| Live Chat & Podcast at 1:00PM Eastern on Sunday! |
| |
| | |
| Thread Tools |
|
23-Mar-2008, 02:00 PM
#1 |
| In need of some computer help Hello, I'm completely new to this site, but my computer has been giving me some trouble and a friend of mine told me I could get some help at this site. My computer will run ok on safe mode, but if I run it normally and start a few programs the task bar will disappear and everything will freeze up for a bit. It eventually unfreezes, but the task bar remains missing as well as all my short cut buttons, so once I exit out of everything, I have to restart the computer if I want to get back to anything. I can use Ctrl-Alt-Del to get to my task manager and shut it off that way. I've tried looking for some free virus removal software--I've been using the AVG free edition because I just don't have the money to buy any software. I don't know much about computers... I know that I have a windows XP, if that helps. Can anyone help me out? |
| |
23-Mar-2008, 02:34 PM
#2 | |||||
| Hi, Let's see if any malware shows by checking a Hijackthis log: go to Click here to download HJTsetup.exe
don't forget this second part Please also do this:
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
|
23-Mar-2008, 04:19 PM
#3 |
| Thanks for the help, this is what I've got so far: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:02:31 PM, on 3/23/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Microsoft Task Scheduler] C:\WINDOWS\system32\dlha\mstask32.com O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe O4 - HKLM\..\Run: [7c03cf4c] rundll32.exe "C:\WINDOWS\system32\voovmgbp.dll",b O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BM7f30fcd0] Rundll32.exe "C:\WINDOWS\system32\eptimedc.dll",s O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O20 - AppInit_DLLs: O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 5425 bytes |
24-Mar-2008, 12:30 AM
#4 | |||||
| Hi, SD FIX Please read all through the info so you know what will be done. **Note that SDFix runs only in Safe Mode **Also> any user account that you boot into, in Safe Mode, has to be at Administrator user level... There is a Printable Version button up under the Thread Tools drop down menu that will let you print a nice text version of these instructions. Alternate way to save directions:Open Notepad> Copy and Paste any text you wish into Notepad, and Save the file as something you will recognize like TSGhelp.txt and save it onto your desktop. Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
|
25-Mar-2008, 11:09 PM
#5 |
| Here's the SDFix report: SDFix: Version 1.160 Run by Administrator on Mon 03/24/2008 at 03:56 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\SYSTEM32\TASKKILL.EXE - Deleted C:\359.TMP - Deleted C:\ADWARE.EXE - Deleted C:\WINDOWS\admintxt.txt - Deleted C:\WINDOWS\system32\dlha\mstask32.com - Deleted C:\WINDOWS\system32\ipv6monl.dll - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-25 19:04:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 9 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:* i sabled:LEXPPS.EXE""C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:M5Shell" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:IE6" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:* isabled:Ares""C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client" "C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:* isabled:AIM""C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enable d:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Wed 1 Sep 2004 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe" Wed 1 Sep 2004 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe" Wed 1 Sep 2004 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe" Mon 1 Jan 2007 88 ..SHR --- "C:\WINDOWS\system32\324A749AC3.sys" Mon 12 Nov 2007 56 ..SHR --- "C:\WINDOWS\system32\C39A744A32.sys" Mon 12 Nov 2007 4,184 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Sun 20 Nov 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 15 Aug 2007 19,968 ...H. --- "C:\Documents