Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
24-Jul-2008, 01:46 AM
#1 | |||||
 Fake Anitvirus AV2009 Getting Pop- UPs Last edited by NWDaydreamer : 24-Jul-2008 01:50 PM. |
| |
28-Jul-2008, 10:02 PM
#3 | |||||
| |
28-Jul-2008, 10:36 PM
#5 | |||||
| Quote:
Thank you!  |
29-Jul-2008, 12:21 AM
#7 | |||||
| Good night, sorry it took forever. I just got another pop up as I was trying to post. Here are my logs: HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:00:03 PM, on 7/28/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\wscntfy.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ICO.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Verizon\VSP\VerizonServicepoint.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\FSRremoS.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: {9f6ce590-8be4-2cdb-1e44-9c50dbce38ef} - {fe83ecbd-05c9-44e1-bdc2-4eb8095ec6f9} - C:\WINDOWS\system32\tmdyqx.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [58be37a2] rundll32.exe "C:\WINDOWS\system32\ydrbnljc.dll",b O4 - HKLM\..\Run: [BM5b8d043e] Rundll32.exe "C:\WINDOWS\system32\ytbqjlnq.dll",s O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin/module.main/favorites\ie_add_to.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: SnipeIt! eSnipe - http://www.esnipe.com/SnipeIt/SnipeItOpen3.asp O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: www.villagephotos.com O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1207382774359 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/def...jolauncher.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 9010 bytes combofix log: ComboFix 08-07-28.4 - HP_Owner 2008-07-28 19:58:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.559 [GMT -7:00] Running from: C:\Documents and Settings\HP_Owner\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\HP_Owner\Application Data\macromedia\Flash Player\#SharedObjects\5LJHQURD\interclick.com C:\Documents and Settings\HP_Owner\Application Data\macromedia\Flash Player\#SharedObjects\5LJHQURD\interclick.com\ud.sol C:\Documents and Settings\HP_Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\HP_Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\cookies.ini C:\WINDOWS\mainms.vpi C:\WINDOWS\pskt.ini C:\WINDOWS\system32\cdefNqru.ini C:\WINDOWS\system32\cdefNqru.ini2 C:\WINDOWS\system32\cjlnbrdy.ini C:\WINDOWS\system32\ddJmlRqr.ini C:\WINDOWS\system32\ddJmlRqr.ini2 C:\WINDOWS\system32\hfvlfvye.ini C:\WINDOWS\system32\jfkjofwx.ini C:\WINDOWS\system32\junvcduw.dll C:\WINDOWS\system32\jylldhkd.ini C:\WINDOWS\system32\lnsiidej.ini C:\WINDOWS\system32\mdgcrvlc.dll C:\WINDOWS\system32\mqedbbvo.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\uethfq.dll C:\WINDOWS\system32\urqNfedc.dll C:\WINDOWS\system32\yjviafpc.ini C:\WINDOWS\system32\zkmroi.dll D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AUTO_HOTKEY_POLLER -------\Service_Auto HotKey Poller ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-29 ))))))))))))))))))))))))))))))) . 2008-07-28 17:49 . 2008-07-28 17:49 105,472 --a------ C:\WINDOWS\system32\tmdyqx.dll 2008-07-28 17:49 . 2008-07-28 17:49 105,472 --a------ C:\WINDOWS\system32\cqfaxnst.dll 2008-07-28 17:49 . 2008-07-28 17:49 83,456 --a------ C:\WINDOWS\system32\ydrbnljc.dll 2008-07-28 17:48 . 2008-07-28 17:48 91,648 --a------ C:\WINDOWS\system32\ytbqjlnq.dll 2008-07-27 13:29 . 2008-07-27 13:29 105,472 --a------ C:\WINDOWS\system32\uplkdmmi.dll 2008-07-27 13:29 . 2008-07-27 13:29 105,472 --a------ C:\WINDOWS\system32\ueqpnk.dll 2008-07-27 13:23 . 2008-07-27 13:23 91,648 --a------ C:\WINDOWS\system32\fcvpiebf.dll 2008-07-26 01:57 . 2008-07-26 01:57 105,472 --a------ C:\WINDOWS\system32\rfrtdglx.dll 2008-07-26 01:57 . 2008-07-26 01:57 105,472 --a------ C:\WINDOWS\system32\leiuro.dll 2008-07-26 01:54 . 2008-07-26 01:54 91,648 --a------ C:\WINDOWS\system32\tgnjrgbm.dll 2008-07-26 01:00 . 2008-07-26 01:00 105,472 --a------ C:\WINDOWS\system32\mxyxhk.dll 2008-07-26 01:00 . 2008-07-26 01:00 105,472 --a------ C:\WINDOWS\system32\jnynjvxv.dll 2008-07-26 00:57 . 2008-07-26 00:57 83,456 --a------ C:\WINDOWS\system32\xwfojkfj.dll 2008-07-25 00:59 . 2008-07-25 00:58 105,472 --a------ C:\WINDOWS\system32\ckfozp.dll 2008-07-25 00:58 . 2008-07-25 00:58 105,472 --a------ C:\WINDOWS\system32\occxyugu.dll 2008-07-25 00:53 . 2008-07-25 00:53 91,648 --a------ C:\WINDOWS\system32\fcquspdj.dll 2008-07-23 22:01 . 