Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cid Popup Blocker


  • This topic is locked This topic is locked
2 replies to this topic

#1 MatthiasH

MatthiasH

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 31 August 2008 - 12:41 PM

Hallo,
ich hatte wohl den CID Popup blocker und habe COMBOFIX benutzt.
Ob der CID nun wirklich weg ist und eventuelle andere MALWARE weiss ich nicht.
Zuerst das hijackfile und dann das combofix.file.
Ich bitte um Überprüfung

Hijackfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:29, on 31.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Programme\D-Tools\daemon.exe
C:\WINDOWS\emMon.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\CA\eTrust Internet Security Suite\cctray\cctray.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\netdde.exe
C:\Programme\TomTom HOME 2\HOMERunner.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\Programme\E-Color\Common\IconMgr.exe
C:\Programme\TechniSat DVB\bin\Server4PC.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\E-Color\E-Color Indicator\TICIcon.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\system32\PSIService.exe
C:\Programme\TechniSat DVB\bin\Server4PC.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Programme\CA\eTrust Internet Security Suite\ccprovsp.exe
C:\Programme\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.iesearch.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.es/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2be8ceeb-baaa-1967-1fc4-a02556d5d8b2} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: agadoo browser enhancer - {62a460fd-cc97-bbaa-d7c6-7dddfc14c052} - C:\WINDOWS\system32\wgjjfgkvxrkpeuqdw.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - (no file)
O2 - BHO: (no name) - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [CAVRID] "C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [emMonitor] C:\WINDOWS\emMon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cctray] "C:\Programme\CA\eTrust Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Programme\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [{00160ca3-9d74-836f-90a3-d13e7386aad5}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\wgjjfgkvxrkpeuqdw.dll" DllStub
O4 - HKLM\..\Run: [{91-1E-EB-B3-DW}] C:\WINDOWS\system32\dwwnw64r.exe DWbrk03FF
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Programme\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: E-Color.lnk = C:\Programme\E-Color\Common\IconMgr.exe
O4 - Global Startup: Server4PC.lnk = C:\Programme\TechniSat DVB\bin\Server4PC.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Programme\CA\eTrust Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

--
End of file - 10315 bytes


UND NUN DAS COMBOFIX FILE:

ComboFix 08-08-30.03 - Haenel 2008-08-31 17:55:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.969 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Haenel\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\Haenel\Startmenü\Programme\Autostart\Deewoo.lnk
C:\Dokumente und Einstellungen\Haenel\Startmenü\Programme\Autostart\DW_Start.lnk
C:\WINDOWS\system32\dwwnw64r.exe
C:\WINDOWS\system32\gside.exe
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\rpwnw64r.exe
C:\WINDOWS\system32\winpfz33.sys
C:\WINDOWS\system32\zxdnt3d.cfg

.
((((((((((((((((((((((( Dateien erstellt von 2008-07-28 bis 2008-08-31 ))))))))))))))))))))))))))))))
.

