Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected Lmok D (Trojan)(Yahoo Anti-Spy)


  • This topic is locked This topic is locked
2 replies to this topic

#1 RJDMGK

RJDMGK

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:03 AM

Posted 24 March 2009 - 10:56 PM

Hi there, Please help me, I cant seem to delete this.

-------------------------

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-03-16.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/4/2009 10:49:22 PM
System Uptime: 3/24/2009 10:16:04 PM (0 hours ago)

Motherboard: ASUSTeK Computer INC. | | A7S333
Processor: AMD Athlon™ XP 1800+ | SOCKET A | 1533/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 37 GiB total, 19.152 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 2/4/2009 11:00:37 PM - System Checkpoint
RP2: 2/4/2009 11:21:41 PM - Installed RangeBooster G WDA-2320
RP3: 2/4/2009 11:21:49 PM - Installed ANIO Service
RP4: 2/4/2009 11:22:01 PM - Installed ANIWZCS2 Service
RP5: 2/4/2009 11:53:30 PM - Installed Windows Installer KB893803v2.
RP6: 2/6/2009 12:15:38 AM - System Checkpoint
RP7: 2/7/2009 1:14:32 AM - System Checkpoint
RP8: 2/7/2009 2:53:14 PM - Restore Operation
RP9: 2/7/2009 2:55:12 PM - Restore Operation
RP10: 2/8/2009 3:05:13 PM - System Checkpoint
RP11: 2/9/2009 11:27:33 PM - System Checkpoint
RP12: 2/11/2009 12:26:31 AM - System Checkpoint
RP13: 2/12/2009 1:24:05 AM - System Checkpoint
RP14: 2/13/2009 2:25:48 AM - System Checkpoint
RP15: 2/14/2009 3:02:01 AM - System Checkpoint
RP16: 2/15/2009 4:02:01 AM - System Checkpoint
RP17: 2/16/2009 5:02:01 AM - System Checkpoint
RP18: 2/16/2009 4:13:17 PM - Installed Adobe Reader 7.0.8
RP19: 2/16/2009 4:35:28 PM - Installed Battlefield Vietnam™
RP20: 2/16/2009 4:41:54 PM - Installed Medal of Honor Pacific Assault™
RP21: 2/18/2009 12:48:45 PM - System Checkpoint
RP22: 2/19/2009 1:44:19 PM - System Checkpoint
RP23: 2/20/2009 2:24:58 PM - System Checkpoint
RP24: 2/21/2009 3:24:58 PM - System Checkpoint
RP25: 2/22/2009 4:26:03 PM - System Checkpoint
RP26: 2/23/2009 5:24:58 PM - System Checkpoint
RP27: 2/24/2009 6:24:58 PM - System Checkpoint
RP28: 2/25/2009 6:26:03 PM - System Checkpoint
RP29: 2/26/2009 7:24:58 PM - System Checkpoint
RP30: 2/27/2009 8:17:34 PM - System Checkpoint
RP31: 2/28/2009 9:32:04 PM - System Checkpoint
RP32: 3/1/2009 10:16:29 PM - System Checkpoint
RP33: 3/2/2009 10:29:27 PM - System Checkpoint
RP34: 3/3/2009 11:44:05 PM - System Checkpoint
RP35: 3/5/2009 12:08:38 AM - System Checkpoint
RP36: 3/6/2009 1:06:33 AM - System Checkpoint
RP37: 3/7/2009 1:07:38 AM - System Checkpoint
RP38: 3/8/2009 10:36:46 PM - System Checkpoint
RP39: 3/9/2009 10:41:41 PM - System Checkpoint
RP40: 3/10/2009 11:41:41 PM - System Checkpoint
RP41: 3/12/2009 12:17:19 AM - System Checkpoint
RP42: 3/15/2009 10:42:55 PM - System Checkpoint
RP43: 3/16/2009 11:21:02 PM - System Checkpoint
RP44: 3/17/2009 11:23:22 PM - System Checkpoint
RP45: 3/19/2009 12:06:54 AM - System Checkpoint
RP46: 3/20/2009 12:52:11 AM - System Checkpoint
RP47: 3/21/2009 1:06:42 AM - System Checkpoint
RP48: 3/23/2009 10:28:36 PM - System Checkpoint
RP49: 3/24/2009 3:11:51 PM - Restore Operation

==== Installed Programs ======================

AC3Filter (remove only)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.8
ANIO Service
ANIWZCS2 Service
AppCore
AVS Video Converter 6
AVS4YOU Software Navigator 1.3
BitComet 1.09
C-Media PCI Audio Device
CA Yahoo! Anti-Spy (remove only)
ccCommon
CoffeeCup Direct FTP 6.5.5
Component Framework
Google Chrome
Google Earth
Google Update Helper
Google Updater
Java™ 6 Update 11
LimeWire 5.0.11
LiveUpdate (Symantec Corporation)
Medal of Honor Pacific Assault™
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Norton AntiVirus
Norton AntiVirus Help
Norton Internet Security
Norton Protection Center
PCI Audio Driver
RangeBooster G WDA-2320
Rogers Yahoo! Applications
Security Status
SPBBC 32bit
Symantec Real Time Storage Protection Component
SymNet
WebFldrs XP
Windows Installer 3.1 (KB893803)
WinRAR archiver
Xvid 1.1.3 final uninstall

