Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Post cleanup problems


  • Please log in to reply
3 replies to this topic

#1 Oowo

Oowo

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 18 June 2007 - 05:25 PM

Papakid,

Thanks so much for all of your help and advice. I followed all of your instructions. So far (today) my only problems have been (still) the frequent loss of connectivity to the internet and the fluctuating Wireless Network speeds running quickly from "Low" to "Very Good" to "Good" constantly.

I upgraded my Java, ran CCleaner, deleted AVG7.5 (as you said it may conflict with SpySweeper), did a disk defrag and downloaded and ran Deckard's System Scanner - however, I was unable to find the extra.txt file. I looked in the folder C:\Deckard\System Scanner and throughout the Deckard file and could not find it anywhere. The only file I could find was the main.txt file.

Here is my DSS main.txt:

Deckard's System Scanner v20070611.50
Run by Owner on 2007-06-18 at 18:11:47
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Owner.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 6:11:58 PM, on 6/18/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1172825992515
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1172825953859
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)


-- Files created between 2007-05-18 and 2007-06-18 -----------------------------

2007-06-18 17:39:04 0 dr-h----- C:\Documents and Settings\Owner\Recent
2007-06-18 17:05:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-06-18 16:44:44 3563520 --a------ C:\Documents and Settings\Owner\ntuser.dat
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Lavasoft
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Keynote Systems
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\InterTrust
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\interMute
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Identities
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Help
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Apple Computer
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Aim
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Adobe
2007-06-17 08:24:45 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Macromedia
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Favorites
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Desktop
2007-06-17 08:24:44 0 d---s---- C:\Documents and Settings\Administrator.OWNER\Cookies
2007-06-17 08:24:44 0 dr-h----- C:\Documents and Settings\Administrator.OWNER\Application Data
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Webroot
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Weather Studio(2)
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Symantec
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Sonic
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\SampleView
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Real
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Motive
2007-06-17 08:24:44 0 d---s---- C:\Documents and Settings\Administrator.OWNER\Application Data\Microsoft
2007-06-17 08:24:42 0 d-------- C:\Documents and Settings\Administrator.OWNER\WINDOWS
2007-06-17 08:24:42 0 d---s---- C:\Documents and Settings\Administrator.OWNER\UserData
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Templates
2007-06-17 08:24:42 0 dr------- C:\Documents and Settings\Administrator.OWNER\Start Menu
2007-06-17 08:24:42 0 dr-h----- C:\Documents and Settings\Administrator.OWNER\SendTo
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Recent
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\PrintHood
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\NetHood
2007-06-17 08:24:42 0 d-------- C:\Documents and Settings\Administrator.OWNER\My Documents
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Local Settings
2007-06-17 08:24:41 405504 --a------ C:\Documents and Settings\Administrator.OWNER\NTUSER.DAT
2007-06-12 07:28:32 4776 --a------ C:\Program Files\CCleaner_Backup.reg
2007-06-12 05:48:22 0 d--h----- C:\WINDOWS\PIF
2007-06-12 04:52:00 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-06-12 04:42:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\interMute
2007-06-11 18:21:53 8704 --a------ C:\WINDOWS\System32\regapi.exe
2007-06-04 19:26:16 20045 --a------ C:\Program Files\cc_20070604_1925.reg
2007-06-04 19:13:20 0 d-------- C:\Program Files\CCleaner
2007-06-04 07:47:55 50688 --a------ C:\Program Files\ATF-Cleaner.exe <Not Verified; Atribune.org; ATF Cleaner>
2007-05-31 14:38:46 0 --a------ C:\Documents and Settings\Owner\netsh
2007-05-31 05:24:11 0 d-------- C:\WINDOWS\System32\ActiveScan
2007-05-31 02:43:56 77312 --a------ C:\WINDOWS\ua2.dll
2007-05-22 16:41:42 0 d-------- C:\Program Files\Last.fm


-- Find3M Report ---------------------------------------------------------------

2007-06-18 17:29:37 0 d-------- C:\Program Files\Java
2007-06-13 14:40:00 0 d-------- C:\Program Files\Lavasoft
2007-06-12 04:52:39 364 --a------ C:\WINDOWS\System32\tmp.reg
2007-06-04 19:56:06 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-04 09:19:41 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2007-06-04 09:15:01 0 d-------- C:\Program Files\a-squared Free
2007-05-31 05:59:58 0 d-------- C:\Program Files\MSN Messenger
2007-05-25 20:00:28 0 d-------- C:\Documents and Settings\Owner\Application Data\Macromedia
2007-05-11 18:22:09 0 d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2007-05-11 10:23:52 0 d-------- C:\Program Files\Enigma Software Group
2007-04-29 19:56:26 0 d-------- C:\Program Files\Firaxis Games
2007-04-29 19:53:18 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-04-29 19:52:38 0 d-------- C:\Documents and Settings\Owner\Application Data\My Games
2007-03-24 23:57:29 0 --a------ C:\autoexec.bat


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="aim"
"hkey"="HKCU"
"command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="KBD"
"hkey"="HKLM"
"command"="C:\\HP\\KBD\\KBD.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SpySweeperUI"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cf2b8eb8-c5d9-11db-a35a-806d6172696f}]
Shell\AutoRun\command D:\Info.exe folder.htt 480 480
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_GTNDIS5


-- End of Deckard's System Scanner: finished at 2007-06-18 at 18:12:24 ---------


Thanks again for your help. I really appreciate it!!!!!!

