Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
11-May-2008, 09:12 PM
#2 | ||||||
| Welcome to TSG  Please click Here to download HijackThis to your desktop. Click the Download button. When the Trend Micro HJT install box appears, double click on the HJTInstall.exe. Click on Install. It will be installed by default here: C:\Program Files\Trend Micro\HijackThis A shortcut to the application will also be placed on your Desktop. The program will open automatically after installation. You can double-click the icon that was placed on the Desktop to run subsequent HijackThis scans or you can use the icon inside the folder. The folder HijackThis is where you will find the HJT logs that you save. When you use the application to remove anything, you will also find the backup copies made by HJT inside this folder. Close all other windows except HijackThis. Click on "Do a system scan and save logfile" When the log pops up in Notepad, copy and paste that file back here. Do NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
__________________ My Blog Microsoft Valuable Professional Consumer--Security 2007-2009 If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Concerned about Browser Security!!! Consider Mozilla Firefox 3.0 and NoScript Operating System Ubuntu Gusty Gibbon 7.10 |
11-May-2008, 11:35 PM
#4 | ||||||
|
__________________ My Blog Microsoft Valuable Professional Consumer--Security 2007-2009 If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Concerned about Browser Security!!! Consider Mozilla Firefox 3.0 and NoScript Operating System Ubuntu Gusty Gibbon 7.10 |
12-May-2008, 11:37 PM
#5 | ||||||
| Combo Fix Log and HiJack This Log Files ComboFix 08-05-11.1 - Derek Mann 2008-05-12 17:13:58.1 - NTFSx86 Running from: C:\Documents and Settings\Derek Mann\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini C:\WINDOWS\system32\agmlhket.ini C:\WINDOWS\system32\chvouqwg.ini C:\WINDOWS\system32\gnjsmffx.dll C:\WINDOWS\system32\gxjiexbj.ini C:\WINDOWS\system32\hPqtwyay.ini C:\WINDOWS\system32\hPqtwyay.ini2 C:\WINDOWS\system32\hqkkdlgl.ini C:\WINDOWS\system32\iabisylw.ini C:\WINDOWS\system32\icmkleuo.dll C:\WINDOWS\system32\kqrjocar.dll C:\WINDOWS\system32\lddjyhgl.dll C:\WINDOWS\system32\LTCeNXyb.ini C:\WINDOWS\system32\LTCeNXyb.ini2 C:\WINDOWS\system32\npwgcgcu.dll C:\WINDOWS\system32\oqddtorb.ini C:\WINDOWS\system32\ouelkmci.ini C:\WINDOWS\system32\qoMeBqQH.dll C:\WINDOWS\system32\utDLknmp.ini C:\WINDOWS\system32\utDLknmp.ini2 C:\WINDOWS\system32\XwvxaGgh.ini C:\WINDOWS\system32\XwvxaGgh.ini2 . ((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 ))))))))))))))))))))))))))))))) . 2008-05-12 14:28 . 2008-05-12 14:29 92,752 --a------ C:\image.jpg 2008-05-12 14:19 . 2008-05-12 14:19 24,365 --a------ C:\Hopkins_Fire1.jpg 2008-05-12 14:16 . 2008-05-12 14:16 23,867 --a------ C:\Firetruck.jpg 2008-05-11 21:55 . 2008-05-11 21:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-09 10:27 . 2008-05-09 10:29 <DIR> d-------- C:\WINDOWS\tbcdata 2008-05-09 10:27 . 2002-04-17 14:51 290,816 --a------ C:\WINDOWS\system32\tbctray.exe 2008-05-09 10:25 . 2008-05-09 10:25 <DIR> d-------- C:\Program Files\Turtle Beach 2008-05-09 10:25 . 2002-04-17 14:51 765,952 --a------ C:\WINDOWS\system\crlds3d.dll 2008-05-09 10:25 . 2002-04-17 14:51 720,896 --a------ C:\WINDOWS\system32\Audio3D.dll 2008-05-09 10:25 . 2002-04-17 14:51 545,088 --a------ C:\WINDOWS\system32\drivers\tbcwdm.sys 2008-05-09 10:25 . 2002-04-17 14:51 425,472 --a------ C:\WINDOWS\system32\tbclang.dll 2008-05-09 10:25 . 2002-04-17 14:51 155,648 --a------ C:\WINDOWS\system32\tbccpnl.cpl 2008-05-09 10:25 . 2002-04-17 14:51 144,768 --a------ C:\WINDOWS\system32\drivers\tbcspud.sys 2008-05-09 10:25 . 2002-04-17 14:51 4,224 --a------ C:\WINDOWS\system32\drivers\tbcos.sys 2008-05-08 17:53 . 2008-05-08 17:53 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-08 17:53 . 2008-05-08 17:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-08 17:50 . 