Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple Problems..


  • This topic is locked This topic is locked
14 replies to this topic

#1 jungledeaf

jungledeaf

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 21 May 2007 - 08:39 PM

I am having a couple different pop-ups plauging my computer. I have a.bat infected by zapchast.reg, systemdoctor pop-ups, windows32.exe in task manager, winupd32.exe, sysprot.exe. Spyware doctor scans and finds infected files, but usually cannot delete about 102 of them.

Logfile of HijackThis v1.99.1
Scan saved at 7:19:33 PM, on 5/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\UniPrint\Client\UniPrint.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Richard & Katie\My Documents\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {6590AD6B-1182-4429-AB41-68E34CE3AA9E} - C:\WINDOWS\system32\bym.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [window] windos.exe
O4 - HKLM\..\Run: [sysprot32] sysprot32.exe
O4 - HKLM\..\Run: [UniPrint] C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe
O4 - HKLM\..\Run: [winupd32] winupd32.exe
O4 - HKLM\..\Run: [Microsoft] windows32.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\RunServices: [window] windos.exe
O4 - HKLM\..\RunServices: [sysprot32] sysprot32.exe
O4 - HKLM\..\RunServices: [winupd32] winupd32.exe
O4 - HKLM\..\RunServices: [Microsoft] windows32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Uoau] "C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 22 May 2007 - 04:14 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum jungledeaf :thumbsup:

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

You should copy/print the following because you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE" using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
* Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
* Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan tab" and UNcheck "Heuristic analysis"
* Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
* Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
* When done, a message will be displayed at the bottom advising if any viruses were found.
* Click "Yes to all" if it asks if you want to cure/move the file.
* When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
* Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the DrWeb.csv report to your desktop.
* Exit Dr.Web Cureit when done.
* Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
* After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

*********************************

Please download Combofix and save to your desktop:
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.


*********************************

Download SmitfraudFix (by S!Ri), to your desktop.
Double click on Smitfraudfix.cmd
Select option #1 – Search, by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy and paste the content of that report into your next reply.

Also post a new Hijackthis log please.
Posted Image
Posted Image

#3 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 24 May 2007 - 10:47 PM

Okay, finally had time to do this! It looks like a lot, so I will say thanks in advance :thumbsup:
Here goes..

DrWeb Report:
bym.dll;c:\windows\system32;Adware.ClickSpring;Incurable.Moved.;
nsd19E.tmp;C:\Documents and Settings\David\Local Settings\Temp;Tool.Prockill;Incurable.Deleted.;
A0013290.exe;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP77;Adware.WebHancer;Incurable.Deleted.;
A0014395.exe\data001;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78\A0014395.exe;Adware.ClickSpring;;
A0014395.exe\data002;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78\A0014395.exe;Adware.MediaTicket;;
A0014395.exe\data003;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78\A0014395.exe;Adware.ClickSpring;;
A0014395.exe;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78;Archive contains infected objects;Moved.;
A0014398.exe;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78;Adware.WebHancer;Incurable.Deleted.;
A0015414.exe;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78;Trojan.MulDrop.6135;Deleted.;
A0015417.sys;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78;Trojan.NtRootKit.239;Deleted.;
A0015614.dll;C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79;Adware.ClickSpring;Incurable.Deleted.;
windll.exe;C:\WINDOWS\system32;Win32.HLLW.MyBot;Deleted.;
mirc.exe;F:\Music\mIRC;Program.mIRC.601;Incurable.Deleted.;



ComboFix Report:
2002-10-29 12:41 25657 --a------ C:\Qoobox\Quarantine\C\WINDOWS\install.exe.vir
2007-03-19 12:31 228864 --------- C:\Qoobox\Quarantine\C\DOCUME~1\David\APPLIC~1\WNSXS~1\w?auclt.exe
2007-04-16 16:10 124142 --a------ C:\Qoobox\Quarantine\C\WINDOWS\b136.exe.vir
2007-05-13 23:47 1226240 --a------ C:\Qoobox\Quarantine\C\windows32.exe.vir
2007-05-24 21:24 832 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_CMDSERVICE.reg.cf
2007-05-24 21:24 836 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_CORE.reg.cf
2007-05-24 21:24 862 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NETWORK_MONITOR.reg.cf


