Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My Computer Seems To Be Infected With Worm.vb.dw


  • This topic is locked This topic is locked
5 replies to this topic

#1 rushie82

rushie82

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:10 AM

Posted 22 February 2007 - 02:33 PM

i seem to have picked up a worm from the peer to peer file sharing program Limewire. It detects on my virus scan program but it doesnt delete it. That file is skipped. Its path is C:\Program files\outlook\p.zip but i cant find that file on my computer. Please help me remove this worm from my pc. Here is my hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 1:00:41 AM, on 2/23/2007
Platform: Windows XP SP2, v.2096 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2096)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\iConnect\iConnect.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.intervideo.com/jsp/Product_Prom...p;locale=0x0409
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - C:\PROGRA~1\YETISP~1\IEBUTT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINCINEMAMGR] "C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [IridiumTimeWizard] D:\rushab\getright\iridium.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: M-W Link to CollegiateŽ Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{98C48711-DC45-4CED-A346-48A5F05AB2D4}: NameServer = 203.109.127.21 203.187.192.12
O17 - HKLM\System\CCS\Services\Tcpip\..\{A25B829F-FE7C-4261-8434-A8B675E63042}: NameServer = 203.187.192.15,203.187.192.12
O20 - AppInit_DLLs: C:\PROGRA~1\CATCOM~1\QUICKH~2\wl_hook.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NT Online Protection - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: Quick Heal Total Security Mail Protection - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Quick Heal Total Security Helper Service WSC (ScanWscS) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe

BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:01:40 AM

Posted 22 February 2007 - 02:43 PM

Welcome rushie82 :thumbsup:

Download ATF Cleaner by Atribune:
http://www.atribune.org/ccount/click.php?id=1

Double-click ATF-Cleaner.exe to run the program.
Click 'Select All' found at the bottom of the list.
Click the 'Empty Selected' button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

If you use Opera browser,do this also:
Click Opera at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

Click 'Exit' on the Main menu to close the program.

****************************

Please make sure all hidden files are showing:

* Click 'Start'.
* Open 'My Computer'.
* Select the 'Tools' menu and click 'Folder Options'.
* Select the 'View' tab.
* Under the 'Hidden files and folders' heading select 'Show hidden files and folders'.
* Uncheck the 'Hide file extensions for known types' option.
* Uncheck the 'Hide protected operating system files (recommended)' option.
* Click Yes to confirm.
* Click OK.

*****************************

Download/install AVG Anti-Spyware 7.5.

Please follow these instructions carefully.

Launch/start up AVG Anti-Spyware.
On the main page click the 'Update' tab,and then 'Start Update'.
Once the updates have been installed,do the following:
Select the 'Scanner' icon at the top of the screen, then select the 'Settings' tab.
Once in the 'Settings' screen,under 'How to act?',then under 'Set default action for detected malware to:', click on 'Recommended actions',then click on 'Quarantine'.
Under 'Reports' select 'Automatically generate report after every scan' and unselect 'Only if threats were found'.
Exit AVG Anti-Spyware,don't run the scan just yet.

You might want to print/copy the following as you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE" using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:

O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -


Find and delete:
C:\Program Files\outlook

Still in Safe Mode launch AVG Anti-Spyware.
Click the 'Scanner' icon at the top.
To start the scan click on 'Complete System Scan'.
Please be patient,it takes a while for the scan to finish.

Once the scan is complete,do the following.
If AVG Anti-Spyware detected any infected objects:,click on 'Apply All Actions'.
Next click on 'Save Report'.
Copy and paste that report into your next reply.
The report can be found under the 'Reports' tab at the top.
Close AVG Anti-Spyware when you've done.
Reboot normally.

Post the AVG Anti Spyware report and a new Hijackthis log into your next reply.
Let me know how your pc is running now please.
Posted Image
Posted Image

#3 rushie82

rushie82
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:10 AM

Posted 22 February 2007 - 04:48 PM

Hi i did all the things u asked me to do. ATF cleaner cleaned about 84 mb worth of stuff. i fixed all files that u asked me to fix with hijackthis and then AVG anti-spyware scan found lot of stuff on my pc that i cleaned as u asked to.
Here is the AVG anti-spyware log as well as latest hijackthis log.


+ Created at: 2:53:25 AM 2/23/2007

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1757981266-117609710-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A29A79A-B9C8-44A9-BEDF-7FADDE3CF33F} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-1757981266-117609710-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C95FE080-8F5D-11D2-A20B-00AA003C157A} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061270.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061290.exe -> Backdoor.EggDrop.v : Cleaned with backup (quarantined).
C:\WINDOWS\system32\egaccess4_1067.dll -> Dialer.Egroup : Cleaned with backup (quarantined).
HKU\S-1-5-21-1757981266-117609710-725345543-1003\Software\EGDHTML -> Dialer.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061259.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061288.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061295.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061296.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061297.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061298.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061299.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061300.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061301.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061302.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061303.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061304.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061305.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061306.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061307.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061308.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061309.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061310.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061311.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061312.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061313.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061314.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061315.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061316.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061317.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061318.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061319.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061320.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061321.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061322.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061323.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061324.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061325.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061326.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061327.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061328.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061329.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061330.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061331.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061332.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061333.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061334.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061335.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061336.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061337.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061338.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061339.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061340.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061341.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061342.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061343.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061344.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061345.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061346.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061347.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061348.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061349.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061350.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061351.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061352.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061353.exe -> Dropper.VB.lu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061271.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{168E5AF0-1ABA-4FF3-BCB8-6BA0CD893CF2}\RP96\A0061354.exe -> Worm.VB.dw : Cleaned with backup (quarantined).