and Settings\Cory\My Documents\~WRL0003.tmp" Tue 1 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Tue 13 Mar 2007 362,264 A..H. --- "C:\Documents and Settings\Cory\Local Settings\Temp\AutoDetect.exe" Sat 11 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL0989.tmp" Sat 11 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL1555.tmp" Sat 11 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL1801.tmp" Sat 11 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL2338.tmp" Sat 11 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL2410.tmp" Sat 11 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL3006.tmp" Sat 11 Mar 2006 19,456 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL3013.tmp" Sat 11 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL3158.tmp" Thu 9 Mar 2006 37,888 ...H. --- "C:\Documents and Settings\David\My Documents\class\~WRL3696.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR421.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR423.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR425.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR427.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR429.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR42B.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR42D.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR457.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR459.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR45B.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR45E.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR461.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR463.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR465.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR467.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR469.tmp" Thu 5 Jan 2006 1,409 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\FOR46B.tmp" Thu 5 Jan 2006 10,564 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR420.tmp" Thu 5 Jan 2006 12,340 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR422.tmp" Thu 5 Jan 2006 12,904 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR424.tmp" Thu 5 Jan 2006 12,048 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR426.tmp" Thu 5 Jan 2006 10,688 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR428.tmp" Thu 5 Jan 2006 10,004 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR42A.tmp" Thu 5 Jan 2006 10,760 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR42C.tmp" Thu 5 Jan 2006 30,004 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR456.tmp" Thu 5 Jan 2006 33,012 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR458.tmp" Thu 5 Jan 2006 43,044 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR45A.tmp" Thu 5 Jan 2006 22,028 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR45D.tmp" Thu 5 Jan 2006 10,564 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR460.tmp" Thu 5 Jan 2006 12,904 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR462.tmp" Thu 5 Jan 2006 12,048 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR464.tmp" Thu 5 Jan 2006 12,340 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR466.tmp" Thu 5 Jan 2006 10,004 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR468.tmp" Thu 5 Jan 2006 10,760 ...H. --- "C:\Documents and Settings\Patricia\Local Settings\Temp\ZTR46A.tmp" Fri 19 Jan 2007 2,928 A..H. --- "C:\Program Files\Common Files\AOL\IPHSend\IPH.BAK" Sat 4 Aug 2007 20,992 ...H. --- "C:\Documents and Settings\Cory\Application Data\Microsoft\Word\~WRL0003.tmp" Sun 12 Nov 2006 19,456 ...H. --- "C:\Documents and Settings\Cory\Application Data\Microsoft\Word\~WRL0004.tmp" Fri 17 Nov 2006 19,456 ...H. --- "C:\Documents and Settings\Cory\Application Data\Microsoft\Word\~WRL0005.tmp" Sat 21 Oct 2006 107 A..H. --- "C:\Documents and Settings\Cory\Local Settings\Temp\Free Download Manager\tic19F.tmp" Sat 14 Oct 2006 234 A..H. --- "C:\Documents and Settings\Cory\Local Settings\Temp\Free Download Manager\tic451.tmp" Sat 14 Oct 2006 686 A..H. --- "C:\Documents