Folder PATH listing
Volume serial number is 90DF-0F1B
C:\QOOBOX
\---Quarantine
+---C
| | windows32.exe.vir
| |
| +---DOCUME~1
| | \---David
| | \---APPLIC~1
| | \---WNSXS~1
| | w?auclt.exe
| |
| \---WINDOWS
| b136.exe.vir
| install.exe.vir
|
\---Registry_backups
LEGACY_CMDSERVICE.reg.cf
LEGACY_CORE.reg.cf
LEGACY_NETWORK_MONITOR.reg.cf



SmitFraud Report:
SmitFraudFix v2.186

Scan done at 21:32:54.12, Thu 05/24/2007
Run from C:\Documents and Settings\David\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winupd32.exe
C:\WINDOWS\system32\windos.exe
C:\WINDOWS\system32\winbo32.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\windows32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\David\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller - Packet Scheduler Miniport
DNS Server Search Order: 64.59.184.13
DNS Server Search Order: 64.59.184.15

HKLM\SYSTEM\CCS\Services\Tcpip\..\{06478CF6-FD78-483F-BA94-C9F47F77101C}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS1\Services\Tcpip\..\{06478CF6-FD78-483F-BA94-C9F47F77101C}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS3\Services\Tcpip\..\{06478CF6-FD78-483F-BA94-C9F47F77101C}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

#4 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 24 May 2007 - 10:55 PM

on normal windows login i am getting a notice from norton saying "retadpu206.exe" was deleted..this happens during every login.

#5 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 25 May 2007 - 03:35 AM

Double click on combofix.exe again and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.

Also post a new Hijackthis log please.
Posted Image
Posted Image

#6 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 25 May 2007 - 10:35 PM

:thumbsup: Here is what you asked for:





ComboFix:


"David" - 2007-05-25 21:24:41 Service Pack 2
ComboFix 07-05.25.V - Running from: "C:\Documents and Settings\David\Desktop\"


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 ))))))))))))))))))))))))))))))))))