::Report end


Logfile of HijackThis v1.99.1
Scan saved at 3:04:16 AM, on 2/23/2007
Platform: Windows XP SP2, v.2096 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2096)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iConnect\iConnect.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.intervideo.com/jsp/Product_Prom...p;locale=0x0409
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - C:\PROGRA~1\YETISP~1\IEBUTT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINCINEMAMGR] "C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [IridiumTimeWizard] D:\rushab\getright\iridium.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: M-W Link to CollegiateŽ Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{98C48711-DC45-4CED-A346-48A5F05AB2D4}: NameServer = 203.109.127.21 203.187.192.12
O17 - HKLM\System\CCS\Services\Tcpip\..\{A25B829F-FE7C-4261-8434-A8B675E63042}: NameServer = 203.187.192.15,203.187.192.12
O20 - AppInit_DLLs: C:\PROGRA~1\CATCOM~1\QUICKH~2\wl_hook.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NT Online Protection - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: Quick Heal Total Security Mail Protection - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Quick Heal Total Security Helper Service WSC (ScanWscS) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:01:40 AM

Posted 22 February 2007 - 05:01 PM

You've no virus protection installed.
Download\install AVG Free Edition Antivirus:
http://free.grisoft.com/softw/70free/setup...ree_441a944.exe
Update AVG's virus definitions and run a full system virus scan.

***************************

Your log is clean :thumbsup:
If all's ok,please do the following:

Revert these settings beack to default:
* Click 'Start'.
* Open 'My Computer'.
* Select the 'Tools' menu and click 'Folder Options'.
* Select the 'View' tab.
* Under the 'Hidden files and folders' heading select 'Show hidden files and folders'.
* Uncheck the 'Hide file extensions for known types' option.
* Uncheck the 'Hide protected operating system files (recommended)' option.
* Click Yes to confirm.
* Click OK.

Clear your 'System Restore' points by doing the following:
Right-click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
Select 'Turn Off System Restore On All Drives'.
Select 'Apply'.
You will then get the following warning:
"You have chosen to turn off System Restore.
If you continue,all existing restore points will be deleted,and you will not be able to track or undo changes to your computer.
Do you want to turn off System Restore?".
Then select 'Yes',your 'System Restore' directories will be purged.

Turn 'System Restore' back on:
Right click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
Unselect 'Turn Off System Restore On All Drives'.
Select 'Apply',then click 'Ok'.

Create a new 'System Restore' point:
Click on Start/All Programs/Accessories/System Tools/System Restore.
In the 'System Restore' window,click 'Create a Restore Point' button,then click 'Next'.
In the window that appears,enter a description,then click on 'Create',then click 'Close'.
The date and time is created automatically.

You should now go to Windows Update and install any available critical/high priority updates.

Read through the info found here,to help you prevent any possible future infections.
How did I get infected?
http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/

Please Note:
Your version of Sun Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older versions of Sun Java,and then update.
1. Download the latest version of Java Runtime Environment (JRE)
2. Scroll down to where it says 'Java Runtime Environment (JRE) 6.0'.
3. Click the "Download" button to the right.
4. Check the box that says: "Accept License Agreement".
5. The page will refresh.
6. Click on the link to download 'Windows Offline Installation, Multi-language' and save to your desktop.
7. Close any programs you may have running - especially your web browser.
8. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
9. Check any item with Java Runtime Environment (JRE or J2SE) in the name.
10. Click the Change/Remove button.
11. Repeat as many times as necessary to remove each Java versions.
12. Reboot your computer once all Java components are removed.
13. Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
Posted Image
Posted Image

#5 rushie82

rushie82
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:10 AM

Posted 22 February 2007 - 05:14 PM

Ok thanx i will do all those things. My PC is running fine. I was quite surprised to find so many adwares and dialers and droppers being found on my pc. My PC was running fine so i figured i m clean. Glad to have cleared everything. Also can u tell me is it safe to use those peer-to-peer file sharing softwares or should i uninstall Limeware from my pc and not use it. Once again thank you very much. you have been a great help. i cant thank u enough.

#6 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:01:40 AM

Posted 22 February 2007 - 05:18 PM

You're most welcome :flowers:

If you want some good advice steer well clear of file sharing programs,or you're going to end up in all sorts of problems eventually.
Yes you should definitely uninstall Limewire.
:thumbsup:

This thread will now be closed.
If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter.
Everyone else please begin a New Topic.

Edited by RichieUK, 22 February 2007 - 05:19 PM.

Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users