Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Links Redirected To 101links.com


  • Please log in to reply
9 replies to this topic

#1 markonato

markonato

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 31 October 2007 - 07:59 PM

Hi, as you see in the topic title, my google search links are being redirected to different sites, mostly 101links.com.
I saw you solved the very similar problem successfully, so hope you can help me too.
Here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:56:35 AM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
c:\wamp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetTimer 2000\NetTimer.exe
C:\Program Files\Java\jdk1.6.0\bin\java.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\UltraEdit\UEDIT32.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\ApexDC++\ApexDC.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mv2Player\Mv2PlayerPlus.exe
C:\Yu Recnik\YuRecnik.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HiJackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetTimer 2000] "C:\Program Files\NetTimer 2000\NetTimer.exe"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Desktop (Service_Desktop) - Unknown owner - C:\Program Files\Free-Soft\Virtual Desktop\Desktop.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/you/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 4477 bytes



Thanks in advance.
Marko

BC AdBot (Login to Remove)

 


m

#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:57 PM

Posted 01 November 2007 - 07:16 AM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Please download FixWareout from here:
http://downloads.subratam.org/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts. If your firewall gives an alert, (because this tool will download an additional file from the internet), please don't let your firewall block it, but allow it instead.
Then you will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
Once the desktop loads please post the text that will open (report.txt) and a new Hijackthis log.

#3 markonato

markonato
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 02 November 2007 - 06:46 AM

Hello David, I was away for a day. Here are those two logs:

FixWareout log:

Username "you" - 11/02/2007 12:17:20 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdczc.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{05290346-A25F-4F8D-A14D-0A648FBFDBCE}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{11EA07C5-3D59-49A6-B134-962B79A9DE71}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{202DBB9D-EF34-4EA3-A623-AFBEA9C46F99}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{51666E14-C72D-459E-91F6-090B9DC6CC2D}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{53F765C4-C3CE-4D97-9CE1-ED9B80725A92}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{53FC17F9-B285-4C26-81EE-C177F78BC8B8}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{CDD1676C-D396-48AF-B55D-12868E81052A}
"DhcpNameServer"="85.255.116.85,85.255.112.14" <Value cleared.

Successfully flushed the DNS Resolver Cache.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....


C:\Program Files\XXXPlugin < Found
Additional tools are recommended.

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"UnlockerAssistant"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\" -H"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"NetTimer 2000"="\"C:\\Program Files\\NetTimer 2000\\NetTimer.exe\""
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~



New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:03 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
c:\wamp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetTimer 2000\NetTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetTimer 2000] "C:\Program Files\NetTimer 2000\NetTimer.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Desktop (Service_Desktop) - Unknown owner - C:\Program Files\Free-Soft\Virtual Desktop\Desktop.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/you/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 3649 bytes

Waiting for instructions.
Greetings.
Marko

#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:57 PM

Posted 02 November 2007 - 07:16 AM

Good work Marko, hopefully the redirects will have stopped now.

Please download Combofix to your desktop.
Doubleclick combofix.exe to launch the application.

Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#5 markonato

markonato
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 02 November 2007 - 08:16 AM

Redirecting stopped before running combofix, i googled for a few minutes, and everything was fine. But this used to happen before...and then redirecting again, so i'm not sure yet.
Anyway, new logs:

combofix log:

ComboFix 07-11-01.1 - you 2007-11-02 14:01:06.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.119 [GMT 1:00]
Running from: C:\Documents and Settings\you\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\AVSystemCare
C:\Documents and Settings\you\Application Data.\AVSystemCare
C:\Documents and Settings\you\Application Data.\AVSystemCare\avtasks.dat
C:\Documents and Settings\you\Application Data.\AVSystemCare\Logs\av.log
C:\Documents and Settings\you\Application Data.\AVSystemCare\Logs\ga6Support.log
C:\Documents and Settings\you\Application Data.\AVSystemCare\Logs\update.log
C:\Documents and Settings\you\Application Data.\AVSystemCare\PGE.dat
C:\Documents and Settings\you\ResErrors.log
C:\UGA6P
C:\WINDOWS\system32\pskill.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FMTR
-------\fmtr


((((((((((((((((((((((((( Files Created from 2007-10-02 to 2007-11-02 )))))))))))))))))))))))))))))))
.