2008-08-28 12:37 . 2008-08-28 12:37 166,400 --a------ C:\WINDOWS\system32\wgjjfgkvxrkpeuqdw.dll
2008-08-23 16:53 . 2008-08-23 16:53 <DIR> d-------- C:\Programme\Tools&More
2008-08-22 14:28 . 2008-08-22 14:28 <DIR> d-------- C:\Programme\Trend Micro
2008-08-22 13:58 . 2008-08-22 13:58 <DIR> d-------- C:\Programme\CCleaner
2008-08-22 00:18 . 2008-08-22 00:18 521,690 --a------ C:\BNN Der Sonntag 100808.pdf
2008-08-21 17:25 . 2008-08-21 17:24 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-08-21 17:17 . 2008-08-21 17:25 <DIR> d-------- C:\Programme\Gemeinsame Dateien\PC Tools
2008-08-21 17:17 . 2008-06-10 21:22 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-08-21 17:17 . 2008-06-02 15:19 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-08-21 17:17 . 2008-06-02 15:19 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-21 17:17 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-08-21 17:16 . 2008-08-21 18:16 <DIR> d-------- C:\Programme\Spyware Doctor
2008-08-21 17:16 . 2008-08-21 17:16 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\PC Tools
2008-08-21 15:44 . 2008-08-21 15:44 <DIR> d-------- C:\Programme\DeepSkyStacker
2008-08-21 13:56 . 2008-08-29 18:28 <DIR> d-------- C:\Programme\SUPERAntiSpyware
2008-08-21 13:56 . 2008-08-21 13:56 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\SUPERAntiSpyware.com
2008-08-21 13:56 . 2008-08-21 13:56 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2008-08-14 13:49 . 2008-08-21 17:29 2,560 --a------ C:\WINDOWS\system32\drivers\mchInjDrv.sys
2008-08-14 13:27 . 2008-08-14 13:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools
2008-08-14 13:08 . 2008-08-21 18:17 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-08-13 21:12 . 2008-08-21 20:24 <DIR> d-------- C:\Programme\NoAdware5.0
2008-08-13 13:35 . 2008-08-13 13:35 <DIR> d-------- C:\Programme\NT Registry Optimizer
2008-08-13 13:17 . 2008-08-13 13:17 <DIR> d-------- C:\0e998d1a8500be1dffa55f13d4675a
2008-08-13 12:14 . 2008-08-13 12:14 <DIR> d-------- C:\Programme\nounaxisfile
2008-08-13 12:11 . 2008-05-01 15:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-10 23:04 . 2008-08-10 23:04 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-10 23:04 . 2008-08-10 23:04 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-10 22:41 . 2008-08-31 17:14 90,915 --a------ C:\WINDOWS\system32\pkblddartbcfg.dll-uninst.exe
2008-08-10 20:29 . 2008-08-13 12:14 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\nounaxisfile
2008-08-10 20:29 . 2008-08-13 12:14 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ball mapi owns ping
2008-08-10 20:28 . 2008-08-10 20:28 <DIR> d-------- C:\Programme\torrent_search
2008-08-10 20:28 . 2008-08-10 20:28 <DIR> d-------- C:\Programme\Conduit
2008-08-10 20:28 . 2008-08-10 20:28 548,924 --a------ C:\WINDOWS\system32\rcntktdl.exe
2008-08-10 20:28 . 2008-08-10 20:28 153,394 --a------ C:\WINDOWS\system32\g15.exe
2008-08-10 20:28 . 2008-08-29 18:24 71,755 --a------ C:\WINDOWS\system32\qknawyonfhxc.exe
2008-08-10 20:27 . 2008-08-10 20:29 <DIR> d-------- C:\Programme\BitTorrent Fastest Tool
2008-08-10 20:18 . 2008-08-10 20:32 <DIR> d-------- C:\Programme\PartyGaming
2008-08-10 20:17 . 2008-08-10 20:18 <DIR> d-------- C:\TEMP\32D6V0BJ
2008-08-07 15:20 . 2008-08-07 15:20 <DIR> d-------- C:\Programme\Foxit Software
2008-08-05 18:10 . 2008-08-05 18:10 2,412,607 --a------ C:\BNN-Email.jpg
2008-08-03 14:50 . 2008-08-03 14:50 <DIR> d-------- C:\Programme\Skype
2008-08-03 14:50 . 2008-08-03 14:50 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Skype
2008-08-03 14:50 . 2008-08-31 18:00 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\Skype
2008-08-03 14:49 . 2008-08-03 14:50 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype
2008-08-02 15:29 . 2008-08-02 15:29 18,257 --a------ C:\IMG_2052_2.jpg
2008-07-27 18:03 . 2008-08-07 13:09 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-07-27 14:28 . 2008-07-27 14:28 <DIR> d-------- C:\Programme\CCDWare
2008-07-26 13:55 . 2008-01-03 16:05 463,360 --a------ C:\TEMP\setup.exe
2008-07-16 16:51 . 2007-04-18 01:24 44,814,336 --a------ C:\Programme\Photoshop.exe
2008-07-16 16:17 . 2008-07-16 16:17 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet
2008-07-12 13:50 . 2008-07-12 13:50 <DIR> d-------- C:\Programme\ICQ6Toolbar
2008-07-12 13:50 . 2008-07-12 13:50 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
2008-07-12 13:49 . 2008-07-12 13:51 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\ICQ
2008-07-12 13:47 . 2008-07-12 13:51 <DIR> d-------- C:\Programme\ICQ6
2008-07-10 17:59 . 2008-07-10 17:59 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
2008-07-10 17:56 . 2008-07-10 17:56 <DIR> d-------- C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\TomTom
2008-07-10 17:55 . 2008-08-14 13:27 <DIR> d-------- C:\Programme\TomTom HOME 2
2008-07-10 17:46 . 2008-07-10 17:46 <DIR> d-------- C:\Programme\TomTom DesktopSuite
2008-07-10 17:44 . 2008-07-10 17:45 <DIR> d-------- C:\Tom Tom v7.131
2008-07-10 16:03 . 2008-06-14 18:57 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-07 21:30 . 2008-07-07 21:30 253,952 -----c--- C:\WINDOWS\system32\dllcache\es.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 00:59 --------- d-----w C:\Programme\Mozilla Thunderbird
2008-08-29 17:27 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-08-21 21:22 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-08-21 17:22 --------- d-----w C:\Programme\Spybot - Search & Destroy
2008-08-12 13:56 --------- d-----w C:\Programme\Google
2008-08-11 22:36 --------- d-----w C:\Programme\eMule
2008-08-07 13:55 --------- d-----w C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\UseNeXT
2008-08-06 17:22 --------- d-----w C:\Programme\xp-AntiSpy
2008-08-06 17:19 --------- d-----w C:\Programme\Java
2008-08-06 17:17 --------- d-----w C:\Programme\NCH Swift Sound
2008-08-06 17:16 --------- d-----w C:\Programme\CDN WinTool Prof
2008-08-06 17:15 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe
2008-08-03 22:28 --------- d-----w C:\Programme\GameSpy Arcade
2008-07-25 12:50 --------- d-----w C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\NCH Swift Sound
2008-07-25 12:50 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
2008-07-20 14:48 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLInstaller
2008-07-19 23:33 --------- d-----w C:\Programme\DivX
2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-15 13:48 --------- d-----w C:\Programme\UseNeXT
2008-07-12 12:51 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-07-10 15:03 91,376 ----a-w C:\WINDOWS\system32\isafprod.dll
2008-07-10 15:03 880,560 ----a-w C:\WINDOWS\system32\drivers\vetefile.sys
2008-07-10 15:03 32,240 ----a-w C:\WINDOWS\system32\drivers\vetmonnt.sys
2008-07-10 15:03 26,352 ----a-w C:\WINDOWS\system32\drivers\vet-filt.sys
2008-07-10 15:03 21,488 ----a-w C:\WINDOWS\system32\drivers\vetfddnt.sys
2008-07-10 15:03 21,104 ----a-w C:\WINDOWS\system32\drivers\vet-rec.sys
2008-07-10 15:03 108,368 ----a-w C:\WINDOWS\system32\drivers\veteboot.sys
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:22 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 665,088 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:39 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:18 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-07 05:14 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll
2007-01-25 14:39 92,064 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmmdm.sys
2007-01-25 14:39 9,232 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmmdfl.sys
2007-01-25 14:39 79,328 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmserd.sys
2007-01-25 14:39 66,656 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmbus.sys
2007-01-25 14:39 6,208 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmcmnt.sys
2007-01-25 14:39 5,936 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmwhnt.sys
2007-01-25 14:39 4,048 ----a-w C:\Dokumente und Einstellungen\Haenel\mqdmcr.sys
2007-01-25 14:39 25,600 ----a-w C:\Dokumente und Einstellungen\Haenel\usbsermptxp.sys
2007-01-25 14:39 22,768 ----a-w C:\Dokumente und Einstellungen\Haenel\usbsermpt.sys
2005-02-15 23:46 733,184 ----a-w C:\Programme\fishsim2.exe
2007-12-13 23:44 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
<pre>
----a-w		   374,858 2005-04-23 15:34:46  C:\Eigene Dateien-P\fly-wcs5t\World Snooker Championship 2005 Trainer .exe
</pre>


