Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus


  • This topic is locked This topic is locked
2 replies to this topic

#1 Reddoug

Reddoug

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Local time:11:36 PM

Posted 29 January 2009 - 09:29 PM

Hi

This is a coworkers computer and it has been tanken over. Warning Dangerous Spyware is displayed on desktop. When trying to open Spybot, get floating point errors. Superantivirus did not find anything. Top of screen in this website it says this computer has 18 Trojans and to scan computer. I have some screen shots of desktop if you need to see them. Several time when trying to navigate to different areas of this site I would get an error message saying redirect by a server. If this computer can not be repaired I have disks to wipe drive and do a clean install.

Thanks Reddoug


DDS (Ver_09-01-19.01) - NTFSx86
Run by User at 19:54:40.04 on Thu 01/29/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.216 [GMT -6:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\ntdll64.exe
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\GR7W9WF6\SetupAntivirusXP[1].exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ntdll64.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\GCNTX5V6\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = localhost
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AntivirusXP.exe] c:\program files\antivirusxp\AntivirusXP.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [<NO NAME>]
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [diagent] "c:\program files\creative\sblive\diagnostics\diagent.exe" startup
mRun: [Framework Windows] frmwrk32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\backWeb-7288971.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\windows\temp\ntdll64.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\i40k213j.default\
FF - HiddenExtension: XUL Cache: {910C0CAC-C396-49C1-96C1-712961A37EB8} - c:\documents and settings\user\local settings\application data\{910C0CAC-C396-49C1-96C1-712961A37EB8}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-9-20 97928]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-9-20 26824]
R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-9-21 875288]
R4 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-9-21 231704]
R4 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-9-20 76040]

=============== Created Last 30 ================

2009-01-29 18:48 0 a------- c:\windows\system32\CMMGR32.EXE
2009-01-29 18:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-29 18:45 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-29 18:45 <DIR> --d----- c:\docume~1\user\applic~1\SUPERAntiSpyware.com
2009-01-24 18:14 4,785 a------- c:\windows\system32\warning.gif
2009-01-24 18:14 1,347 a------- c:\windows\system32\ahtn.htm
2009-01-23 15:52 125,440 a------- c:\windows\system32\ntdll64.exe
2009-01-22 20:52 491 a------- c:\windows\system32\win32hlp.cnf
2009-01-22 20:52 1 a------- c:\windows\system32\uniq.tll
2009-01-22 20:52 1 a------- c:\windows\system32\test.ttt
2009-01-22 20:51 25,088 a------- c:\windows\system32\frmwrk32.exe
2009-01-22 20:51 25,088 a------- c:\windows\system32\303357.exe
2009-01-21 18:20 134,144 a------- c:\windows\ebanurif.dll
2009-01-21 18:08 40,960 a------- c:\windows\Pdukokiqovab.dll
2009-01-18 20:05 54,156 a---h--- c:\windows\QTFont.qfn
2009-01-18 20:05 1,409 a------- c:\windows\QTFont.for

==================== Find3M ====================

2009-01-22 20:52 125,440 a------- c:\windows\system32\userinit.exe
2008-12-27 17:10 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-11 04:57 333,952 a------- c:\windows\system32\drivers\srv.sys

============= FINISH: 19:54:52.78 ===============




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-01-19.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/19/2008 4:58:20 PM
System Uptime: 1/29/2009 7:19:36 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 02Y832
Processor: Intel® Pentium® 4 CPU 2.40GHz | Microprocessor | 2394/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 66.62 GiB free.
D: is CDROM ()
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP19: 10/7/2008 7:46:44 PM - System Checkpoint
RP20: 10/10/2008 3:56:56 PM - System Checkpoint
RP21: 10/14/2008 5:12:16 PM - Software Distribution Service 3.0
RP22: 10/19/2008 11:11:01 AM - System Checkpoint
RP23: 10/21/2008 2:18:37 PM - Avg8 Update
RP24: 10/23/2008 2:57:43 PM - Software Distribution Service 3.0
RP25: 10/27/2008 2:45:58 PM - System Checkpoint
RP26: 11/5/2008 4:42:26 PM - System Checkpoint
RP27: 11/8/2008 2:41:58 PM - System Checkpoint
RP28: 11/10/2008 3:44:23 PM - Avg8 Update
RP29: 11/12/2008 7:36:53 AM - Software Distribution Service 3.0
RP30: 11/14/2008 3:59:46 PM - System Checkpoint
RP31: 11/27/2008 10:38:47 AM - Avg8 Update
RP32: 12/12/2008 3:32:50 PM - Avg8 Update
RP33: 12/12/2008 5:16:27 PM - Software Distribution Service 3.0
RP34: 12/14/2008 9:11:01 PM - System Checkpoint
RP35: 12/16/2008 8:17:25 PM - System Checkpoint
RP36: 12/17/2008 8:22:06 PM - System Checkpoint
RP37: 12/19/2008 4:56:03 PM - Software Distribution Service 3.0
RP38: 12/27/2008 5:10:02 PM - Installed Java™ 6 Update 11
RP39: 1/1/2009 10:39:50 AM - System Checkpoint
RP40: 1/9/2009 4:04:56 PM - System Checkpoint
RP41: 1/13/2009 7:07:08 PM - Software Distribution Service 3.0

==== Installed Programs ======================

ABBYY FineReader 5.0 Sprint
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
aspi
AVG Free 8.0
BCM V.92 56K Modem
CCHelp
CCScore
Dell AIO Printer A940
Dell ResourceCD
ESSAdpt
ESSANUP
ESSCAM
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSvpaht
ESSvpot
FaxTools
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Intel® PRO Network Adapters and Drivers
Java™ 6 Update 11
Java™ 6 Update 7
Kodak EasyShare software
KSU
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.1)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nero 6 Ultra Edition
Notifier
OTtBP
PowerDVD
QuickTime
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
SFR
SFR2
Sound Blaster Live!
Spybot - Search & Destroy
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

1/23/2009 7:17:24 AM, error: Service Control Manager [7031] - The AVG8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
1/29/2009 7:15:50 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
1/29/2009 7:15:50 PM, error: Service Control Manager [7034] - The Terminal Services service terminated unexpectedly. It has done this 1 time(s).
1/29/2009 7:21:46 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

==== End Of File ===========================

BC AdBot (Login to Remove)

 


#2 Reddoug

Reddoug
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Local time:11:36 PM

Posted 02 February 2009 - 09:19 PM

I was able to repair the problem.

#3 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Staff Emeritus
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:01:36 AM

Posted 02 February 2009 - 09:57 PM

Thanks for informing us.

This thread is then closed.

Should you need it reopened, please contact a Forum Moderator. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users