Cookies\neez@mediaplex[1].txt
C:\Documents and Settings\Neez\Cookies\neez@metareward[1].txt
C:\Documents and Settings\Neez\Cookies\neez@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Neez\Cookies\neez@msnportal.112.2o7[1].txt
C:\Documents and Settings\Neez\Cookies\neez@nbads[2].txt
C:\Documents and Settings\Neez\Cookies\neez@nextag[1].txt
C:\Documents and Settings\Neez\Cookies\neez@pch.122.2o7[1].txt
C:\Documents and Settings\Neez\Cookies\neez@perf.overture[1].txt
C:\Documents and Settings\Neez\Cookies\neez@pornotube[1].txt
C:\Documents and Settings\Neez\Cookies\neez@publishers.clickbooth[2].txt
C:\Documents and Settings\Neez\Cookies\neez@qksrv[1].txt
C:\Documents and Settings\Neez\Cookies\neez@questionmarket[2].txt
C:\Documents and Settings\Neez\Cookies\neez@realmedia[2].txt
C:\Documents and Settings\Neez\Cookies\neez@regalinteractive[1].txt
C:\Documents and Settings\Neez\Cookies\neez@revenue[1].txt
C:\Documents and Settings\Neez\Cookies\neez@revsci[2].txt
C:\Documents and Settings\Neez\Cookies\neez@roiservice[2].txt
C:\Documents and Settings\Neez\Cookies\neez@sav.coolsavings[1].txt
C:\Documents and Settings\Neez\Cookies\neez@server.iad.liveperson[2].txt
C:\Documents and Settings\Neez\Cookies\neez@serving-sys[2].txt
C:\Documents and Settings\Neez\Cookies\neez@shortmedia.us.intellitxt[1].txt
C:\Documents and Settings\Neez\Cookies\neez@skilljam.advertserve[1].txt
C:\Documents and Settings\Neez\Cookies\neez@statse.webtrendslive[1].txt
C:\Documents and Settings\Neez\Cookies\neez@tacoda[2].txt
C:\Documents and Settings\Neez\Cookies\neez@trafficmp[1].txt
C:\Documents and Settings\Neez\Cookies\neez@tribalfusion[2].txt
C:\Documents and Settings\Neez\Cookies\neez@try.starware[1].txt
C:\Documents and Settings\Neez\Cookies\neez@valueclick[1].txt
C:\Documents and Settings\Neez\Cookies\neez@ww3.shoshkeles[1].txt
C:\Documents and Settings\Neez\Cookies\neez@www.burstbeacon[1].txt
C:\Documents and Settings\Neez\Cookies\neez@www.burstnet[2].txt
C:\Documents and Settings\Neez\Cookies\neez@www.rowise[2].txt
C:\Documents and Settings\Neez\Cookies\neez@z1.adserver[2].txt
C:\Documents and Settings\Neez\Cookies\neez@zedo[2].txt

Adware.180solutions/Search Assistant
HKCR\MediaGateway.Installer
HKCR\MediaGateway.Installer\CLSID
HKCR\MediaGateway.Installer\CurVer
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}#AppID
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\Implemented Categories
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\LocalServer32
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\ProgID
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\Programmable
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\TypeLib
HKCR\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C}\VersionIndependentProgID
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MediaGatewayX.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MediaGatewayX.dll#.Owner
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MediaGatewayX.dll#{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs#C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll [  ]

Adware.Media Access
HKCR\AppId\{735C5A0C-F79F-47A1-8CA1-2A2E482662A8}
HKCR\Interface\{00ADA225-EA6C-4FB3-82E8-68189201CCB9}
HKCR\Interface\{00ADA225-EA6C-4FB3-82E8-68189201CCB9}\ProxyStubClsid
HKCR\Interface\{00ADA225-EA6C-4FB3-82E8-68189201CCB9}\ProxyStubClsid32
HKCR\Interface\{00ADA225-EA6C-4FB3-82E8-68189201CCB9}\TypeLib
HKCR\Interface\{00ADA225-EA6C-4FB3-82E8-68189201CCB9}\TypeLib#Version
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}\1.0
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}\1.0\0
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}\1.0\0\win32
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}\1.0\FLAGS
HKCR\TypeLib\{15696AE2-6EA4-47F4-BEA6-A3D32693EFC7}\1.0\HELPDIR