2008-07-28 19:11 111,521 --a------ C:\WINDOWS\BM5b8d043e.xml 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmpEAE31.FOT 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmp74D31.FOT 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmp58D31.FOT 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmp4BD31.FOT 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmp20E31.FOT 2008-07-21 23:30 . 2008-07-21 23:30 1,409 --a------ C:\WINDOWS\system32\tmp07E31.FOT 2008-07-20 18:26 . 2008-07-20 18:26 60,928 --a------ C:\WINDOWS\system32\blphcpgsj0etbc.scr 2008-07-14 11:29 . 2008-07-14 11:29 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-14 11:20 . 2008-07-22 21:42 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmpEB972.FOT 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmpDF972.FOT 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmpB3A72.FOT 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmpA7A72.FOT 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmp9AA72.FOT 2008-07-12 12:58 . 2008-07-12 12:58 1,409 --a------ C:\WINDOWS\system32\tmp7EA72.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmpF4803.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmpE8803.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmp48703.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmp3C703.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmp1F703.FOT 2008-07-06 22:18 . 2008-07-06 22:18 1,409 --a------ C:\WINDOWS\system32\tmp02803.FOT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-29 03:05 94,302,240 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-29 02:11 --------- d-----w C:\Documents and Settings\HP_Owner\Application Data\MailWasherPro 2008-07-29 01:50 1,105,316 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-26 07:28 --------- d-----w C:\Program Files\Trillian 2008-07-24 05:17 --------- d-----w C:\Program Files\SpywareBlaster 2008-07-20 02:53 3,645 ----a-w C:\WINDOWS\viassary-hp.reg 2008-07-06 20:26 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-06 20:26 76,040 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys 2008-05-06 17:45 691,545 ----a-w C:\WINDOWS\unins000.exe 2008-05-04 11:14 13,766,723 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-08-10 00:07 97,448 ----a-w C:\Documents and Settings\HP_Owner\Application Data\GDIPFONTCACHEV1.DAT 2007-07-05 14:19 7,680 ----a-w C:\Documents and Settings\HP_Owner\mspich.exe 2006-02-07 05:17 686 ----a-w C:\Documents and Settings\HP_Owner\Application Data\wklnhst.dat 2006-06-01 21:27 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fe83ecbd-05c9-44e1-bdc2-4eb8095ec6f9}] 2008-07-28 17:49 105472 --a------ C:\WINDOWS\system32\tmdyqx.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe" [2004-11-11 18:50 212992] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00 1937408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04 52736] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 22:55 155648] "HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53 49152] "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:42 659456] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 20:43 233472] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 21:54 253952] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 13:41 196608] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03 81920] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-25 08:46 185784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-07 03:38 282624] "Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-06-06 16:52 936960] "VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20 2061816] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-11-22 19:12 1060864] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-06 13:26 1232152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "58be37a2"="C:\WINDOWS\system32\ydrbnljc.dll" [2008-07-28 17:49 83456] "BM5b8d043e"="C:\WINDOWS\system32\ytbqjlnq.dll" [2008-07-28 17:48 91648] "SiSPower"="SiSPower.dll" [2005-04-12 11:31 49152 C:\WINDOWS\system32\SiSPower.dll] "AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 88209 C:\WINDOWS\AGRSMMSG.exe] "Mouse Suite 98 Daemon"="ICO.EXE" [2003-11-20 14:08 57344 C:\WINDOWS\system32\ico.exe] "VTTimer"="VTTimer.exe" [2005-03-07 12:33 53248 C:\WINDOWS\system32\VTTimer.exe] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 05:31:38 241664] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-06-27 22:41:32 169472] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-05 00:17:04 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoa dGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-06 13:26] R1 pelmouse;Mouse Suite Drive;C:\WINDOWS\system32\DRIVERS\pelmouse.sys [2003-01-10 