2007-05-24 21:54 917,504 -ra------ C:\WINDOWS\system\cmids3d.dll
2007-05-24 21:54 712,704 -ra------ C:\WINDOWS\system32\Audio3D.dll
2007-05-24 21:54 315,392 -ra------ C:\WINDOWS\system\cmifltr.dll
2007-05-24 21:33 3,390 --a------ C:\WINDOWS\system32\tmp.reg
2007-05-24 21:31 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-05-24 21:31 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-05-24 21:31 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-05-24 21:30 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-21 19:14 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-05-21 18:44 <DIR> d-------- C:\VundoFix Backups
2007-05-19 17:41 <DIR> d--hs---- C:\WINDOWS\RGF2aWQ
2007-05-19 17:12 2 --a------ C:\WINDOWS\system32\wtssvit32.exe
2007-05-19 17:12 <DIR> d-------- C:\Program Files\Common Files\çasks
2007-05-18 14:06 10,318 --a------ C:\affid.exe
2007-05-16 22:30 58,048 --a------ C:\WINDOWS\system32\drivers\mvstdi5x.sys
2007-05-16 22:30 108,256 --a------ C:\WINDOWS\system32\drivers\naiavf5x.sys
2007-05-16 22:29 <DIR> d-------- C:\Program Files\Network Associates
2007-05-16 22:29 <DIR> d-------- C:\Program Files\Common Files\Network Associates
2007-05-16 22:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
2007-05-05 16:59 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Juniper Networks
2007-04-29 20:55 <DIR> d-------- C:\Program Files\UniPrint
2007-04-29 01:36 640,000 --a------ C:\WINDOWS\system32\dll32exec.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-25 07:02:25 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000009-00001102-00000002-80271102}.dat
2007-05-25 07:02:25 24 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000009-00001102-00000002-80271102}.dat
2007-05-20 18:44:19 -------- d-----w C:\Program Files\Common Files\?asks
2007-05-20 16:40:48 -------- d-----w C:\Program Files\Spyware Doctor
2007-04-25 00:48:20 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-24 05:12:27 -------- d-----w C:\Program Files\Common Files\AnswerWorks 4.0
2007-04-20 03:53:16 33,952 ----a-w C:\WINDOWS\system32\drivers\oreans32.sys
2007-04-19 20:33:56 -------- d-----w C:\Program Files\NAMCO BANDAI Games
2007-04-19 20:13:36 -------- d-----w C:\Program Files\WinImage
2007-04-19 04:04:46 51,072 ----a-w C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-04-19 04:04:44 30,592 ----a-w C:\WINDOWS\system32\drivers\ikhfile.sys
2007-04-19 03:19:26 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 02:55:34 -------- d-----w C:\DOCUME~1\David\APPLIC~1\EPSON
2007-04-07 23:47:56 -------- d-----w C:\Program Files\QUICKENW
2007-04-07 22:25:06 -------- d-----w C:\Program Files\Common Files\Intuit
2007-03-23 12:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll
2007-03-23 12:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll
2007-03-23 02:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
2007-03-07 06:06:40 -------- d-----w C:\Program Files\QuickTime
2007-03-07 06:05:21 -------- d-----w C:\Program Files\Apple Software Update
2007-02-05 20:17:02 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll
2004-08-04 07:56:50 710,656 --sh--r C:\WINDOWS\system32\winbo32.exe
2004-08-04 07:56:50 640,000 --sh--r C:\WINDOWS\system32\windos.exe
2004-08-04 07:56:50 487,936 --sh--r C:\WINDOWS\system32\winupd32.exe
2004-08-04 07:56:50 1,226,240 --sh--r C:\WINDOWS\system32\windows32.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}=C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll [2007-01-03 21:36]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{B56A7D7D-6927-48C8-A975-17DF180C71AC}=C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll [2007-01-03 21:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"winupd32"="winupd32.exe" [2004-08-04 01:56 C:\WINDOWS\system32\winupd32.exe]
"window"="windos.exe" [2004-08-04 01:56 C:\WINDOWS\system32\windos.exe]
"winbo32"="winbo32.exe" [2004-08-04 01:56 C:\WINDOWS\system32\winbo32.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 17:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"@"="" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 18:56 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 02:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54]
"UniPrint"="C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe" [2005-07-20 16:40]
"Microsoft"="windows32.exe" [2004-08-04 01:56 C:\WINDOWS\system32\windows32.exe]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2007-01-03 21:36]
"Uoau"="C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" []
"Pmka"="C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"window"=windos.exe
"winupd32"=winupd32.exe
"Microsoft"=windows32.exe
"winbo32"=winbo32.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime


Contents of the 'Scheduled Tasks' folder
2007-05-03 00:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-25 21:26:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-25 21:27:31
C:\ComboFix-quarantined-files.txt ... 2007-05-25 21:27
C:\ComboFix2.txt ... 2007-05-24 21:30

--- E O F ---






'





HiJack This:


Logfile of HijackThis v1.99.1
Scan saved at 9:30:41 PM, on 5/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\winupd32.exe
C:\WINDOWS\system32\windos.exe
C:\WINDOWS\system32\winbo32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\windows32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Richard & Katie\My Documents\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [winupd32] winupd32.exe
O4 - HKLM\..\Run: [window] windos.exe
O4 - HKLM\..\Run: [winbo32] winbo32.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UniPrint] C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe
O4 - HKLM\..\Run: [Microsoft] windows32.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\RunServices: [window] windos.exe
O4 - HKLM\..\RunServices: [winupd32] winupd32.exe
O4 - HKLM\..\RunServices: [Microsoft] windows32.exe
O4 - HKLM\..\RunServices: [winbo32] winbo32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Uoau] "C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

#7 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 26 May 2007 - 12:28 AM

Download Avenger from the link below:
http://swandog46.geekstogo.com/avenger.zip
Unzip/extract it to your desktop.