and Settings\Cory\Local Settings\Temp\Free Download Manager\tic456.tmp" Sat 9 Sep 2006 28,160 ...H. --- "C:\Documents and Settings\David\Application Data\Microsoft\Word\~WRL2948.tmp" Sun 20 Nov 2005 4,348 A..H. --- "C:\Documents and Settings\Cory\My Documents\My Music\other\License Backup\drmv1key.bak" Tue 16 May 2006 20 A..H. --- "C:\Documents and Settings\Cory\My Documents\My Music\other\License Backup\drmv1lic.bak" Sun 20 Nov 2005 400 A.SH. --- "C:\Documents and Settings\Cory\My Documents\My Music\other\License Backup\drmv2key.bak" Mon 19 Sep 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp" Mon 19 Sep 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp" Mon 19 Sep 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\lock.tmp" Sat 19 Nov 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\lock.tmp" Tue 18 Oct 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4(2)\lock.tmp" Finished! And this is the Hijackthis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:28:35 PM, on 3/25/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\system32\LxrSII1s.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe C:\Program Files\Lexmark 1200 Series\lxczbmon.exe C:\Program Files\X3watch\x3watch.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AIM6\aim6.exe C:\Documents and Settings\Cory\Local Settings\Application Data\Lexar Media\LxrAutorun.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\PROGRA~1\Grisoft\AVG7\avgw.exe C:\PROGRA~1\Grisoft\AVG7\avginet.exe C:\Program Files\AIM6\aolsoftware.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\AIM6\anotify.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe O4 - HKLM\..\Run: [7c03cf4c] rundll32.exe "C:\WINDOWS\system32\mjdqsccg.dll",b O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BM7f30fcd0] Rundll32.exe "C:\WINDOWS\system32\gqmrfedb.dll",s O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Intel Audio Studio V2.0] C:\WINDOWS\fmideploy.exe O4 - HKCU\..\Run: [Audio Studio V2.8] C:\WINDOWS\flsmontr.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [LxrAutorun] C:\Documents and Settings\Cory\Local Settings\Application Data\Lexar Media\LxrAutorun.exe O4 - HKCU\..\Run: [IntelliMouse Explorer V2.3] C:\WINDOWS\netpefr32.exe O4 - HKCU\..\Run: [Legacy VGA Drivers V1.0] C:\WINDOWS\certproc32.exe O4 - HKCU\..\Run: [Legacy VGA Drivers V1.9x] C:\WINDOWS\cabview32.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O20 - AppInit_DLLs: O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6922 bytes |
26-Mar-2008, 06:40 PM
#6 | |||||
| Hi, Good....please do what is below: Note: it is very important that you turn off the protective programs as it says, so do go to the link, and do what it says... COMBO FIX: Please read all through the info so you know what will be done. Here are directions etc but I also have them below: http://www.bleepingcomputer.com/comb...o-use-combofix There is a Printable Version button up under the Thread Tools drop down menu that will let you print a nice text version of these instructions. Alternate way to save directions:Open Notepad> Copy and Paste any text you wish into Notepad, and Save the file as something you will recognize like TSGhelp.txt and save it onto your desktop. Important notes regarding ComboFix: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. Combofix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
_ _ _ _ _ _ _
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
|
26-Mar-2008, 11:59 PM
#7 |