(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a460fd-cc97-bbaa-d7c6-7dddfc14c052}]
2008-08-28 12:37 166400 --a------ C:\WINDOWS\system32\wgjjfgkvxrkpeuqdw.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\HOMERunner.exe" [2008-05-06 09:42 202088]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2007-05-10 16:09 23395880]
"msnmsgr"="C:\Programme\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Programme\Analog Devices\SoundMAX\SMTray.exe" [2003-07-30 10:08 143360]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"EPSON Stylus Photo R200 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE" [2003-09-11 04:00 99840]
"CAVRID"="C:\Programme\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [2008-07-10 16:03 234736]
"DAEMON Tools-1033"="C:\Programme\D-Tools\daemon.exe" [2004-08-22 18:05 81920]
"emMonitor"="C:\WINDOWS\emMon.exe" [2005-01-06 10:56 32768]
"ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 22:05 339968]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"cctray"="C:\Programme\CA\eTrust Internet Security Suite\cctray\cctray.exe" [2008-07-31 21:30 181488]
"Media Codec Update Service"="C:\Programme\Essentials Codec Pack\update.exe" [2007-04-08 17:44 303104]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"{00160ca3-9d74-836f-90a3-d13e7386aad5}"="C:\WINDOWS\system32\wgjjfgkvxrkpeuqdw.dll" [2008-08-28 12:37 166400]
"{91-1E-EB-B3-DW}"="C:\WINDOWS\system32\dwwnw64r.exe" [N/A]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 01:58 110592 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:57 15360]