2008-05-08 17:50 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-08 16:56 . 2002-04-03 11:51 425,472 --a------ C:\WINDOWS\system32\tbc8.tmp 2008-05-08 10:18 . 2008-05-08 10:18 <DIR> d-------- C:\VundoFix Backups 2008-05-07 13:16 . 2008-05-07 13:16 2,112 --a------ C:\WINDOWS\system32\oncvbiso.exe 2008-05-06 15:14 . 2008-05-06 15:14 13,256 --a------ C:\41E93XQA7VL._SL500_AA240_.jpg 2008-05-06 15:10 . 2008-05-06 15:10 12,433 --a------ C:\41MC5CD6B6L._SL500_AA240_.jpg 2008-05-06 15:01 . 2008-05-06 15:01 17,333 --a------ C:\200px-Murderingtheclassics.jpg 2008-05-06 14:42 . 2008-05-06 14:42 13,748 --a------ C:\51A5thkm3pL._SL500_AA240_.jpg 2008-05-06 14:38 . 2008-05-06 14:38 17,504 --a------ C:\51pJhUgm+eL._SL500_AA240_.jpg 2008-05-06 14:25 . 2008-05-06 14:30 72,703 --a------ C:\The Last Shadow Puppets-The Age Of The Understatement [Front].jpg 2008-05-06 14:18 . 2008-05-06 14:18 15,670 --a------ C:\51gMelAe2ZL._SL500_AA240_.jpg 2008-05-06 14:13 . 2008-05-06 14:13 19,072 --a------ C:\51fUe2B0ZTL._SL500_AA240_.jpg 2008-05-06 13:30 . 2008-05-06 13:30 18,224 --a------ C:\diamo.jpg 2008-05-06 13:15 . 2008-05-08 02:35 0 --a------ C:\WINDOWS\system32\edxxyhle.dll 2008-05-06 13:12 . 2008-05-06 13:12 2,112 --a------ C:\WINDOWS\system32\uastsiim.exe 2008-05-06 12:21 . 2008-05-05 16:24 4,803 --a------ C:\Folder.jpg 2008-05-06 12:18 . 2008-05-06 12:23 299,426 --a------ C:\00-barenaked_ladies-snacktime-cd-2008.jpg 2008-05-06 10:29 . 2008-05-06 12:32 56,822 --a------ C:\Front.jpg 2008-05-05 13:12 . 2008-05-08 02:48 0 --a------ C:\WINDOWS\system32\rmrrndow.dll 2008-05-05 13:12 . 2008-05-08 02:39 0 --a------ C:\WINDOWS\system32\lqmnkkjg.dll 2008-05-05 11:02 . 2008-05-05 11:35 14,071 --a------ C:\krokus.jpg 2008-05-04 13:15 . 2008-05-08 02:51 0 --a------ C:\WINDOWS\system32\upuqcrcd.dll 2008-05-04 13:09 . 2008-05-08 02:36 0 --a------ C:\WINDOWS\system32\fqogmdga.dll 2008-05-03 13:15 . 2008-05-08 02:50 0 --a------ C:\WINDOWS\system32\sqwwkrjp.dll 2008-05-02 15:11 . 2008-05-02 15:11 <DIR> d-------- C:\Documents and Settings\Derek Mann\Application Data\Uniblue 2008-05-02 13:16 . 2008-05-08 02:37 0 --a------ C:\WINDOWS\system32\implxpxt.dll 2008-05-02 13:14 . 2008-05-08 02:31 0 --a------ C:\WINDOWS\system32\brotddqo.dll 2008-05-02 13:07 . 2008-05-02 13:07 280,576 --a------ C:\WINDOWS\system32\yaywtqPh.dll 2008-05-02 10:53 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-05-02 10:53 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-05-02 10:53 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-05-02 10:53 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-05-02 10:52 . 2008-05-02 11:38 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-05-02 10:52 . 2008-05-02 10:52 <DIR> d-------- C:\Documents and Settings\Derek Mann\Application Data\PC Tools 2008-05-02 10:24 . 2008-05-02 10:24 <DIR> d-------- C:\Documents and Settings\Derek Mann\Application Data\RegistrySmart 2008-04-30 11:15 . 2008-05-10 20:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-30 05:25 . 2008-05-12 17:05 109,778 --a------ C:\WINDOWS\BM03b0f16e.xml 2008-04-22 20:01 . 2008-04-22 20:04 <DIR> d-------- C:\Documents and Settings\Derek Mann\Application Data\Mp3tag . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-12 19:08 --------- d-----w C:\Program Files\EzGenerator3 2008-05-11 19:14 --------- d-----w C:\Documents and Settings\Derek Mann\Application Data\BitTorrent 2008-05-11 01:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-09 15:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-08 22:03 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-05-08 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-08 21:54 --------- d-----w C:\Program Files\NCH Swift Sound 2008-05-08 21:50 --------- d-----w C:\Program Files\Diploma 6 2008-05-06 23:49 --------- d-----w C:\Program Files\SmartSync Pro 2008-05-06 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\NCH Swift Sound 2008-05-05 22:51 --------- d-----w C:\Program Files\Mp3TagToolsv12 2008-05-02 20:40 --------- d-----w C:\Program Files\Norton AntiVirus 2008-04-30 20:37 --------- d-----w C:\Program Files\BroadJump 2008-04-30 16:15 --------- d-----w C:\Program Files\Ace Utilities 2008-04-30 15:18 --------- d-----w C:\Program Files\DivX 2008-04-03 15:08 --------- d-----w C:\Program Files\Java 2008-03-21 20:30 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys 2002-07-10 17:22 81,920 ----a-w C:\Program Files\Common Files\msado25.tlb 2001-10-05 19:53 21,866 ----a-w C:\Program Files\Common Files\tppupd2k.