| Here's the ComboFix log: ComboFix 08-03-25.4 - Administrator 2008-03-26 22:26:31.1 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.131 [GMT -4:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Starware C:\Documents and Settings\All Users\Application Data\Starware\buttons\cursorcafeA.bmp C:\Documents and Settings\All Users\Application Data\Starware\buttons\gamesA.bmp C:\Documents and Settings\All Users\Application Data\Starware\buttons\moviesA.bmp C:\Documents and Settings\All Users\Application Data\Starware\buttons\screensaverA.bmp C:\Documents and Settings\Cory\Application Data\ShoppingReport C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\Config.xml C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\db\Aliases.dbs C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\db\Sites.dbs C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\dwld\WhiteList.xip C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\report\aggr_storage.xml C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\report\send_storage.xml C:\Documents and Settings\Cory\Application Data\ShoppingReport\cs\res2\WhiteList.dbs C:\Documents and Settings\Patricia\Application Data\ShoppingReport C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\Config.xml C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\db\Aliases.dbs C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\db\Sites.dbs C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\dwld\WhiteList.xip C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\report\aggr_storage.xml C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\report\send_storage.xml C:\Documents and Settings\Patricia\Application Data\ShoppingReport\cs\res1\WhiteList.dbs C:\Program Files\Common Files\vcclient C:\Program Files\Common Files\vcclient\Version.txt C:\Program Files\newdotnet C:\Program Files\newdotnet\newdotnet7_14(2).dll C:\Program Files\screensavers.com C:\Program Files\screensavers.com\Installer\bin\iebyterange.xml C:\Program Files\screensavers.com\Installer\bin\iebyterange.xml.backup C:\Program Files\screensavers.com\Installer\bin\siuninst.exe C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll C:\Program Files\ShoppingReport\Uninst.exe C:\Program Files\spysheriff C:\Program Files\spysheriff\base.avd C:\Program Files\spysheriff\base001.avd C:\Program Files\spysheriff\base002.avd C:\Program Files\spysheriff\found.wav C:\Program Files\spysheriff\heur000.dll C:\Program Files\spysheriff\heur001.dll C:\Program Files\spysheriff\heur002.dll C:\Program Files\spysheriff\heur003.dll C:\Program Files\spysheriff\notfound.wav C:\Program Files\spysheriff\removed.wav C:\Program Files\spysheriff\SpySheriff.dvm C:\Program Files\spysheriff\SpySheriff.exe C:\Program Files\spysheriff\Uninstall.exe C:\Program Files\WinBudget C:\Program Files\WinBudget\bin\crap.1189116244.old C:\Program Files\WinBudget\bin\matrix.dll.1189116241.old C:\Program Files\yazzle sudoku C:\WINDOWS\BM7f30fcd0.xml C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\ysbactivex.dll C:\WINDOWS\pskt.ini C:\WINDOWS\system32\audellku.dll C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\emclckmh.dll C:\WINDOWS\system32\eptimedc.dll C:\WINDOWS\system32\fiyxvwmj.dll C:\WINDOWS\system32\gqmrfedb.dll C:\WINDOWS\system32\ieouwlxa.dll C:\WINDOWS\system32\ingseldo.dll C:\WINDOWS\system32\iqburmnc.dll C:\WINDOWS\system32\odlesgni.ini C:\WINDOWS\system32\qommnmj.dll C:\WINDOWS\system32\roaaagro.dll C:\WINDOWS\system32\rtutv.ini C:\WINDOWS\system32\rtutv.ini2 C:\WINDOWS\system32\rvcptknk.dll C:\WINDOWS\system32\srdgaxdc.dll C:\WINDOWS\system32\vtutr.dll C:\WINDOWS\system32\xwvolfow.dll C:\WINDOWS\system32\yayyxyv.dll . ((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 ))))))))))))))))))))))))))))))) . 2008-03-26 20:18 . 2008-03-26 20:18 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData 2008-03-25 19:16 . 2008-03-26 22:39 231,424 --a------ C:\WINDOWS\idmparse32.dll 2008-03-25 19:16 . 2008-03-26 22:39 17,920 --a------ C:\WINDOWS\dmsynth.dll 2008-03-24 16:37 . 2008-03-24 16:37 1,577,785 ---hs---- C:\WINDOWS\system32\gccsqdjm.ini 2008-03-24 15:50 . 2008-03-24 15:50 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-24 15:44 . 2008-03-25 19:14 <DIR> d-------- C:\SDFix 2008-03-23 19:25 . 2008-03-23 19:25 268 --ah----- C:\sqmdata10.sqm 2008-03-23 19:25 . 2008-03-23 19:25 244 --ah----- C:\sqmnoopt10.sqm 2008-03-23 16:29 . 2008-03-23 16:29 1,543,159 ---hs---- C:\WINDOWS\system32\whtgapdr.ini 2008-03-23 14:51 . 2008-03-23 14:51 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-23 13:01 . 2008-03-23 13:01 <DIR> d-------- C:\Documents and Settings\Administrator\Contacts 2008-03-23 12:44 . 