Malware.SpyLocked
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}\1.0
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}\1.0\0
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}\1.0\0\win32
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}\1.0\FLAGS
HKCR\TypeLib\{1E033191-2D29-4E24-89E9-1DD85EA75078}\1.0\HELPDIR
HKCR\Interface\{05061FBD-4124-4EAE-BEFE-B844303A2D74}
HKCR\Interface\{05061FBD-4124-4EAE-BEFE-B844303A2D74}\ProxyStubClsid
HKCR\Interface\{05061FBD-4124-4EAE-BEFE-B844303A2D74}\ProxyStubClsid32
HKCR\Interface\{05061FBD-4124-4EAE-BEFE-B844303A2D74}\TypeLib
HKCR\Interface\{05061FBD-4124-4EAE-BEFE-B844303A2D74}\TypeLib#Version
HKCR\Interface\{0D0E7125-9728-40AC-9FC1-CA3C26A0E9AC}
HKCR\Interface\{0D0E7125-9728-40AC-9FC1-CA3C26A0E9AC}\ProxyStubClsid
HKCR\Interface\{0D0E7125-9728-40AC-9FC1-CA3C26A0E9AC}\ProxyStubClsid32
HKCR\Interface\{0D0E7125-9728-40AC-9FC1-CA3C26A0E9AC}\TypeLib
HKCR\Interface\{0D0E7125-9728-40AC-9FC1-CA3C26A0E9AC}\TypeLib#Version
HKCR\Interface\{17DA0ADA-D080-476A-8A32-29961B3145DA}
HKCR\Interface\{17DA0ADA-D080-476A-8A32-29961B3145DA}\ProxyStubClsid
HKCR\Interface\{17DA0ADA-D080-476A-8A32-29961B3145DA}\ProxyStubClsid32
HKCR\Interface\{17DA0ADA-D080-476A-8A32-29961B3145DA}\TypeLib
HKCR\Interface\{17DA0ADA-D080-476A-8A32-29961B3145DA}\TypeLib#Version
HKCR\Interface\{27E4B73F-3C78-4463-888D-AE36C6F3ABFC}
HKCR\Interface\{27E4B73F-3C78-4463-888D-AE36C6F3ABFC}\ProxyStubClsid
HKCR\Interface\{27E4B73F-3C78-4463-888D-AE36C6F3ABFC}\ProxyStubClsid32
HKCR\Interface\{27E4B73F-3C78-4463-888D-AE36C6F3ABFC}\TypeLib
HKCR\Interface\{27E4B73F-3C78-4463-888D-AE36C6F3ABFC}\TypeLib#Version
HKCR\Interface\{3EEC58B4-FE87-4885-AE8A-B19E7454BD03}
HKCR\Interface\{3EEC58B4-FE87-4885-AE8A-B19E7454BD03}\ProxyStubClsid
HKCR\Interface\{3EEC58B4-FE87-4885-AE8A-B19E7454BD03}\ProxyStubClsid32
HKCR\Interface\{3EEC58B4-FE87-4885-AE8A-B19E7454BD03}\TypeLib
HKCR\Interface\{3EEC58B4-FE87-4885-AE8A-B19E7454BD03}\TypeLib#Version
HKCR\Interface\{3F0B05B7-FD07-43A3-82CA-8DD6C75363D7}
HKCR\Interface\{3F0B05B7-FD07-43A3-82CA-8DD6C75363D7}\ProxyStubClsid
HKCR\Interface\{3F0B05B7-FD07-43A3-82CA-8DD6C75363D7}\ProxyStubClsid32
HKCR\Interface\{3F0B05B7-FD07-43A3-82CA-8DD6C75363D7}\TypeLib
HKCR\Interface\{3F0B05B7-FD07-43A3-82CA-8DD6C75363D7}\TypeLib#Version
HKCR\Interface\{4EDB0354-F87D-4C60-B5F8-B09D30247BF3}
HKCR\Interface\{4EDB0354-F87D-4C60-B5F8-B09D30247BF3}\ProxyStubClsid
HKCR\Interface\{4EDB0354-F87D-4C60-B5F8-B09D30247BF3}\ProxyStubClsid32
HKCR\Interface\{4EDB0354-F87D-4C60-B5F8-B09D30247BF3}\TypeLib
HKCR\Interface\{4EDB0354-F87D-4C60-B5F8-B09D30247BF3}\TypeLib#Version
HKCR\Interface\{62DDEE51-44C6-44F9-B8CC-CC85C7BDD54D}
HKCR\Interface\{62DDEE51-44C6-44F9-B8CC-CC85C7BDD54D}\ProxyStubClsid
HKCR\Interface\{62DDEE51-44C6-44F9-B8CC-CC85C7BDD54D}\ProxyStubClsid32