Edited by Oowo, 18 June 2007 - 05:26 PM.


BC AdBot (Login to Remove)

 


#2 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:39 AM

Posted 19 June 2007 - 12:03 AM

Hey Oowo, you're welcome for the help.

Did you run DSS from the desktop? Sounds like a little thing but it makes a difference. If not, go to whatever folder you saved it to, right click on dss.exe, choose copy (or cut), then go to your desktop, right click on open area and choose paste. Then go to the C:\Deckard folder and rename it to DeckardOld. Now try running DSS from your desktop and see if you can get proper logs.

The main.txt looks pretty good, but some things in there in I need to check out.

I was really suggesting that you consider removing or disabling SpySweeper instead of AVG. SS is know to be heavy on resources and AVG is comparatively light. It is always recommended that you run an antivirus since that is what they are designed for and anti-spyware as a supplement. I just looked at Webroot's page and don't see them mention the plain SpySweeper having an antivirus--so I may have been misinformed in thinking the latest version has one. Webroot offers a Spy Sweeper with AntiVirus bundle, but if you aren't running that specific program, you need to turn your AVG back on ASAP. To see if there is any significant performance improvement in having SS not running, it would be better to uninstall SpySweeper or just disable it and see if it makes any difference.

If you can't get DSS to run a full log, I'd like to see another list of what you have installed. Do the following only if you can't get an extra.txt from DSS:

Open HijackThis.

If you still have the New Users Quickstart screen enabled, click Open Misc Tools Section.
If you just have the regular opening screen, click the Config... button then the Misc Tools button.

Now click the Open Uninstall Manager button, then the Save List button. Save the list somewhere convenient like My Documents and then the list will open in Notepad. Copy and Paste that list into your next reply to this post.

I take it your speed has increased now and the image rendering is OK? What about System Restore--did you test it?

I'll be posting soon to your other thread to let you know about this one.

We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan


#3 Oowo

Oowo
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 19 June 2007 - 01:07 AM

Papakid,

Thanks again for taking time to help me. I am indeed very grateful for your effort. :flowers:

I had downloaded Deckard's System Scanner to desktop and am still unable to find the extra.txt file anywhere. I looked in the folder C:\Deckard\System Scanner file, the Deckard file and even did a search for it in "All Files and Folders". If it is anywhere, I am unable to find it. :thumbsup:

My System Restore did work after turning it off and then rebooting my system and then turning it back on. Thanks for that advice! Also, Since upgrading Java, the speed has increased and the picture rendering is fine.

Although I haven't been knocked offline in a few hours, my signal strength (Linksys Wireless-G PCI Adapter - WMP54Gv4) still continually flutters all over the place from "Low" to "Good" and "Very Good" constantly.

I disabled all the functions of Spy Sweeper, but have not yet downloaded AVG7.5 yet - as I have Dr.Web Cureit. Also, I paid around $40.00 for Spy Sweeper and I am a bit hesitant to delete it altogether. But, it is currently disabled.

Here are my Hijackthis and DSS main.text logs:

*******************************************************************************

Adobe Flash Player ActiveX
Adobe Shockwave Player
a-squared Free 2.1
CCleaner (remove only)
Compaq Connections
HijackThis 1.99.1
HP Deskjet printer preloaded drivers
Instant Support
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
Java™ SE Runtime Environment 6 Update 1
KBD
Last.fm 1.1.3.0
Linksys Wireless-G PCI Adapter
Microsoft .NET Framework (English) v1.0.3705
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 7.0
NVIDIA Windows 2000/XP Display Drivers
OmniPass
Panda ActiveScan
PC-Doctor for Windows
PS2
QuickTime
RealPlayer
S3Display
S3Gamma2
S3Info2
S3Overlay
Simple Installer - Multilanguage Version
Spy Sweeper
Update for Windows XP (KB898461)
Weblink
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows XP Hotfix - KB842773
Windows XP Hotfix (SP2) [See q329256 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q329909
Windows XP Hotfix (SP2) Q331958
Windows XP Hotfix (SP2) Q811789

*******************************************************************************

Deckard's System Scanner v20070611.50
Run by Owner on 2007-06-19 at 01:47:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Owner.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 1:47:03 AM, on 6/19/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\System32\notepad.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1172825992515
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1172825953859
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)