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens,copy and paste ALL the following bold blue text in the Quote box below:

Files to delete:
C:\affid.exe
C:\WINDOWS\system32\wtssvit32.exe
C:\WINDOWS\system32\dll32exec.exe
C:\WINDOWS\system32\winbo32.exe
C:\WINDOWS\system32\windos.exe
C:\WINDOWS\system32\winupd32.exe
C:\WINDOWS\system32\windows32.exe

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply.
Also post a new Hijackthis log please.
Posted Image
Posted Image

#8 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 26 May 2007 - 11:13 PM

:thumbsup:

Avenger Logfile
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\dwdrktna

*******************

Script file located at: \??\C:\Documents and Settings\qcawwkyc.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\affid.exe deleted successfully.
File C:\WINDOWS\system32\wtssvit32.exe deleted successfully.
File C:\WINDOWS\system32\dll32exec.exe deleted successfully.
File C:\WINDOWS\system32\winbo32.exe deleted successfully.
File C:\WINDOWS\system32\windos.exe deleted successfully.
File C:\WINDOWS\system32\winupd32.exe deleted successfully.
File C:\WINDOWS\system32\windows32.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.




Hijack This Logfile
Logfile of HijackThis v1.99.1
Scan saved at 10:07:33 PM, on 5/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Richard & Katie\My Documents\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [winupd32] winupd32.exe
O4 - HKLM\..\Run: [window] windos.exe
O4 - HKLM\..\Run: [winbo32] winbo32.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UniPrint] C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe
O4 - HKLM\..\Run: [Microsoft] windows32.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\RunServices: [window] windos.exe
O4 - HKLM\..\RunServices: [winupd32] winupd32.exe
O4 - HKLM\..\RunServices: [Microsoft] windows32.exe
O4 - HKLM\..\RunServices: [winbo32] winbo32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Uoau] "C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

#9 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 27 May 2007 - 04:28 AM

Download/install AVG Anti-Spyware 7.5.

Please follow these instructions very carefully.

Launch/start up AVG Anti-Spyware.
On the main page click the 'Update' tab,and then 'Start Update'.
Note:
If you have any problems running the update process prior to running the scan,download/install the 'Full Database' from here:
http://download.ewido.net/avgas-signatures-full-current.exe

Once the updates have been installed,do the following:
Select the 'Scanner' icon at the top of the screen, then select the 'Settings' tab.
Once in the 'Settings' screen,under 'How to act?',then under 'Set default action for detected malware to:', click on 'Recommended actions',then click on 'Quarantine'.
Under 'Reports' select 'Automatically generate report after every scan' and unselect 'Only if threats were found'.
Exit AVG Anti-Spyware,don't run the scan just yet.

You might want to print/copy the following as you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Have Hijack This fix the following [If still present], by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:

O4 - HKLM\..\Run: [winupd32] winupd32.exe
O4 - HKLM\..\Run: [window] windos.exe
O4 - HKLM\..\Run: [winbo32] winbo32.exe
O4 - HKLM\..\Run: [Microsoft] windows32.exe
O4 - HKLM\..\RunServices: [window] windos.exe
O4 - HKLM\..\RunServices: [winupd32] winupd32.exe
O4 - HKLM\..\RunServices: [Microsoft] windows32.exe
O4 - HKLM\..\RunServices: [winbo32] winbo32.exe
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)


Still in Safe Mode launch AVG Anti-Spyware.
Click the 'Scanner' icon at the top.
To start the scan click on 'Complete System Scan'.
Please be patient,it takes a while for the scan to finish.

Once the scan is complete,do the following.
If AVG Anti-Spyware detected any infected objects:,click on 'Apply All Actions'.

Next click on 'Save Report'.
Copy and paste that report into your next reply.
The report can be found under the 'Reports' tab at the top.
Close AVG Anti-Spyware when you've done.
Reboot normally.

******************************

Run 'BitDefender Online Scanner' using Internet Explorer:
http://www.bitdefender.com/scan8/ie.html
Read the 'END USER SOFTWARE LICENSE AGREEMENT' then click 'I agree'.
You'll be prompted to install the activex control,please do so.
Once installed,disable your current antivirus program,then click the 'Click here to scan' button.
The virus signatures will then load.
Once loaded the scan will start.
The scan will take quite some time so please be patient.
Once the scan has finished select the 'Detected Problems' tab.
Click on 'Click here to export scan'.
Save the file as an HTML file to your desktop.
Then click on the saved file and allow it to open with your browser.
Go to 'Edit'/'Select All' then copy and paste that log into your next reply.
*Note*
Don't forget to re-enable your antivirus program.