2008-03-23 12:44 244 --ah----- C:\sqmnoopt09.sqm 2008-03-23 12:44 . 2008-03-23 12:44 232 --ah----- C:\sqmdata09.sqm 2008-03-23 12:43 . 2008-03-23 12:43 244 --ah----- C:\sqmnoopt08.sqm 2008-03-23 12:43 . 2008-03-23 12:43 232 --ah----- C:\sqmdata08.sqm 2008-03-22 23:02 . 2008-03-25 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-03-22 22:39 . 2005-09-19 10:03 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-03-22 22:39 . 2005-09-19 09:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-03-22 22:39 . 2005-09-19 10:09 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek 2008-03-13 22:55 . 2008-03-13 22:55 268 --ah----- C:\sqmdata07.sqm 2008-03-13 22:55 . 2008-03-13 22:55 244 --ah----- C:\sqmnoopt07.sqm 2008-03-13 22:46 . 2008-03-13 22:46 <DIR> d-------- C:\Documents and Settings\Patricia\Application Data\x3watch 2008-03-13 22:46 . 2008-03-13 22:47 <DIR> d-------- C:\Documents and Settings\Patricia\Application Data\AVG7 2008-03-05 22:29 . 2008-03-25 19:20 <DIR> d-------- C:\Documents and Settings\Cory\Application Data\AVG7 2008-03-05 22:27 . 2008-03-05 22:27 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-03-05 22:25 . 2008-03-05 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-05 22:25 . 2008-03-06 10:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-03-05 18:54 . 2008-03-05 22:46 1,307,488 ---hs---- C:\WINDOWS\system32\pbgmvoov.ini 2008-03-05 16:31 . 2008-03-05 18:49 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-03-02 04:06 . 2008-03-02 04:08 <DIR> d-------- C:\Program Files\Windows Live Safety Center . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-25 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\x3watch 2008-03-05 19:30 4 ----a-w C:\KLSA.DAT 2008-02-23 23:32 --------- d-----w C:\Program Files\X3watch 2008-02-23 22:35 --------- d-----w C:\Documents and Settings\David\Application Data\x3watch 2008-02-22 14:35 249,856 ----a-w C:\WINDOWS\cabview32.exe 2008-02-07 21:53 --------- d-----w C:\Documents and Settings\Cory\Application Data\SQLX3 2008-02-07 20:52 559,104 ----a-w C:\WINDOWS\click.dll 2008-02-04 04:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-02-04 04:02 --------- d-----w C:\Program Files\Symantec 2007-01-26 03:12 1,443,213 -c--a-w C:\Documents and Settings\LocalService\Application Data\Install.dat 2005-11-19 22:54 2,855,080 -c--a-w C:\Program Files\aawsepersonal.exe 2005-11-19 22:46 1,541,704 -c--a-w C:\Program Files\aresregular188_installer.exe 2005-11-19 22:40 8,715,352 -c--a-w C:\Program Files\Install_AIM.exe 2005-11-19 22:36 9,352,392 -c--a-w C:\Program Files\Install_MSN_Messenger.exe 2007-01-01 23:48 88 --sh--r C:\WINDOWS\system32\324A749AC3.sys 2007-11-13 01:16 56 --sh--r C:\WINDOWS\system32\C39A744A32.sys 2007-11-13 01:16 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] "Audio Studio V2.8"="C:\WINDOWS\flsmontr.exe" [ ] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 11:20 50528] "LxrAutorun"="C:\Documents and Settings\Cory\Local Settings\Application Data\Lexar Media\LxrAutorun.exe" [2006-11-09 11:00 24576] "IntelliMouse Explorer V2.3"="C:\WINDOWS\netpefr32.exe" [ ] "Legacy VGA Drivers V1.0"="C:\WINDOWS\certproc32.exe" [ ] "Legacy VGA Drivers V1.9x"="C:\WINDOWS\cabview32.exe" [2008-02-22 10:35 249856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ] "Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 01:22 57344] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "x3watch"="C:\Program Files\X3watch\x3watch.exe" [2007-09-28 09:50 299008] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-05 22:26 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-05 22:26 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-09-19 09:59:12 156784] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-08-08 16:00:00 65588] Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-08 16:00:00 24633] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0\\waol.