HKCR\Interface\{62DDEE51-44C6-44F9-B8CC-CC85C7BDD54D}\TypeLib
HKCR\Interface\{62DDEE51-44C6-44F9-B8CC-CC85C7BDD54D}\TypeLib#Version
HKCR\Interface\{71FBB0FF-3295-4435-966D-C966DC86DC18}
HKCR\Interface\{71FBB0FF-3295-4435-966D-C966DC86DC18}\ProxyStubClsid
HKCR\Interface\{71FBB0FF-3295-4435-966D-C966DC86DC18}\ProxyStubClsid32
HKCR\Interface\{71FBB0FF-3295-4435-966D-C966DC86DC18}\TypeLib
HKCR\Interface\{71FBB0FF-3295-4435-966D-C966DC86DC18}\TypeLib#Version
HKCR\Interface\{7578BE5C-0F58-4914-A8E4-6446A94FA82B}
HKCR\Interface\{7578BE5C-0F58-4914-A8E4-6446A94FA82B}\ProxyStubClsid
HKCR\Interface\{7578BE5C-0F58-4914-A8E4-6446A94FA82B}\ProxyStubClsid32
HKCR\Interface\{7578BE5C-0F58-4914-A8E4-6446A94FA82B}\TypeLib
HKCR\Interface\{7578BE5C-0F58-4914-A8E4-6446A94FA82B}\TypeLib#Version
HKCR\Interface\{8B317816-B6CD-4F56-88D8-02FA916C5C54}
HKCR\Interface\{8B317816-B6CD-4F56-88D8-02FA916C5C54}\ProxyStubClsid
HKCR\Interface\{8B317816-B6CD-4F56-88D8-02FA916C5C54}\ProxyStubClsid32
HKCR\Interface\{8B317816-B6CD-4F56-88D8-02FA916C5C54}\TypeLib
HKCR\Interface\{8B317816-B6CD-4F56-88D8-02FA916C5C54}\TypeLib#Version
HKCR\Interface\{9AF243AF-0FBF-4FD8-9D12-0442BE49D64B}
HKCR\Interface\{9AF243AF-0FBF-4FD8-9D12-0442BE49D64B}\ProxyStubClsid
HKCR\Interface\{9AF243AF-0FBF-4FD8-9D12-0442BE49D64B}\ProxyStubClsid32
HKCR\Interface\{9AF243AF-0FBF-4FD8-9D12-0442BE49D64B}\TypeLib
HKCR\Interface\{9AF243AF-0FBF-4FD8-9D12-0442BE49D64B}\TypeLib#Version
HKCR\Interface\{9D01BC12-D61A-4828-AA88-A4FFFC393C0D}
HKCR\Interface\{9D01BC12-D61A-4828-AA88-A4FFFC393C0D}\ProxyStubClsid
HKCR\Interface\{9D01BC12-D61A-4828-AA88-A4FFFC393C0D}\ProxyStubClsid32
HKCR\Interface\{9D01BC12-D61A-4828-AA88-A4FFFC393C0D}\TypeLib
HKCR\Interface\{9D01BC12-D61A-4828-AA88-A4FFFC393C0D}\TypeLib#Version
HKCR\Interface\{A8870ADF-5E61-44B9-A443-439BC30CE341}
HKCR\Interface\{A8870ADF-5E61-44B9-A443-439BC30CE341}\ProxyStubClsid
HKCR\Interface\{A8870ADF-5E61-44B9-A443-439BC30CE341}\ProxyStubClsid32
HKCR\Interface\{A8870ADF-5E61-44B9-A443-439BC30CE341}\TypeLib
HKCR\Interface\{A8870ADF-5E61-44B9-A443-439BC30CE341}\TypeLib#Version
HKCR\Interface\{D8F9E49E-80BE-4BD8-8EFE-3124228105DC}
HKCR\Interface\{D8F9E49E-80BE-4BD8-8EFE-3124228105DC}\ProxyStubClsid
HKCR\Interface\{D8F9E49E-80BE-4BD8-8EFE-3124228105DC}\ProxyStubClsid32
HKCR\Interface\{D8F9E49E-80BE-4BD8-8EFE-3124228105DC}\TypeLib
HKCR\Interface\{D8F9E49E-80BE-4BD8-8EFE-3124228105DC}\TypeLib#Version
HKCR\Interface\{E92E6F2D-2CA1-4B39-BBAA-D685F4A0FB40}
HKCR\Interface\{E92E6F2D-2CA1-4B39-BBAA-D685F4A0FB40}\ProxyStubClsid
HKCR\Interface\{E92E6F2D-2CA1-4B39-BBAA-D685F4A0FB40}\ProxyStubClsid32
HKCR\Interface\{E92E6F2D-2CA1-4B39-BBAA-D685F4A0FB40}\TypeLib
HKCR\Interface\{E92E6F2D-2CA1-4B39-BBAA-D685F4A0FB40}\TypeLib#Version