Post the AVG Anti Spyware report,the contents of the BitDefender Online Scanner log, and a new Hijackthis log into your next reply.
Let me know how your pc is running now please.
Posted Image
Posted Image

#10 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 27 May 2007 - 01:30 PM

Thanks so far RichieUK!! My computer is definately running much more smoothly.
It was lagging basic functions in the OS prior to your help and would sporadically
hiccup as whatever inflictions were bullying my system. The internet seems to be
back to what it should be.

Here are the logs:

AVG Report
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 07:51 2007-05-27

+ Scan result:



C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\bym.dll -> Adware.PurityScan : Cleaned.
C:\QooBox\Quarantine\C\DOCUME~1\David\APPLIC~1\WNSXS~1\wυauclt.exe -> Adware.PurityScan : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP78\A0015411.exe -> Adware.PurityScan : Cleaned.
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir -> Adware.Softomate : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015709.exe -> Adware.Softomate : Cleaned.
C:\WINDOWS\b129.exe -> Adware.WebHancer : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP63\A0011206.exe -> Backdoor.Rbot.ccd : Cleaned.
C:\Documents and Settings\Administrator\DoctorWeb\Quarantine\A0014395.exe -> Downloader.PurityScan.eh : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP77\A0013273.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015577.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015587.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015596.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015606.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015626.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015645.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015724.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015780.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015829.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP80\A0015858.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP80\A0015868.exe -> Downloader.Small.eqn : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP80\A0016866.exe -> Downloader.Small.eqn : Cleaned.
:mozilla.143:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.144:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.145:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.146:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.117:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.118:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.119:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.120:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.121:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.122:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.123:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.266:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.30:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.31:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.32:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.33:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.34:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@microsoftgamestudio.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.14:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.16:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.18:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
F:\2Richard\Cookies\richard@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
F:\David\Cookies\david@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.351:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.352:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adobe : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@www.adobe[1].txt -> TrackingCookie.Adobe : Cleaned.
F:\2Richard\Cookies\richard@www.adobe[2].txt -> TrackingCookie.Adobe : Cleaned.
F:\David\Cookies\david@www.adobe[1].txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.252:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.253:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.38:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.41:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.42:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.43:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.19:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.38:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.181:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
F:\2Richard\Cookies\richard@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.292:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.295:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
F:\2Richard\Cookies\richard@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
F:\2Richard\Cookies\richard@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.35:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
F:\2Richard\Cookies\richard@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.10:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.8:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.99:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.9:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.197:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.198:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
F:\2Richard\Cookies\richard@ad1.clickhype[2].txt -> TrackingCookie.Clickhype : Cleaned.
F:\2Richard\Cookies\richard@clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
F:\2Richard\Cookies\richard@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
F:\2Richard\Cookies\richard@ads.cnn[1].txt -> TrackingCookie.Cnn : Cleaned.
:mozilla.139:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.142:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Com : Cleaned.
F:\2Richard\Cookies\richard@com[1].txt -> TrackingCookie.Com : Cleaned.
F:\2Richard\Cookies\richard@connextra[1].txt -> TrackingCookie.Connextra : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned.
F:\2Richard\Cookies\richard@dealtime[1].txt -> TrackingCookie.Dealtime : Cleaned.
:mozilla.45:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.88:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.20:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.239:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.240:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.241:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.242:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.302:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.303:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@ehg-chrysler.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@ehg-groupernetworks.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.342:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.343:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.344:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.345:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.224:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.225:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@searchportal.information[2].txt -> TrackingCookie.Information : Cleaned.
F:\2Richard\Cookies\richard@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@search.live[1].txt -> TrackingCookie.Live : Cleaned.
F:\2Richard\Cookies\richard@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
F:\2Richard\Cookies\richard@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.226:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
F:\2Richard\Cookies\richard@ie.search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
F:\2Richard\Cookies\richard@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
:mozilla.270:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\David\Cookies\david@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Cleaned.
F:\2Richard\Cookies\richard@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.
F:\David\Cookies\david@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.100:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.35:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.36:F:\David\Application Data\Mozilla\Firefox\Profiles\8jobtqz3.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
F:\David\Cookies\david@data1.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.73:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.23:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.24:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.25:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.26:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.27:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.
F:\2Richard\Cookies\richard@network.realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.204:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.205:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.206:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.207:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.208:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.209:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.210:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.211:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.196:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.199:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
F:\2Richard\Cookies\richard@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.66:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.67:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.68:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.69:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.130:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.137:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.140:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.141:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.293:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.294:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
F:\2Richard\Cookies\richard@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
F:\David\Cookies\david@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.50:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@targetnet[2].txt -> TrackingCookie.Targetnet : Cleaned.
F:\2Richard\Cookies\richard@toplist[1].txt -> TrackingCookie.Toplist : Cleaned.
:mozilla.77:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.78:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.47:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.58:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.59:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.60:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.61:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.82:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.83:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.84:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.85:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.86:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.87:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\Claire\Cookies\claire@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
F:\2Richard\Cookies\richard@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
F:\David\Cookies\david@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned.
F:\2Richard\Cookies\richard@free.wegcash[2].txt -> TrackingCookie.Wegcash : Cleaned.
:mozilla.11:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.12:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.13:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
F:\2Richard\Cookies\richard@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.132:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.136:F:\2Richard\Application Data\Mozilla\Firefox\Profiles\zvt0o2ts.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Richard & Katie\Cookies\richard_&_katie@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015615.exe -> Trojan.Agent : Cleaned.
F:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP58\A0009927.EXE/setup.exe -> Trojan.Agent : Cleaned.
C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016937.exe -> Trojan.Small : Cleaned.