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= C:\\Program Files\\Internet Explorer\\iexplore.exe "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= R2 LxrSII1d;Secure II Driver;C:\WINDOWS\system32\Drivers\LxrSII1d.sys [2006-12-14 09:37] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38] S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{17f8e1b9-60c6-11dc-a339-00038a000015}] \Shell\AutoRun\command - E:\Autorun.exe /run \Shell\Shell00\Command - E:\Autorun.exe /run \Shell\Shell01\Command - E:\Autorun.exe /action \Shell\Shell02\Command - E:\Autorun.exe /uninstall [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Audio Studio V2.8] C:\WINDOWS\flsmontr.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\IntelliMouse Explorer V2.3] C:\WINDOWS\netpefr32.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Legacy VGA Drivers V1.0] C:\WINDOWS\certproc32.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Legacy VGA Drivers V1.9x] C:\WINDOWS\cabview32.exe . Contents of the 'Scheduled Tasks' folder "2008-03-22 19:41:30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2005-10-10 05:33:56 C:\WINDOWS\Tasks\New Task.job" . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-26 22:39:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\system32\LxrSII1s.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Lexmark 1200 Series\lxczbmon.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-03-26 22:49:10 - machine was rebooted [Cory] ComboFix-quarantined-files.txt 2008-03-27 02:49:04 . 2008-03-12 07:04:42 --- E O F --- And here's the newest HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:54, on 2008-03-26 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O20 - AppInit_DLLs: O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 5196 bytes |
27-Mar-2008, 12:12 AM
#8 | |||||
| Hi, Back in my first reply, was this: Quote:
You didn't post that list, please do so. |
|
27-Mar-2008, 05:19 PM
#9 |
| sorry, about that, here you go: Adobe Flash Player ActiveX Adobe Shockwave Player AIM 6 America Online (Choose which version to remove) AOL Coach Version 1.0(Build:20040229.1 en) AOL Connectivity Services AOL Instant Messenger AOLIcon Apple Mobile Device Support Apple Software Update AVG 7.5 BitTorrent 4.2.2 Broadcom Management Programs Dell Driver Reset Tool Dell Picture Studio v3.0 Dell Support 3.1 EarthLink setup files eMusic Download Manager 3.0 FaxTools FoneSync HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB926239) Intel(R) 537EP V9x DF PCI Modem Intel(R) Extreme Graphics Driver Internet Explorer Default Page iTunes Jasc Paint Shop Pro Studio, Dell Editon Lexmark 1200 Series Lexmark Z600 Series Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Word 2000 SR-1 Microsoft Works 2001 Setup Launcher Microsoft Works 6.0 Modem Event Monitor Modem Helper Modem On Hold MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) NetZeroInstallers Opera 9.0 Qualxserve Service Agreement QuickTime RealPlayer Rhapsody Player Engine Screensavers Installer Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB946026) Sonic DLA Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) Viewpoint Media Player WebCyberCoach 3.2 Dell Windows Installer 3.1 (KB893803) Windows Live Messenger Windows Live OneCare safety scanner Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 WordPerfect Office 12 X3watch 5.0.5 |
27-Mar-2008, 08:46 PM
#10 | |||||
| Hi, Need to have you have the files shown below scanned at the site shown - takes just seconds to scan one file at a time. Go to > http://virusscan.jotti.org/ and use the Browse button there...you just navigate to the location of the file, one at a time, and when you find it, click on it once to highlight it...don't run it....and the path to it will show up in the Jotti scan window. Then just click on the "Submit" button to upload the file to them for the quick scan.... Copy and paste the results for each file scanned.... C:\WINDOWS\idmparse32.dll C:\WINDOWS\system32\pbgmvoov.ini C:\WINDOWS\cabview32.exe C:\WINDOWS\netpefr32.exe C:\WINDOWS\click.dll C:\Program Files\aresregular188_installer.exe C:\WINDOWS\system32\Drivers\toywdm.sys After that we can get finished, hopefully.