Trojan.Media-Codec/V2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Protection Volume
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Protection Volume#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Protection Volume#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Plug-in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Plug-in#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Plug-in#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Messenger
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Messenger#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Messenger#UninstallString

Trojan.Rootkit-TnCore/Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{AC1A5C8A-DCF4-4F02-918B-0959E15184D8}\RP426\A0068797.EXE

Trojan.Rootkit-TnCore
C:\SYSTEM VOLUME INFORMATION\_RESTORE{AC1A5C8A-DCF4-4F02-918B-0959E15184D8}\RP428\A0069931.SYS

Trace.Known Threat Sources
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\A129OZCD\mid[1].jpg
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\lp.zango[1]
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\control_body_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\top[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\A129OZCD\control_header_box_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\A129OZCD\right[2].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\control_image1_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\control_bg_tile_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\spacer[2].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\spacer[7].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\contain_zango_games[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\validpic[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\BID6676[1]
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\lp.zango[1]
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\control_logo_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\A129OZCD\mbox[1].js
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\control_cta1_brix[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\lp.zango[1]
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\BID6741[1]
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\contain_image4_wind[1].jpg
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\47MEREFT\contain_logo_wind[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\contain_body_wind[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\IRU3GB0Z\contain_content_bottom[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\bot[1].gif
C:\Documents and Settings\Neez\Local Settings\Temporary Internet Files\Content.IE5\MEL5H8RH\ZangoDetectScript[1].js








Logfile of HijackThis v1.99.1
Scan saved at 10:28:46 AM, on 8/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\BitTorrent\bittorrent.exe
D:\Program Files\super spy\SUPERAntiSpyware.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
D:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Nitro5x] c:\nitro5x\nitro5x.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Metrics] C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe a
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\super spy\SUPERAntiSpyware.exe
O4 - Startup: LifeDrive™ Manager.lnk = C:\Program Files\palmOne\LifeDriveMgrTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: EZ Win Bingo by pogo - http://game1.pogo.com/applet-6.9.3.39/bingo/bingoe-en_US.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://encarta.msn.com/encnet/external/MSSurVid.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\super spy\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

#6 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:07:49 PM

Posted 05 August 2007 - 03:18 PM

You have Mcafee and Avast4 Antivirus installed.
Not a good idea to have more than one antivirus program installed on your computer.
Each program may interpret the actions of the other as viral, therefore giving you false virus warnings about virus-related activities.
It could also lead to system slowdowns and other problems within the operating system,due to the two conflicting with each other.
You should uninstall one or the other as soon as possible,then restart your pc.

------------------------------------------------

Your log is clean :thumbsup:
If all's ok,please do the following.

Find and delete:
Combofix.exe
C:\QooBox
C:\Program Files\Freeze.com

Download ATF Cleaner by Atribune:
http://www.atribune.org/ccount/click.php?id=1

Double-click ATF-Cleaner.exe to run the program.
Click 'Select All' found at the bottom of the list.
Click the 'Empty Selected' button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

If you use Opera browser,do this also:
Click Opera at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

Click 'Exit' on the Main menu to close the program.

-------------------------------------------------

Click on Start/All Programs/Accessories/System Tools/System Restore.
In the 'System Restore' window,click on the 'Create a Restore Point' button,then click 'Next'.
In the window that appears,enter a description\name for the Restore Point,then click on 'Create',wait,then click 'Close'.
The date and time will be created automatically.

Next click on Start/All Programs/Accessories/System Tools/Disk Cleanup.
The 'Select Drive' box will appear,click on Ok.
The 'Disk Cleanup for [C:]' box will appear,click on the 'More Options' tab.
At the bottom in the 'System Restore' window,click on the 'Clean up...' button.
A box will pop up 'Are you sure you want to delete all but the most recent restore point?',click on 'Yes'.
Click on 'Yes' at 'Are you sure you want to perform these actions?'.
Now wait until 'Disk Cleanup' finishes and the box disappears.

Read through the information found here,to help you prevent any possible future infections.
'How to prevent Malware' by miekiemoes:
http://users.telenet.be/bluepatchy/miekiem...prevention.html
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users