::Report end



Bitdefender Log
BitDefender Online Scanner



Scan report generated at: Sun, May 27, 2007 - 09:10:52





Scan path: A:\;C:\;D:\;E:\;F:\;







Statistics

Time
01:10:02

Files
655855

Folders
7507

Boot Sectors
3

Archives
3154

Packed Files
75831




Results

Identified Viruses
7

Infected Files
22

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
22




Engines Info

Virus Definitions
508833

Engine build
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\avenger\backup.zip=>avenger/winbo32.exe
Infected with: DeepScan:Generic.Sdbot.BB7C98F8

C:\avenger\backup.zip=>avenger/winbo32.exe
Disinfection failed

C:\avenger\backup.zip=>avenger/winbo32.exe
Deleted

C:\avenger\backup.zip
Updated

C:\avenger\backup.zip=>avenger/windows32.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\avenger\backup.zip=>avenger/windows32.exe
Disinfection failed

C:\avenger\backup.zip=>avenger/windows32.exe
Deleted

C:\avenger\backup.zip
Updated

C:\avenger\backup.zip=>avenger/winupd32.exe
Infected with: DeepScan:Generic.Sdbot.F9FDF115

C:\avenger\backup.zip=>avenger/winupd32.exe
Disinfection failed

C:\avenger\backup.zip=>avenger/winupd32.exe
Deleted

C:\avenger\backup.zip
Updated

C:\QooBox\Quarantine\C\windows32.exe.vir
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\QooBox\Quarantine\C\windows32.exe.vir
Disinfection failed

C:\QooBox\Quarantine\C\windows32.exe.vir
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011474.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011474.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011474.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011482.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011482.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011482.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011490.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011490.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011490.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011497.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011497.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011497.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011499.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011499.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011499.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011500.exe
Infected with: DeepScan:Generic.Sdbot.F9FDF115

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011500.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP70\A0011500.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011523.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011523.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011523.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011525.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011525.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011525.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011542.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011542.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011542.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011553.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011553.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP71\A0011553.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015576.exe
Infected with: DeepScan:Generic.Sdbot.0D0B622B

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015576.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015576.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015707.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015707.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015707.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016933.exe
Infected with: DeepScan:Generic.Sdbot.BB7C98F8