C:\Dokumente und Einstellungen\Haenel\Startmen\Programme\Autostart\
Adobe Gamma.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2006-07-15 13:13:26 113664]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Gamma Loader.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2006-07-15 13:13:26 113664]
BlueSoleil.lnk - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-09-10 23:30:11 1044480]
E-Color.lnk - C:\Programme\E-Color\Common\IconMgr.exe [2005-03-20 17:51:42 57344]
Server4PC.lnk - C:\Programme\TechniSat DVB\bin\Server4PC.exe [2008-02-23 16:49:10 328968]
WinZip Quick Pick.lnk - C:\Programme\WinZip\WZQKPICK.EXE [2008-03-10 16:20:10 118784]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"FoFileAssociate"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-08-26 15:03 352256 C:\Programme\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= c:\progra~1\codecp~1\divx3\divxc32.dll
"vidc.DIV4"= c:\progra~1\codecp~1\divx412\divx.dll
"vidc.DX50"= c:\progra~1\codecp~1\divx502\divx.dll
"vidc.xvid"= c:\progra~1\codecp~1\xvid\xvid.dll
"vidc.fvfw"= c:\progra~1\codecp~1\ffvfw\ffvfw.dll
"vidc.MP43"= c:\progra~1\codecp~1\mpeg4\mpg4c32.dll
"VIDC.MJPG"= c:\progra~1\codecp~1\picvideo\pvmjpg21.dll
"VIDC.PIMJ"= c:\progra~1\codecp~1\picvideo\pvljpg20.dll
"VIDC.PVW2"= c:\progra~1\codecp~1\picvideo\pvwv220.dll
"VIDC.SJPG"= c:\progra~1\codecp~1\pmmjpeg\pmmjpeg.dll
"vidc.MJPX"= c:\progra~1\codecp~1\m3jpegv3\m3jpeg32.dll
"vidc.dmb1"= c:\progra~1\codecp~1\m3jpegv3\m3jpeg32.dll
"VIDC.HFYU"= c:\progra~1\codecp~1\huffyuv\huffyuv.dll
"VIDC.ZLIB"= c:\progra~1\codecp~1\lcljp\avizlib.dll
"VIDC.MSZH"= c:\progra~1\codecp~1\lcljp\avimszh.dll
"vidc.MVW1"= c:\progra~1\codecp~1\aware\icmw_32.dll
"vidc.dvmc"= c:\progra~1\codecp~1\mcdv\mcdvd_32.dll
"vidc.VP31"= c:\progra~1\codecp~1\on2vp3\vp31vfw.dll
"vidc.3IV2"= c:\progra~1\codecp~1\3ivx\3ivxvf~1.dll
"vidc.I263"= c:\progra~1\codecp~1\i263\i263_32.drv
"msacm.imc"= c:\progra~1\codecp~1\i263\imc32.acm
"msacm.lameacm"= c:\progra~1\codecp~1\mp3lame\lameacm.acm
"msacm.atrac3"= c:\progra~1\codecp~1\atrac3\atrac3.acm
"msacm.qmpeg"= c:\progra~1\codecp~1\qmpeg\qmpeg.acm
"msacm.uleaddv"= c:\progra~1\codecp~1\uleaddv\dvacm.acm
"msacm.vorbis"= c:\progra~1\codecp~1\vorbis\vorbis.acm
"msacm.divxa32"= c:\progra~1\codecp~1\wma\divxa32.acm
"msacm.msaudio2"= c:\progra~1\codecp~1\wma\msaud32h.acm
"SENTINEL"= snti386.dll
"vidc.K3CC"= K3CCodec.dll
"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"BlueSoleil Hid Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Programme\\Codemasters\\World Championship Snooker 2004\\wcs2004.exe"=
"C:\\Programme\\Infogrames\\Grand Prix 4\\GP4.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"C:\\Programme\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Programme\\Dassault Systemes\\B15\\intel_a\\code\\bin\\CNEXT.exe"=
"C:\\Programme\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Programme\\Trillian\\trillian.exe"=
"C:\\Programme\\TechniSat DVB\\bin\\Server4PC.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\DVBViewerTE\\ts_winlirc.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\Microprose\\Grand Prix 3\\gp3.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:127.0.0.1
"4672:UDP"= 4672:UDP:upload
"5827:TCP"= 5827:TCP:wcs
"5827:UDP"= 5827:UDP:wcs2
"86:TCP"= 86:TCP:BroadCam Web Server
"23956:TCP"= 23956:TCP:emu tcp
"39781:UDP"= 39781:UDP:emu udp