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CAA51FD-E0A5-4327-92DA-919341017243}] C:\WINDOWS\system32\byXNeCTL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0AE3583-C36B-4EA5-832A-9FEAE84E45E2}] 2008-05-02 13:07 280576 --a------ C:\WINDOWS\system32\yaywtqPh.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9A9C5F2-E8F7-45E0-B780-29E0246D0DF2}] C:\WINDOWS\system32\hgGaxvwX.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\Carbonite.Blue] @={E300CD91-100F-4E67-9AF3-1384A6124015} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\Carbonite.Green] @={95A27763-F62A-4114-9072-E81D87DE3B68} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\Carbonite.Partial] @={E300CD91-100F-4E67-9AF3-1384A6124015} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\Carbonite.Red] @={01CCCC8C-1D50-4b13-B96D-4B922DD3128B} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\Carbonite.Yellow] @={5E529433-B50E-4bef-A63B-16A6B71B071A} [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2008-02-09 07:04 509376 -ra------ C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2008-02-09 07:04 509376 -ra------ C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2008-02-09 07:04 509376 -ra------ C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_CLASSES_ROOT\CLSID\{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}] 2008-02-09 07:04 509376 -ra------ C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2008-02-09 07:04 509376 -ra------ C:\Program Files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "SpySweeper"="" [] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 17:24 942080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="NvQTwk" [] "LXSUPMON"="C:\WINDOWS\System32\LXSUPMON.exe" [2002-03-15 06:29 886272] "MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe" [2001-07-25 13:00 241714] "TPP Auto Loader"="C:\WINDOWS\TPPALDR.EXE" [2001-10-05 14:54 118784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-11 01:39 98304] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 11:42 58728] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-02-06 23:08 100056] "Picasa Media Detector"="C:\Program Files\Picasa\Picasa2\PicasaMediaDetector.exe" [2006-01-23 21:13 421888] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-04 19:54 180269] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "IPInSightMonitor 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" [2005-08-10 22:10 122880] "IPInSightLAN 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPClient.exe" [2005-08-10 22:10 380928] "MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 12:06 11776] "MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 12:06 110592] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "Carbonite Backup"="C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2008-02-09 07:04 526272] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [ ] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 07:44:06 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.xvid"= xvid.dll "vidc.3IV2"= 3ivxVfWCodec_dec.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "BJCFD"=C:\Program Files\BroadJump\Client Foundation\CFD.