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016933.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016933.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016935.exe
Infected with: DeepScan:Generic.Malware.G!I!!FLWX!!Bprng.770EA1FB

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016935.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016935.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016936.exe
Infected with: DeepScan:Generic.Sdbot.F9FDF115

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016936.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016936.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016966.exe
Infected with: Trojan.Downloader.PurityScan.CR

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016966.exe
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016966.exe
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016969.exe=>(NSIS o)=>lzma_solid_nsis0006
Infected with: Trojan.Dloader.AFR

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016969.exe=>(NSIS o)=>lzma_solid_nsis0006
Disinfection failed

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016969.exe=>(NSIS o)=>lzma_solid_nsis0006
Deleted

C:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP81\A0016969.exe=>(NSIS o)
Update failed

F:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015616.exe
Infected with: Trojan.Mirchack.A

F:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015616.exe
Disinfection failed

F:\System Volume Information\_restore{91303A77-69C6-438F-A588-35A6025E7D0E}\RP79\A0015616.exe
Deleted



Hijack This Log
Logfile of HijackThis v1.99.1
Scan saved at 12:25:27 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Documents and Settings\Richard & Katie\My Documents\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UniPrint] C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Uoau] "C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

:thumbsup:

#11 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 27 May 2007 - 02:30 PM

Double click on combofix.exe again and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Posted Image
Posted Image

#12 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 27 May 2007 - 04:24 PM

Combo fix:

"David" - 2007-05-27 15:17:34 Service Pack 2
ComboFix 07-05.25.V - Running from: "C:\Documents and Settings\David\Desktop\"


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-27 ))))))))))))))))))))))))))))))))))


2007-05-27 07:59 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-05-27 07:16 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-05-26 22:05 <DIR> d-------- C:\avenger
2007-05-24 21:54 917,504 -ra------ C:\WINDOWS\system\cmids3d.dll
2007-05-24 21:54 712,704 -ra------ C:\WINDOWS\system32\Audio3D.dll
2007-05-24 21:54 315,392 -ra------ C:\WINDOWS\system\cmifltr.dll
2007-05-24 21:33 3,390 --a------ C:\WINDOWS\system32\tmp.reg
2007-05-24 21:31 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-05-24 21:31 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-05-24 21:31 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-05-24 21:30 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-21 19:14 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-05-21 18:44 <DIR> d-------- C:\VundoFix Backups
2007-05-19 17:41 <DIR> d--hs---- C:\WINDOWS\RGF2aWQ
2007-05-19 17:12 <DIR> d-------- C:\Program Files\Common Files\çasks
2007-05-16 22:30 58,048 --a------ C:\WINDOWS\system32\drivers\mvstdi5x.sys
2007-05-16 22:30 108,256 --a------ C:\WINDOWS\system32\drivers\naiavf5x.sys
2007-05-16 22:29 <DIR> d-------- C:\Program Files\Network Associates
2007-05-16 22:29 <DIR> d-------- C:\Program Files\Common Files\Network Associates
2007-05-16 22:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
2007-05-05 16:59 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Juniper Networks
2007-04-29 20:55 <DIR> d-------- C:\Program Files\UniPrint