2007-11-02 14:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-02 12:26 <DIR> d--hs---- C:\FOUND.017
2007-11-02 00:27 <DIR> d-------- C:\Documents and Settings\you\Application Data\iWin
2007-11-01 23:57 <DIR> d-------- C:\Program Files\Risk
2007-11-01 23:57 <DIR> d-------- C:\Program Files\ReflexiveArcade
2007-11-01 01:55 <DIR> d-------- C:\HijackThis
2007-10-30 17:40 <DIR> d--hs---- C:\FOUND.016
2007-10-28 20:14 <DIR> d-------- C:\Program Files\templates
2007-10-28 20:14 <DIR> d-------- C:\Program Files\Devices
2007-10-28 20:14 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-10-28 20:14 <DIR> d-------- C:\Program Files\CDBurning
2007-10-28 20:14 659,456 --a------ C:\Program Files\dtdr3260.dll
2007-10-28 20:14 655,360 --a------ C:\Program Files\rjbres.dll
2007-10-28 20:14 339,968 --a------ C:\Program Files\rjdlg.dll
2007-10-28 20:14 139,264 --a------ C:\Program Files\DUNZIP32.dll
2007-10-28 20:14 81,920 --a------ C:\Program Files\tsasdk.dll
2007-10-28 20:14 57,344 --a------ C:\Program Files\tpasdk.dll
2007-10-28 20:14 41,472 --a------ C:\Program Files\mmcdda32.dll
2007-10-28 20:14 36,352 --a------ C:\Program Files\ierjplug.dll
2007-10-28 20:14 32,768 --a------ C:\Program Files\rpwa3260.dll
2007-10-28 20:14 19,456 --a------ C:\Program Files\tnetdtct.dll
2007-10-28 20:14 19,456 --a------ C:\Program Files\rjprog.dll
2007-10-28 20:14 14,336 --a------ C:\Program Files\wmdmhelper.dll
2007-10-28 20:14 6,656 --a------ C:\Program Files\fixrjb.exe
2007-10-28 20:13 <DIR> d-------- C:\Program Files\Setup
2007-10-28 20:13 <DIR> d-------- C:\Program Files\rpplugins
2007-10-28 20:13 <DIR> d-------- C:\Program Files\producer
2007-10-28 20:13 <DIR> d-------- C:\Program Files\plugins
2007-10-28 20:13 <DIR> d-------- C:\Program Files\Netscape6
2007-10-28 20:13 <DIR> d-------- C:\Program Files\library
2007-10-28 20:13 <DIR> d-------- C:\Program Files\DataCache
2007-10-28 20:13 <DIR> d-------- C:\Program Files\browserrecord
2007-10-28 20:13 719,360 --a------ C:\Program Files\dbghelp.dll
2007-10-28 20:13 296,312 --a------ C:\Program Files\rpbrowserrecordplugin.dll
2007-10-28 20:13 214,560 --a------ C:\Program Files\realplay.exe
2007-10-28 20:13 152,920 --a------ C:\Program Files\RecordingManager.exe
2007-10-28 20:13 102,400 --a------ C:\Program Files\HXAudioDeviceHook.dll
2007-10-28 20:13 95,552 --a------ C:\Program Files\rdsf3260.dll
2007-10-28 20:13 86,016 --a------ C:\Program Files\rpplugprot.dll
2007-10-28 20:13 65,536 --a------ C:\Program Files\rjwmapln.dll
2007-10-28 20:13 62,776 --a------ C:\Program Files\rpshell.dll
2007-10-28 20:13 53,248 --a------ C:\Program Files\rpau3260.dll
2007-10-28 20:13 42,824 --a------ C:\Program Files\rpshellsearch.dll
2007-10-28 20:13 9,216 --a------ C:\Program Files\rphelperapp.exe
2007-10-28 20:13 7,168 --a------ C:\Program Files\realjbox.exe
2007-10-28 20:13 1,030 --a------ C:\Program Files\autoplaylist.dat
2007-10-28 20:13 480 --a------ C:\Program Files\keys.dat
2007-10-28 20:13 50 --a------ C:\Program Files\strs23.dat
2007-10-28 20:13 13 --a------ C:\Program Files\strs26.dat
2007-10-28 10:41 <DIR> d--hs---- C:\FOUND.015
2007-10-26 13:27 <DIR> d-------- C:\wamp
2007-10-10 12:12 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-03 10:42 <DIR> d-------- C:\Documents and Settings\you\.deploytool
2007-10-03 02:30 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-10-03 02:30 163,840 --a------ C:\WINDOWS\system32\unrar.dll
2007-10-03 02:30 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-10-03 02:28 <DIR> d-------- C:\Program Files\XXXPlugin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-28 19:14 568 ----a-w C:\Program Files\fpsectbl
2007-10-28 19:14 2,851 ----a-w C:\Program Files\cdroms.cfg
2007-10-28 19:14 16,296 ----a-w C:\Program Files\realtfon.fon
2007-10-28 19:14 119,808 ----a-w C:\Program Files\waiting.avi
2007-10-28 19:14 11,444 ----a-w C:\Program Files\frw.bmp
2007-10-28 19:13 994 ----a-w C:\Program Files\browserrecord.swf
2007-10-28 19:13 685 ----a-w C:\Program Files\RecordingManager.exe.manifest
2007-10-28 19:13 682 ----a-w C:\Program Files\realplay.exe.manifest
2007-10-28 19:13 61,495 ----a-w C:\Program Files\ssimages.vs
2007-10-28 19:13 587,888 ----a-w C:\Program Files\normal.vs
2007-10-28 19:13 57,762 ----a-w C:\Program Files\howto.chm
2007-10-28 19:13 53,098 ----a-w C:\Program Files\presets.rnx
2007-10-28 19:13 52,609 ----a-w C:\Program Files\RealNetworks License.html
2007-10-28 19:13 52,609 ----a-w C:\Program Files\playrlic.html
2007-10-28 19:13 50,548 ----a-w C:\Program Files\RealNetworks License.txt
2007-10-28 19:13 50,548 ----a-w C:\Program Files\playrlic.txt
2007-10-28 19:13 27,024 ----a-w C:\Program Files\Readme.html
2007-10-28 19:13 23,558 ----a-w C:\Program Files\freeoffers.ico
2007-10-28 19:13 207 ----a-w C:\Program Files\subscription.rnx
2007-10-28 19:13 201,949 ----a-w C:\Program Files\realplay.chm
2007-10-28 19:13 17,846 ----a-w C:\Program Files\videotest.rm
2007-10-28 19:13 1,211 ----a-w C:\Program Files\flvplay.swf
2007-10-01 17:46 --------- d-----w C:\Program Files\Common Files\Java
2007-10-01 15:03 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-10-01 15:03 299,392 ----a-w C:\WINDOWS\system32\imon.dll
2007-10-01 15:03 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-01 10:18 --------- d-----w C:\Program Files\Alwil Software
2007-10-01 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2007-09-25 23:01 --------- d-----w C:\Program Files\Microsoft Works