13:55] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-06 13:26] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-06 13:26] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-06 13:26] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-10-19 11:11] S3 pelps2m;i8042 Keyboard & PS/2 Mouse Port Driver;C:\WINDOWS\system32\DRIVERS\pelps2m.sys [2004-08-02 11:33] S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\D] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{e0739498-b087-11d9-876c-0011d8230b0e}] \Shell\AutoRun\command - G:\JDSecure\Windows\JDSecure20.exe . - - - - ORPHANS REMOVED - - - - BHO-{062AD784-8272-4AF5-924D-371D940B3B8A} - C:\WINDOWS\system32\rqRlmJdd.dll BHO-{B237C305-472A-45EA-90CB-0C02689EBFA4} - C:\WINDOWS\system32\rqRIyVlk.dll HKCU-Run-LDM - \Program\BackWeb-8876480.exe HKCU-Run-RegistryCleanFixMFC - C:\Program Files\RegistryCleaner\registrycleaner2008.exe HKLM-Run-NetStat Live - C:\Program Files\AnalogX\NetStat Live\nsl.exe HKLM-Run-AutoTBar - c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE HKLM-Run-lphcpgsj0etbc - C:\WINDOWS\system32\lphcpgsj0etbc.exe ShellExecuteHooks-{B237C305-472A-45EA-90CB-0C02689EBFA4} - C:\WINDOWS\system32\rqRIyVlk.dll Notify-rqRIyVlk - rqRIyVlk.dll . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.myspace.com/ R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1;localhost R1 -: HKCU-SearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com O8 -: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin/module.main/favorites\ie_add_to.html O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 -: SnipeIt! eSnipe - http://www.esnipe.com/SnipeIt/SnipeItOpen3.asp O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-28 20:26:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\ydrbnljc.dll -> C:\WINDOWS\system32\ytbqjlnq.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\FSRremoS.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\u pdate\update.exe . ************************************************************************** . Completion time: 2008-07-28 20:48:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-29 03:47:16 Pre-Run: 80,939,892,736 bytes free Post-Run: 80,920,027,136 bytes free 225 --- E O F --- 2008-07-20 07:00:25 |
29-Jul-2008, 01:10 PM
#9 | |||||
| Last edited by NWDaydreamer : 29-Jul-2008 02:32 PM. Reason: Hopefully figured it out? Sheesh! |
29-Jul-2008, 05:02 PM
#11 | |||||
 I don't know what I'm doing wrong but it says: File: mspich.exe Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 99cd458334f52f18e67578ee5d2b764e Packers detected: UPX can taken on 29 Jul 2008 20:56:49 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing |
29-Jul-2008, 05:25 PM
#12 | |||||
| |
29-Jul-2008, 05:52 PM
#13 | |||||
| That's OK. You did it right. As for those files, I need to know what the files names are and the paths to the files please. Open Notepad and copy and paste the text in the code box below into it: Code: File::
C:\WINDOWS\system32\tmdyqx.dll
C:\WINDOWS\system32\cqfaxnst.dll
C:\WINDOWS\system32\ydrbnljc.dll
C:\WINDOWS\system32\ytbqjlnq.dll
C:\WINDOWS\system32\uplkdmmi.dll
C:\WINDOWS\system32\ueqpnk.dll
C:\WINDOWS\system32\fcvpiebf.dll
C:\WINDOWS\system32\rfrtdglx.dll
C:\WINDOWS\system32\leiuro.dll
C:\WINDOWS\system32\tgnjrgbm.dll
C:\WINDOWS\system32\mxyxhk.dll
C:\WINDOWS\system32\jnynjvxv.dll
C:\WINDOWS\system32\xwfojkfj.dll
C:\WINDOWS\system32\ckfozp.dll
C:\WINDOWS\system32\occxyugu.dll
C:\WINDOWS\system32\fcquspdj.dll
C:\WINDOWS\BM5b8d043e.xml
C:\WINDOWS\system32\tmpEAE31.FOT
C:\WINDOWS\system32\tmp74D31.FOT
C:\WINDOWS\system32\tmp58D31.FOT
C:\WINDOWS\system32\tmp4BD31.FOT
C:\WINDOWS\system32\tmp20E31.FOT
C:\WINDOWS\system32\tmp07E31.FOT
C:\WINDOWS\system32\blphcpgsj0etbc.scr
C:\WINDOWS\system32\tmpEB972.FOT
C:\WINDOWS\system32\tmpDF972.FOT
C:\WINDOWS\system32\tmpB3A72.FOT
C:\WINDOWS\system32\tmpA7A72.FOT
C:\WINDOWS\system32\tmp9AA72.FOT
C:\WINDOWS\system32\tmp7EA72.FOT
C:\WINDOWS\system32\tmpF4803.FOT
C:\WINDOWS\system32\tmpE8803.FOT
C:\WINDOWS\system32\tmp48703.FOT
C:\WINDOWS\system32\tmp3C703.FOT
C:\WINDOWS\system32\tmp1F703.FOT
C:\WINDOWS\system32\tmp02803.FOT
C:\WINDOWS\system32\tmdyqx.dll
C:\WINDOWS\system32\ydrbnljc.dll
C:\WINDOWS\system32\ytbqjlnq.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fe83ecbd-05c9-44e1-bdc2-4eb8095ec6f9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"58be37a2"=-
"BM5b8d043e"=- Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.
__________________ Microsoft MVP - Consumer Security Alliance of Security Analysis Professionals |
29-Jul-2008, 07:05 PM
#14 | |||||
| |