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 18:42:41 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000009-00001102-00000002-80271102}.dat
2007-05-27 18:42:41 24 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000009-00001102-00000002-80271102}.dat
2007-05-20 18:44:19 -------- d-----w C:\Program Files\Common Files\?asks
2007-05-20 16:40:48 -------- d-----w C:\Program Files\Spyware Doctor
2007-04-25 00:48:20 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-24 05:12:27 -------- d-----w C:\Program Files\Common Files\AnswerWorks 4.0
2007-04-20 03:53:16 33,952 ----a-w C:\WINDOWS\system32\drivers\oreans32.sys
2007-04-19 20:33:56 -------- d-----w C:\Program Files\NAMCO BANDAI Games
2007-04-19 20:13:36 -------- d-----w C:\Program Files\WinImage
2007-04-19 04:04:46 51,072 ----a-w C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-04-19 04:04:44 30,592 ----a-w C:\WINDOWS\system32\drivers\ikhfile.sys
2007-04-19 03:19:26 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 02:55:34 -------- d-----w C:\DOCUME~1\David\APPLIC~1\EPSON
2007-04-07 23:47:56 -------- d-----w C:\Program Files\QUICKENW
2007-04-07 22:25:06 -------- d-----w C:\Program Files\Common Files\Intuit
2007-03-23 12:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll
2007-03-23 12:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll
2007-03-23 02:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
2007-03-07 06:06:40 -------- d-----w C:\Program Files\QuickTime
2007-03-07 06:05:21 -------- d-----w C:\Program Files\Apple Software Update
2007-02-05 20:17:02 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}=C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll [2007-01-03 21:36]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{B56A7D7D-6927-48C8-A975-17DF180C71AC}=C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll [2007-01-03 21:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 17:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"@"="" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 18:56 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 02:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54]
"UniPrint"="C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe" [2005-07-20 16:40]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 06:20]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2007-01-03 21:36]
"Uoau"="C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" []
"Pmka"="C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 08:13]

*Newly Created Service* -ENTDRV51

Contents of the 'Scheduled Tasks' folder
2007-05-03 00:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 15:19:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-27 15:19:52
C:\ComboFix-quarantined-files.txt ... 2007-05-27 15:19
C:\ComboFix2.txt ... 2007-05-25 21:27
C:\ComboFix3.txt ... 2007-05-24 21:30

--- E O F ---





















hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 3:21:06 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Richard & Katie\My Documents\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UniPrint] C:\PROGRA~1\UniPrint\Client\SetDfltSettings.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Uoau] "C:\PROGRA~1\COMMON~1\ASKS~1\netdde.exe" -vt yazb
O4 - HKCU\..\Run: [Pmka] "C:\Documents and Settings\David\Application Data\W?nSxS\w?auclt.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

#13 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 27 May 2007 - 04:46 PM

Copy and paste the following bold blue text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as..Save as Type: 'All Files' File name: fix.reg to your desktop.
Then double click on the fix.reg file on your desktop and agree to merge it into the registry,then reboot.

REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uoau"=-
"Pmka"=-

****************************

Download\install CleanUp.
Launch CleanUp,then click on 'Options'.
Now move the slider on the left up to 'Standard Cleanup!'.
Click 'Ok',now run the program by clicking on the 'Cleanup' button.
Reboot,or log off/log on when it's finished.

****************************

Your log is clean :thumbsup:
If all's ok,please do the following:

Find and delete:
Combofix
SmitfraudFix
Avenger

C:\VundoFix Backups
C:\QooBox
C:\Avenger

Click on Start/All Programs/Accessories/System Tools/System Restore.
In the 'System Restore' window,click on the 'Create a Restore Point' button,then click 'Next'.
In the window that appears,enter a description\name for the Restore Point,then click on 'Create',wait,then click 'Close'.
The date and time will be created automatically.

Next click on Start/All Programs/Accessories/System Tools/Disk Cleanup.
The 'Select Drive' box will appear,click on Ok.
The 'Disk Cleanup for [C:]' box will appear,click on the 'More Options' tab.
At the bottom in the 'System Restore' window,click on the 'Clean up...' button.
A box will pop up 'Are you sure you want to delete all but the most recent restore point?',click on 'Yes'.
Click on 'Yes' at 'Are you sure you want to perform these actions?'.
Now wait until 'Disk Cleanup' finishes and the box disappears.

Read through the information found here,to help you prevent any possible future infections.
'How to prevent Malware' by miekiemoes:
http://users.telenet.be/bluepatchy/miekiem...prevention.html
Posted Image
Posted Image

#14 jungledeaf

jungledeaf
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 27 May 2007 - 05:20 PM

You are a wizard and a gentleman! Thank you! :thumbsup:

#15 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:04:59 PM

Posted 27 May 2007 - 05:43 PM

You're most welcome :thumbsup:

This thread will now be closed.
If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you.
Include the address of this thread in your request.
If you should have a new issue, please start a new topic.
This applies only to the original topic starter.
Everyone else please begin a New Topic.
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users