R0 ALiAGP;ALi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\ALiAGP.sys [2003-08-05 12:20]
R1 hwinterface;hwinterface;C:\WINDOWS\system32\Drivers\hwinterface.sys [2006-12-12 14:48]
R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2005-04-23 11:21]
R1 mchInjDrv;madCodeHook DLL injection driver;C:\WINDOWS\system32\Drivers\mchInjDrv.sys [2008-08-21 17:29]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-08-21 17:24]
R1 VBoxDrv;VirtualBox Service;C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2007-06-06 01:19]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2007-06-06 01:19]
R2 ALIEHCD;ALi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys [2003-11-17 21:26]
R2 ApogeeIO;Apogee Port I/O;C:\WINDOWS\system32\Drivers\apogeeio.sys [2005-06-01 13:07]
R2 ICQ Service;ICQ Service;C:\Programme\ICQ6Toolbar\ICQ Service.exe [2008-06-10 19:26]
R2 MaxImIO;MaxIm Port I/O;C:\WINDOWS\system32\Drivers\maximio.sys [2005-06-01 13:07]
R2 sbigudrv;sbigudrv;C:\WINDOWS\SYSTEM32\DRIVERS\sbigudrv.sys [2002-08-23 12:29]
R3 ALI5261;ALi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ALILAN.SYS [2003-09-05 16:07]
R3 aliroothub;USB 2.0 Root Hub;C:\WINDOWS\system32\DRIVERS\AliRtHub.sys [2003-11-17 21:31]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS [2007-10-01 21:54]
S2 OxSer;PCI Serial Driver;C:\WINDOWS\system32\DRIVERS\OxSer.sys [2001-05-15 11:30]
S2 PARXPORT;PCI Parallel Driver;C:\WINDOWS\system32\DRIVERS\parxport.sys [2001-05-15 11:27]
S2 SBIGULDR;SBIG USB Loader (sbiguldr.sys);C:\WINDOWS\system32\Drivers\sbiguldr.sys [2005-10-20 09:39]
S2 SBIGUSBE;SBIG USB Driver (sbigusbe.sys);C:\WINDOWS\system32\Drivers\sbigusbe.sys [2003-09-05 08:11]
S3 ASUSHWIO;ASUSHWIO;C:\WINDOWS\system32\drivers\ASUSHWIO.sys []
S3 ATICDSDr;ATICDSDr;C:\Programme\ATI Technologies\ATI Control Panel\atiicdxx.sys [2005-02-23 04:40]
S3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []
S3 PortTalk;PortTalk;C:\WINDOWS\system32\drivers\Porttalk.sys [2005-03-08 00:39]
S3 sbig;sbig;C:\WINDOWS\System32\Drivers\sbig.sys [2001-05-08 16:51]
S3 Slnt7554;USB Soft Modem Driver;C:\WINDOWS\system32\DRIVERS\slnt7554.sys [2004-11-01 22:27]
S3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2003-09-16 06:48]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d91f1838-a73b-11dc-8685-000b0d0b299a}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fde2f14a-b3bf-11dc-86ac-000b0d0b299a}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Inhalt des "geplante Tasks" Ordners