2007-09-24 22:02 138,624 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-09-24 20:02 --------- d-----w C:\Program Files\Spyware Terminator
2007-09-24 20:02 --------- d-----w C:\Program Files\Crawler
2007-09-24 20:02 --------- d-----w C:\Documents and Settings\you\Application Data\Spyware Terminator
2007-09-24 20:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2007-09-15 05:44 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-15 05:44 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-09-14 14:08 --------- d-----w C:\Program Files\LegendofAladdin_at
2007-09-13 21:50 --------- d-----w C:\Program Files\Windows Desktop Search
2007-09-13 21:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2007-09-13 21:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-09-13 15:41 275,572,437 ----a-w C:\ICSD.zip
2007-08-22 14:12 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-08-22 14:12 658,944 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-22 14:12 615,424 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-22 14:12 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-22 14:12 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-22 14:12 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-08-22 14:12 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-22 14:12 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-08-22 14:12 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-08-22 14:12 3,058,176 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-22 14:12 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-08-22 14:12 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-22 14:12 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-22 14:12 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-08-22 14:12 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-22 14:12 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-08-22 14:12 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-08-22 14:12 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-08-21 11:30 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2007-08-21 07:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 07:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-09 12:26 20,480 ----a-w C:\WINDOWS\system32\ac3config.exe
2006-04-13 01:05 456 ----a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-04-23 05:24]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-01 16:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-10-28 20:13]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"NetTimer 2000"="C:\Program Files\NetTimer 2000\NetTimer.exe" [2001-09-08 19:32]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^you^Start Menu^Programs^Startup^WampServer.lnk]
path=C:\Documents and Settings\you\Start Menu\Programs\Startup\WampServer.lnk
backup=C:\WINDOWS\pss\WampServer.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^you^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
path=C:\Documents and Settings\you\Start Menu\Programs\Startup\WinMySQLadmin.lnk
backup=C:\WINDOWS\pss\WinMySQLadmin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVSystemCare]
C:\Program Files\AVSystemCare\pgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePicGrabber]
C:\Program Files\FreePicGrabber\ThumbGrab.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"C:\Program Files\ICQLite\ICQLite.exe" -minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
C:\Program Files\ICQ\ICQNet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetTimer 2000]
"C:\Program Files\NetTimer 2000\NetTimer.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]
rundll32.exe "C:\WINDOWS\system32\tsjxrgkj.dll",setvm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
"C:\Program Files\TuneUp Utilities 2004\MemOptimizer.exe" autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uga6pcw]
"C:\PROGRA~1\COMMON~1\AVSYST~1\uga6pcw.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uninstall_CToolbar]
"C:\WINDOWS\Temp\CTun.exe" "/remove"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VaCtrl]
C:\Program Files\VoiceAge\Common\VaCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SQLWriter"=2 (0x2)
"SQLSERVERAGENT"=3 (0x3)
"Netlogon"=3 (0x3)
"MSSQLServerOLAPService"=3 (0x3)
"MSSQLServerADHelper"=3 (0x3)
"MSSQLSERVER"=2 (0x2)
"MSSQL$SQLEXPRESS"=2 (0x2)
"gusvc"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R2 wampmysqld;wampmysqld;c:\wamp\mysql\bin\mysqld-nt.exe --defaults-file=c:\wamp\mysql\my.ini wampmysqld
R3 Intels51;Intel® 536EP Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys
S3 CoachUsb;Coach Digital Camera on USB;C:\WINDOWS\system32\DRIVERS\CoachUsb.sys
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys
S3 Service_Desktop;Desktop;C:\Program Files\Free-Soft\Virtual Desktop\Desktop.exe
S3 SmartKeyDriver;SmartKeyDriver;\??\C:\Program Files\MSI\SmartKey\Smemory.sys
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 wampapache;wampapache;"c:\wamp\apache2\bin\httpd.exe" -k runservice
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80
S4 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{287c144c-797c-11db-9af4-0013d360f96c}]
\Shell\Auto\command - Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-10-12 16:16:16 C:\WINDOWS\Tasks\1-Click Maintenance.job"
"2007-11-02 12:39:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 14:08:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"
--