-- Files created between 2007-05-19 and 2007-06-19 -----------------------------

2007-06-19 01:36:51 0 dr-h----- C:\Documents and Settings\Owner\Recent
2007-06-18 17:05:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-06-18 16:44:44 3563520 --a------ C:\Documents and Settings\Owner\ntuser.dat
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Lavasoft
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Keynote Systems
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\InterTrust
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\interMute
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Identities
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Help
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Apple Computer
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Aim
2007-06-17 08:24:47 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Adobe
2007-06-17 08:24:45 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Macromedia
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Favorites
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Desktop
2007-06-17 08:24:44 0 d---s---- C:\Documents and Settings\Administrator.OWNER\Cookies
2007-06-17 08:24:44 0 dr-h----- C:\Documents and Settings\Administrator.OWNER\Application Data
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Webroot
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Weather Studio(2)
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Symantec
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Sonic
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\SampleView
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Real
2007-06-17 08:24:44 0 d-------- C:\Documents and Settings\Administrator.OWNER\Application Data\Motive
2007-06-17 08:24:44 0 d---s---- C:\Documents and Settings\Administrator.OWNER\Application Data\Microsoft
2007-06-17 08:24:42 0 d-------- C:\Documents and Settings\Administrator.OWNER\WINDOWS
2007-06-17 08:24:42 0 d---s---- C:\Documents and Settings\Administrator.OWNER\UserData
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Templates
2007-06-17 08:24:42 0 dr------- C:\Documents and Settings\Administrator.OWNER\Start Menu
2007-06-17 08:24:42 0 dr-h----- C:\Documents and Settings\Administrator.OWNER\SendTo
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Recent
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\PrintHood
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\NetHood
2007-06-17 08:24:42 0 d-------- C:\Documents and Settings\Administrator.OWNER\My Documents
2007-06-17 08:24:42 0 d--h----- C:\Documents and Settings\Administrator.OWNER\Local Settings
2007-06-17 08:24:41 405504 --a------ C:\Documents and Settings\Administrator.OWNER\NTUSER.DAT
2007-06-12 07:28:32 4776 --a------ C:\Program Files\CCleaner_Backup.reg
2007-06-12 05:48:22 0 d--h----- C:\WINDOWS\PIF
2007-06-12 04:52:00 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-06-12 04:42:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\interMute
2007-06-11 18:21:53 8704 --a------ C:\WINDOWS\System32\regapi.exe
2007-06-04 19:26:16 20045 --a------ C:\Program Files\cc_20070604_1925.reg
2007-06-04 19:13:20 0 d-------- C:\Program Files\CCleaner
2007-06-04 07:47:55 50688 --a------ C:\Program Files\ATF-Cleaner.exe <Not Verified; Atribune.org; ATF Cleaner>
2007-05-31 14:38:46 0 --a------ C:\Documents and Settings\Owner\netsh
2007-05-31 05:24:11 0 d-------- C:\WINDOWS\System32\ActiveScan
2007-05-31 02:43:56 77312 --a------ C:\WINDOWS\ua2.dll
2007-05-22 16:41:42 0 d-------- C:\Program Files\Last.fm


-- Find3M Report ---------------------------------------------------------------

2007-06-19 01:23:09 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe
2007-06-19 01:23:06 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-18 17:29:37 0 d-------- C:\Program Files\Java
2007-06-13 14:40:00 0 d-------- C:\Program Files\Lavasoft
2007-06-12 04:52:39 364 --a------ C:\WINDOWS\System32\tmp.reg
2007-06-04 19:56:06 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-04 09:19:41 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2007-06-04 09:15:01 0 d-------- C:\Program Files\a-squared Free
2007-05-31 05:59:58 0 d-------- C:\Program Files\MSN Messenger
2007-05-25 20:00:28 0 d-------- C:\Documents and Settings\Owner\Application Data\Macromedia
2007-05-11 18:22:09 0 d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2007-05-11 10:23:52 0 d-------- C:\Program Files\Enigma Software Group
2007-04-29 19:56:26 0 d-------- C:\Program Files\Firaxis Games
2007-04-29 19:53:18 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-04-29 19:52:38 0 d-------- C:\Documents and Settings\Owner\Application Data\My Games
2007-03-24 23:57:29 0 --a------ C:\autoexec.bat


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"KBD"="C:\\HP\\KBD\\KBD.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cf2b8eb8-c5d9-11db-a35a-806d6172696f}]
Shell\AutoRun\command D:\Info.exe folder.htt 480 480
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_GTNDIS5


-- End of Deckard's System Scanner: finished at 2007-06-19 at 01:47:21 ---------

Edited by Oowo, 19 June 2007 - 01:09 AM.


#4 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:39 AM

Posted 19 June 2007 - 01:25 PM

Hey Oowo,

Looks like you have the standard version of SpySweeper. I think you are misunderstanding what I am asking you to do--it is more important to have your protection running to prevent infections. You should leave one antivirus protection running in the background as well as SS's and only disable it to determine if it is causing a slowdown or right before making a change to your system as sometimes SS will interfere--I'll let you know when to disable SS. If they are not causing a significant slowdown or other problems, you should leave both running. Please take care of this first before we go any farther.

Dr Web is for cleaning up after an infection and offers no guard for preventing infections.

Don't know what is going on with DSS. I'm having a bit of a hard time getting the time to research a couple of files but the log looks pretty good. Just do this for me for now.

Please download SmitfraudFix If you have run this program before, please delete any old copies and download the newest one as it is updated very often.

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users