2008-08-08 C:\WINDOWS\Tasks\1-Klick-Wartung.job
- C:\Programme\TuneUp Utilities 2004\SystemOptimizer.exe [2004-11-09 21:16]

2008-08-31 C:\WINDOWS\Tasks\A9B9BF89918A3729.job
- c:\dokume~1\haenel\anwend~1\nounax~1\REF SOFTWARE HTM.exe [2008-08-13 12:14]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{2be8ceeb-baaa-1967-1fc4-a02556d5d8b2} - (no file)


.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\Mozilla\Firefox\Profiles\9d9qvf45.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www2.firesearch.com/
FF -: plugin - C:\Dokumente und Einstellungen\Haenel\Anwendungsdaten\Mozilla\plugins\npPxPlay.dll
FF -: plugin - C:\Programme\DivX\DivX Content Uploader\npUpload.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 18:00:14
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...


**************************************************************************
.
Zeit der Fertigstellung: 2008-08-31 18:04:52
ComboFix-quarantined-files.txt 2008-08-31 17:03:49

Pre-Run: 6,860,849,152 Bytes frei
Post-Run: 8,842,510,336 Bytes frei

315 --- E O F --- 2008-08-13 21:27:04



Vielen Dank

Matthias

BC AdBot (Login to Remove)

 


m

#2 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:39 PM

Posted 16 September 2008 - 10:57 AM

Hello


Apologize for the delay in response we get overwhelmed at times but we are trying our best to keep up.
If you have since resolved the original problem you were having would appreciate you letting us know If not please perform the following below so I can have a look at the current condition of your machine.

Thanks and again sorry for the delay.
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
Next
Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Posted Image

#3 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:39 PM

Posted 22 September 2008 - 09:51 AM

This thread will now be closed.
If you need this topic reopened, please contact me.

This applies only to the original topic starter.
Everyone else please begin a New Topic.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users