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
Completion time: 2007-11-02 14:08:45 - machine was rebooted
.
--- E O F ---



New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:13:55 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
c:\wamp\mysql\bin\mysqld-nt.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetTimer 2000\NetTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetTimer 2000] "C:\Program Files\NetTimer 2000\NetTimer.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Desktop (Service_Desktop) - Unknown owner - C:\Program Files\Free-Soft\Virtual Desktop\Desktop.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/you/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 3648 bytes

#6 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:57 PM

Posted 02 November 2007 - 08:36 AM

Ok, let's continue.. :thumbsup:

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uninstall_CToolbar]

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Please delete this folder:
C:\Program Files\XXXPlugin

Please perform this online scan: Kaspersky Webscan
Note that this scanner will only work on Internet Explorer, so please use this browser for the scan.
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.

When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

Also, run HijackThis.
On the first menu, click Open the Misc Tools Section
Click Open Uninstall Manager
Click Save List - Save it anywhere.
A notepad will pop-up after it's saved, please copy everything in that Notepad and paste it here.

#7 markonato

markonato
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 03 November 2007 - 05:21 AM

11 hours online scanning :blink:
XXXPlugin deleted.


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, November 03, 2007 11:05:05 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/11/2007
Kaspersky Anti-Virus database records: 450434
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
I:\

Scan Statistics:
Total number of scanned objects: 237454
Number of viruses found: 9
Number of infected objects: 22
Number of suspicious objects: 0
Duration of the scan process: 11:19:33