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "8097:TCP"= 8097:TCP:*  isabled:EarthLink UHP Modem Support"3306:TCP"= 3306:TCP:* isabled:MYSQL"3389:TCP"= 3389:TCP:* isabled:@xpsp2res.dll,-22009[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\M] \Shell\AutoRun\command - M:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{14c19e04-eb01-11dc-9910-0007e900d878}] \Shell\AutoRun\command - L:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{566a0e8c-acf3-11dc-9905-0007e900d878}] \Shell\AutoRun\command - K:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{6eee007f-c482-11dc-990c-0007e900d878}] \Shell\AutoRun\command - K:\system\viewer\FlipVideoforPC.exe \Shell\Flip Video for PC\command - K:\system\viewer\FlipVideoforPC.exe . Contents of the 'Scheduled Tasks' folder "2008-05-12 23:00:26 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe "2008-05-08 14:58:53 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Derek Mann.job" - C:\PROGRA~1\NORTON~1\Navw32.exeh/task: . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-12 22:07:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\EarthLink TotalAccess\Accelerator\prplsf.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Norton AntiVirus\IWP\NPFMNTOR.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe . ************************************************************************** . Completion time: 2008-05-12 22:28:01 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-13 03:27:07 Pre-Run: 15,291,166,720 bytes free Post-Run: 16,246,394,880 bytes free 250 --- E O F --- 2008-05-09 01:45:50 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:36:43 PM, on 5/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\WINDOWS\TPPALDR.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe C:\Program Files\EarthLink TotalAccess\FastLane2\IPClient.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - ~EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: ElnkBhoGuard Class - {00000000-0000-0000-0000-000000000002} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0CAA51FD-E0A5-4327-92DA-919341017243} - C:\WINDOWS\system32\byXNeCTL.dll (file missing) O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll O2 - BHO: (no name) - {A0AE3583-C36B-4EA5-832A-9FEAE84E45E2} - C:\WINDOWS\system32\yaywtqPh.dll (file missing) O2 - BHO: (no name) - {B9A9C5F2-E8F7-45E0-B780-29E0246D0DF2} - C:\WINDOWS\system32\hgGaxvwX.dll (file missing) O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe" O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPClient.exe" -l O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink TotalAccess\Toolbar\SearchUI.dll/search.html O8 - Extra context menu item: Save with Download Manager... - file://C:\Program Files\J River\Media Center\DMDownload.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-24.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1105334579140 O16 - DPF: {6BF35011-3AE5-44D3-A8BB-73ED462A0BC0} (EZUploader Control) - http://www.ezprints.com/software/ezuploader.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/amp...1.11_en_dl.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 12144 bytes |
14-May-2008, 11:28 AM
#6 | ||||||
| Download the attached file CFScript.txt to your Desktop  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at "C:\ComboFix.txt". In your next reply, please include the ComboFix log and a fresh HIjackthis log. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Note:Please do not use this script on another computer, you may damage the system. The script is made especially for this user's computer only!!!! ======================================== Please download ATF Cleaner by Atribune. This program is for XP, Windows 2000, and Vista
If you use Firefox browser
If you use Opera browser
Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ============================================== Please download Malwarebytes Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.
__________________ My Blog Microsoft Valuable Professional Consumer--Security 2007-2009 If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Concerned about Browser Security!!! Consider Mozilla Firefox 3.0 and NoScript Operating System Ubuntu Gusty Gibbon 7.10 |
14-May-2008, 06:36 PM
#8 | ||||||
| |