__________________ Mung (computer term), the act of making several incremental changes to an item that combine to destroy it Donate directly to help the site TSG Library TSG's Welcome Guide- Tips, Rules, How to use TSG and more! |
|
28-Mar-2008, 09:20 PM
#11 |
| confused about last post... Um, I couldn't find some of them... I found something in my AVG virus vault that looked like idmparse32.dll, but I'm not quite sure what to do. Anyway, here are the ones I can find. Do you know where I need to look for the others? C:\WINDOWS\cabview32.exe Scan taken on 28 Mar 2008 23:44:45 (GMT) A-Squared Found nothing AntiVir Found TR/Dldr.Agent.kfq.1 ArcaVir Found Trojan.Downloader.Agent.Kfq Avast Found nothing AVG Antivirus Found nothing BitDefender Found Trojan.Agent.Delf.GY ClamAV Found nothing CPsecure Found nothing Dr.Web Found BackDoor.Weby F-Prot Antivirus Found Possibly a new variant of W32/MalwareHiderPatched-based!Maximus F-Secure Anti-Virus Found Trojan-Downloader.Win32.Agent.kfq Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Agent.kfq NOD32 Found probably unknown NewHeur_PE (probable variant) Norman Virus Control Found W32/Agent.EXBW Panda Antivirus Found Bck/Weby.A Rising Antivirus Found nothing Sophos Antivirus Found Mal/Generic-A VirusBuster Found nothing VBA32 Found Trojan-Downloader.Win32.Agent.kfq C:\WINDOWS\click.dll Scan taken on 29 Mar 2008 00:07:01 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found Win32.Trojan-Downloader (probable variant) C:\Program Files\aresregular188_installer.exe Scan taken on 29 Mar 2008 00:07:37 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing |
28-Mar-2008, 11:51 PM
#12 | |||||
| Hi, Can you simply type or copy the filepath, with the filename showing, here, from the AVG results? You have to have these settings to be able to see hidden, system, and all files: Last edited by Byteman; 28-Mar-2008 at 11:56 PM.. |
|
29-Mar-2008, 12:39 PM
#13 |
| a little bit better Ok, I was able to type the results for idmparse32.dll, and I found pbgmvoov.ini. However, the other two are still MIA. I'm not sure what to do. C:\WINDOWS\idmparse32.dll (From AVG virus Vault Object Details) Object name idmparse32.dll Object path C:\WINDOWS\ Discovery Trojan horse Downloader.Agent.ACUQ Date of detection 2008-03-14 21:56 Source Computer DH6VFJ81 Finder Cory File size 226 KB (231424 bytes) Healable No Source Moved Object Status Infected C:\WINDOWS\system32\pbgmvoov.ini Scan taken on 29 Mar 2008 15:12:29 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing C:\WINDOWS\cabview32.exe Scan taken on 28 Mar 2008 23:44:45 (GMT) A-Squared Found nothing AntiVir Found TR/Dldr.Agent.kfq.1 ArcaVir Found Trojan.Downloader.Agent.Kfq Avast Found nothing AVG Antivirus Found nothing BitDefender Found Trojan.Agent.Delf.GY ClamAV Found nothing CPsecure Found nothing Dr.Web Found BackDoor.Weby F-Prot Antivirus Found Possibly a new variant of W32/MalwareHiderPatched-based!Maximus F-Secure Anti-Virus Found Trojan-Downloader.Win32.Agent.kfq Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Agent.kfq NOD32 Found probably unknown NewHeur_PE (probable variant) Norman Virus Control Found W32/Agent.EXBW Panda Antivirus Found Bck/Weby.A Rising Antivirus Found nothing Sophos Antivirus Found Mal/Generic-A VirusBuster Found nothing VBA32 Found Trojan-Downloader.Win32.Agent.kfq C:\WINDOWS\netpefr32.exe still unable to find C:\WINDOWS\click.dll Scan taken on 29 Mar 2008 00:07:01 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found Win32.Trojan-Downloader (probable variant) C:\Program Files\aresregular188_installer.exe Scan taken on 29 Mar 2008 00:07:37 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing C:\WINDOWS\system32\Drivers\toywdm.sys still unable to find |
|
29-Mar-2008, 09:45 PM
#14 |
| Give it the three finger salute. Ctrl+alt+del. Click on the performance tab. Is something being ran using 100% of your processor and not letting up on it? If so, check the tab before performance and see what program is hogging if anything is hogging resources |

|
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |

| Thread Tools | |
| |
| You Are Using: |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 07:40 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. | |