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\you\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\you\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Identities\{3B344E1D-2BD2-4E5F-9E69-6B8918B502A2}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Identities\{3B344E1D-2BD2-4E5F-9E69-6B8918B502A2}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Identities\{3B344E1D-2BD2-4E5F-9E69-6B8918B502A2}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Identities\{3B344E1D-2BD2-4E5F-9E69-6B8918B502A2}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\you\Local Settings\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\you\Local Settings\Temp\Perflib_Perfdata_490.dat Object is locked skipped
C:\Documents and Settings\you\Local Settings\Temp\hijackthis.lo0 Object is locked skipped
C:\Documents and Settings\you\Local Settings\Temp\Edit.000 Object is locked skipped
C:\Documents and Settings\you\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\history.dat Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\parent.lock Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\cert8.db Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\key3.db Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\search.sqlite Object is locked skipped
C:\Documents and Settings\you\Application Data\Mozilla\Firefox\Profiles\o00cu9fo.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\you\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\you\ntuser.dat Object is locked skipped
C:\Program Files\mIRCNew\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\cache\FND0.NFI Infected: Trojan.Win32.DNSChanger.uu skipped
C:\Program Files\ESET\infected\0CMJ00CA.NQF Infected: Trojan.Win32.DNSChanger.uu skipped
C:\System Volume Information\_restore{BDFA9414-B859-4A3D-8C85-51E6A68651B2}\RP509\A0112065.sys Object is locked skipped
C:\System Volume Information\_restore{BDFA9414-B859-4A3D-8C85-51E6A68651B2}\RP510\A0112121.exe Infected: Trojan.Win32.DNSChanger.uu skipped
C:\System Volume Information\_restore{BDFA9414-B859-4A3D-8C85-51E6A68651B2}\RP511\A0112147.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\System Volume Information\_restore{BDFA9414-B859-4A3D-8C85-51E6A68651B2}\RP511\change.log Object is locked skipped
C:\Instalacije\GETRIGHT\GETRT45D.EXE/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.Gator.1050 skipped
C:\Instalacije\GETRIGHT\GETRT45D.EXE WiseSFX: infected - 1 skipped
C:\Instalacije\kazaalite202e.exe/data0014 Infected: not-a-virus:AdWare.Win32.Altnet.o skipped
C:\Instalacije\kazaalite202e.exe Inno: infected - 1 skipped
C:\Instalacije\vtp7.zip/Vista Transformation Pack 7.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Instalacije\vtp7.zip/Vista Transformation Pack 7.0.exe Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\Instalacije\vtp7.zip ZIP: infected - 2 skipped
C:\Instalacije\codec-scan1466.exe/stream/Script Infected: Trojan.Win32.DNSChanger.jf skipped
C:\Instalacije\codec-scan1466.exe/stream Infected: Trojan.Win32.DNSChanger.jf skipped
C:\Instalacije\codec-scan1466.exe NSIS: infected - 2 skipped
C:\wamp\logs\mysql_error.log Object is locked skipped
C:\wamp\mysql\data\ibdata1 Object is locked skipped
C:\wamp\mysql\data\ib_logfile0 Object is locked skipped
C:\wamp\mysql\data\ib_logfile1 Object is locked skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\pskill.exe.vir Infected: not-a-virus:RiskTool.Win32.PsKill.e skipped
C:\MIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.91 skipped
D:\System Volume Information\_restore{BDFA9414-B859-4A3D-8C85-51E6A68651B2}\RP511\change.log Object is locked skipped
D:\Staro sa D-a\sa starog\SpasavanjeNew\ATmIRC.zip/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.60 skipped
D:\Staro sa D-a\sa starog\SpasavanjeNew\ATmIRC.zip ZIP: infected - 1 skipped
D:\Staro sa C-a\Downloads\zafrkancije\nc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
D:\Staro sa C-a\Downloads\zafrkancije\trace.zip/nc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
D:\Staro sa C-a\Downloads\zafrkancije\trace.zip ZIP: infected - 1 skipped

Scan process completed.



New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:06 AM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
c:\wamp\mysql\bin\mysqld-nt.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetTimer 2000\NetTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\UltraEdit\UEDIT32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\ApexDC++\ApexDC.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetTimer 2000] "C:\Program Files\NetTimer 2000\NetTimer.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Desktop (Service_Desktop) - Unknown owner - C:\Program Files\Free-Soft\Virtual Desktop\Desktop.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/you/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 4068 bytes



HijackThis uninstall list:

µTorrent
ABC Amber PDF Converter
ACDSee 7.0 PowerPack
Adobe Acrobat 7.0 Professional
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Photoshop 5.5
Adobe Photoshop 7.0
Adobe Reader 7.0
Adobe Shockwave Player
AirHockey 3D 1.82
AnalogX MaxMem
AngelPotion Video Codec V1
ApexDC++ 0.4.0
Avant Browser (remove only)
AVIcodec (remove only)
BabycamAndMotionDetection_CS
CDex extraction audio
CSS Tab Designer v2.0
DAEMON Tools
DDORMap 1.0.0.0
DV 8800
DZK Player
EA SPORTS online 2006
EA.com Matchup
EA.com Update
Easy PDF to Text Converter v2.0
Editor
FLV Player
FreePicGrabber
GEDA by X15
GetRight
Google Talk (remove only)
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB926239)
HTML Executable Viewer 1.1.0
HyperCam 2
ICQ Toolbar
ICQ 5.1
Java™ 6 Update 3
Java™ SE Development Kit 6
Java™ SE Runtime Environment 6
Kaspersky Online Scanner
K-Lite Codec Pack 3.4.5 Standard
Lavovi - Livescore 1.07
Legend of Aladdin Free Trial
LockBox
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Fireworks MX 2004
Macromedia Flash MX 2004
Macromedia FreeHand MXa
MadOnion.com/3DMark2001 SE
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft ActiveSync 4.0
Microsoft ASP.NET 2.0 AJAX Extensions 1.0
Microsoft ASP.NET 2.0 AJAX Futures January CTP
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Device Emulator version 1.0 - ENU
Microsoft DirectX 9.0 SDK Update (August 2005)
Microsoft Document Explorer 2005
Microsoft Document Explorer 2005
Microsoft Office Professional Edition 2003
Microsoft Office Visio for Enterprise Architects
Microsoft SQL Server 2000
Microsoft SQL Server 2005
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Analysis Services
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Management Studio Express CTP
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual J# 2.0 Redistributable Package
Microsoft Visual SourceSafe 2005 - ENU
Microsoft Visual Studio 2005 Professional Edition - ENU
mIRC
Mozilla Firefox (2.0.0.9)
MSDN Library for Visual Studio 2005
MSDN Library for Visual Studio 2005
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
MV2Player (remove only)
MySQL Administrator 1.0.12
MySQL Servers and Clients 4.0.20d
MySQL Turbo Manager 3.7.1.5
Nero 6 Enterprise Edition
NetTimer 2000 version 2.0
News Scroller Wizard 2.0
NOD32 antivirus system
NOD32 FiX v2.1
NVIDIA Drivers
Online TV Player 3
Opera 9.20
PasswordKeeper
PDF Ripper 1.01
Popup Blocker (Windows Live Toolbar)
QuickTime
QuickTime Alternative 1.77
Rapala Pro Fishing
RealPlayer
Realtek AC'97 Audio
Rhapsody Player Engine
Risk
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB925674)
Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB937060)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939373)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Skype 2.0
Smart Menus (Windows Live Toolbar)
SmartKey
Soldier of Fortune Gold
Sony Ericsson PC Suite 1.20.173
SPOT xde® Player DLL
Spyware Terminator
Sun Java System Application Server Platform Edition
Sybase PowerDesigner 10.0 Evaluation
Tabbed Browsing (Windows Live Toolbar)
Total Commander 6.03a XP
TuneUp Utilities 2004
TVAnts 1.0
UltraEdit-32 Uninstall
Unlocker 1.8.5
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
VeryPDF PDF2Word v3.0
Vodafone 804SS USB driver Software
WAMP5 1.7.3
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Toolbar
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB894476
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
Winning Eleven 7 INTERNATIONAL
WinRAR archiver
Yahoo! Browser Services
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar

Btw, there was no redirecting since yesterday, combofix.. :thumbsup:

#8 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:57 PM

Posted 03 November 2007 - 06:25 AM

Great, hopefully not much more to do now!

Please find and delete the following infected cracks/installers:
C:\Instalacije\GETRIGHT\GETRT45D.EXE
C:\Instalacije\kazaalite202e.exe
C:\Instalacije\vtp7.zip
C:\Instalacije\codec-scan1466.exe
D:\Staro sa C-a\Downloads\zafrkancije\nc.exe
D:\Staro sa C-a\Downloads\zafrkancije\trace.zip

Also, delete this folder:
C:\qoobox

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Please reboot a final time and let me know how the PC is running.
I see a clean Hijackthis log now! :thumbsup:

#9 markonato

markonato
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 03 November 2007 - 05:12 PM

Everything seems to work fine now. Great job. Thanks David! :thumbsup:

#10 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:10:57 PM

Posted 04 November 2007 - 10:37 AM

Glad I could help! :thumbsup:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybotİ - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasoftsİ Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacoolsİ SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.
:blink: If you wish to learn how to use HijackThis to remove malware, you might like to join the Malware Removal Training Program!

If you have any addition questions just ask...
David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users