==== Event Viewer Messages From Past Week ========

3/20/2009 10:19:31 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
3/24/2009 3:04:08 PM, error: System Error [1003] - Error code 100000ea, parameter1 863bc840, parameter2 864eb3f0, parameter3 f7c55cb4, parameter4 00000001.
3/24/2009 3:08:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
3/24/2009 3:08:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/24/2009 3:09:32 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
3/24/2009 3:09:47 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
3/24/2009 3:09:47 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/24/2009 3:09:47 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
3/24/2009 3:09:47 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/24/2009 3:09:47 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 eeCtrl Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SRTSPX SYMTDI Tcpip
3/24/2009 4:22:20 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 eeCtrl Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SPBBCDrv SRTSPX SYMTDI Tcpip

==== End Of File ===========================


DDS (Ver_09-03-16.01) - NTFSx86
Run by Mike & Shell at 22:45:52.99 on Tue 03/24/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1152.618 [GMT -5:00]

AV: Norton Security Online *On-access scanning enabled* (Updated)
FW: Norton Security Online *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\D-Link\RangeBooster G WDA-2320\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Symantec Shared\SecurityStatusSDK\SSDK02.exe
C:\Program Files\CA Yahoo! Anti-Spy\CAYahooAntispy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navw32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mike & Shell\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.theweathernetwork.com/weather/caon0040
uSearch Page = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sp/*http://www.yahoo.com
uSearch Bar = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
mDefault_Search_URL = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/su/*http://www.yahoo.com
mSearch Page = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sp/*http://www.yahoo.com
mSearch Bar = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
uSearchURL,(Default) = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/su/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.1.15.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mRun: [D-Link RangeBooster G WDA-2320] c:\program files\d-link\rangebooster g wda-2320\AirPlusCFG.exe
mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe
mRun: [YOP] c:\progra~1\yahoo!\yop\yop.exe /autostart
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [osCheck] "c:\program files\norton internet security\osCheck.exe"
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.3.1.15.dll/206
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

============= SERVICES / DRIVERS ===============

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2009-2-4 547744]
R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2009-2-4 57376]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090324.023\NAVENG.SYS [2009-3-24 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090324.023\NAVEX15.SYS [2009-3-24 876144]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2007-8-28 23888]

=============== Created Last 30 ================

2009-03-07 12:38 <DIR> --d----- c:\program files\AVS4YOU
2009-03-07 12:35 <DIR> --d----- c:\docume~1\mike&s~1\applic~1\AVS4YOU
2009-03-04 09:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVS4YOU
2009-03-03 23:26 <DIR> --d----- c:\program files\common files\AVSMedia
2009-03-03 23:26 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-03-03 23:26 974,848 a------- c:\windows\system32\mfc70.dll
2009-03-03 23:26 487,424 a------- c:\windows\system32\msvcp70.dll
2009-03-03 23:26 24,576 a------- c:\windows\system32\msxml3a.dll
2009-03-03 22:41 5,632 a------- c:\windows\system32\ptpusb.dll
2009-03-03 22:40 159,232 a------- c:\windows\system32\ptpusd.dll
2009-03-03 22:40 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-03-03 22:40 15,104 a------- c:\windows\system32\drivers\usbscan.sys

==================== Find3M ====================

2009-02-19 12:03 579,464 a------- c:\windows\system32\SymNeti.dll
2009-02-19 12:03 207,240 a------- c:\windows\system32\SymRedir.dll
2009-02-19 11:31 31,280 a------- c:\windows\system32\drivers\SymIM.sys
2009-02-19 11:31 9,844 a------- c:\windows\system32\drivers\SymRedir.cat
2009-02-19 11:31 1,611 a------- c:\windows\system32\drivers\SymRedir.inf
2009-02-19 11:31 41,008 a------- c:\windows\system32\drivers\symndisv.sys
2009-02-19 11:31 184,496 a------- c:\windows\system32\drivers\symtdi.sys
2009-02-19 11:31 96,560 a------- c:\windows\system32\drivers\symfw.sys
2009-02-19 11:31 38,576 a------- c:\windows\system32\drivers\symids.sys
2009-02-19 11:31 37,424 a------- c:\windows\system32\drivers\symndis.sys
2009-02-19 11:31 22,320 a------- c:\windows\system32\drivers\symredrv.sys
2009-02-19 11:31 13,616 a------- c:\windows\system32\drivers\symdns.sys
2009-02-18 12:26 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-10 09:32 124,464 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-02-10 09:32 60,808 a------- c:\windows\system32\S32EVNT1.DLL
2009-02-10 09:32 10,635 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-02-10 09:32 806 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-02-07 15:00 2,560 a------- c:\windows\_MSRSTRT.EXE
2009-02-05 00:14 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-04 22:42 21,640 a------- c:\windows\system32\emptyregdb.dat

============= FINISH: 22:46:54.19 ===============


THANK YOU.

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,963 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:07:03 AM

Posted 03 April 2009 - 01:48 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. You can find information on A/V control HERE

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,963 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:07:03 AM

Posted 11 April 2009 - 03:43 PM

Due to the lack of feedback, this Topic is now closed.

In case you still have problems, please start a new topic.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users