Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Virus & Other Malware Removal Virus & Other Malware Removal
Go to first new post email hacked
Go to first new post Files keep deleting themselves! NEED HEL ...
Go to first new post Windows Vista Home
Go to first new post Fubar virus?
Go to first new post Firefox -> google -> url hijack
Go to first new post Freezing Computer and beyond ridiculousl ...
Go to first new post windows XP OBJECT DELAY LOAD
Go to first new post Shell.exe - System Error (Miner.dll miss ...
Go to first new post Audio Ads Playing in the Background + Ot ...
Go to first new post Can't right click, copy or delete files ...
Go to first new post Trojan virus
Go to first new post BSOD ntoskrnl.exe error after FBI Cyberc ...
Go to first new post Browser shutdown
Go to first new post Click live search redirect..........Help ...
Go to first new post Infected with "Police Cybercrime In ...
Search Search
Search for:
Tech Support Guy Forums > > >

Solved: Need malware removal help

(New)
(!)

Reply
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
11-Aug-2007, 01:51 PM #1
Solved: Need malware removal help
Ad-Aware isn't quite doing it this time. Here's my hijack this log:



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 1:49:19 PM, on 8/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\gkrkfrtA.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\svhost.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\regscan.exe
C:\PROGRA~1\COMMON~1\SMBOLS~1\notepad.exe
C:\WINDOWS\system32\S?mantec\?canregw.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\gkrkfrt.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\retadpu77.exe
C:\Documents and Settings\Goober\Application Data\Microsoft\Windows\myskfh.exe
C:\Documents and Settings\Goober\Application Data\WinTouch\WinTouch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Goober\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3964D8D6-86D0-493A-B460-A805B5401114} - C:\WINDOWS\System32\khfgeda.dll
O2 - BHO: (no name) - {48FAAECA-400E-67D4-2970-3CB6033FA5B8} - C:\WINDOWS\System32\fooamevx.dll
O2 - BHO: 0 - {50DD82F9-2D7E-4778-0886-10AFFF5EFD35} - C:\Program Files\Windows NT\wohucav.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5D4FCEA9-C8D5-4CD6-AF72-EA2087F9B0C1} - C:\Program Files\MSN Gaming Zone\savej83122.dll
O2 - BHO: (no name) - {8C3049B1-49B1-4052-B884-21E2DF868460} - C:\Program Files\MSN Gaming Zone\savej4444.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\System32\ffmbdytj.dll
O2 - BHO: (no name) - {CB569602-271F-4444-BC63-07AF8EC06D81} - C:\WINDOWS\System32\ssqqq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gkrkfrtA] C:\WINDOWS\gkrkfrtA.exe
O4 - HKLM\..\Run: [{ZN}] C:\WINDOWS\TISKY009.exe SKY009
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\System32\tmthfoqj.dll",forkonce
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe" -c
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\System32\regscan.exe
O4 - HKCU\..\Run: [Amne] "C:\PROGRA~1\COMMON~1\SMBOLS~1\notepad.exe" -vt yazb
O4 - HKCU\..\Run: [Vcn] C:\WINDOWS\system32\S?mantec\?canregw.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Goober\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Goober\Application Data\Microsoft\Windows\myskfh.exe
O4 - HKUS\S-1-5-19\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.0\webbuying.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WinCore32.exe] C:\WINDOWS\System32\WinCore32.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OuterinfoUpdate] "C:\Program Files\Outerinfo\OuterinfoUpdate.exe" (User 'NETWORK SERVICE')
O4 - Startup: TA_Start.lnk = C:\WINDOWS\TISKY009.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: khfgeda - C:\WINDOWS\SYSTEM32\khfgeda.dll
O20 - Winlogon Notify: ssqqq - C:\WINDOWS\System32\ssqqq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\gkrkfrt.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

--
End of file - 8566 bytes
MFDnNC's Avatar
Member with 49,015 posts.
  
Join Date: Sep 2004
11-Aug-2007, 02:35 PM #2
NOTE: If you have downloaded ComboFix previously please delete that version and download it again!

Download this file :

http://www.techsupportforum.com/sect...s/ComboFix.exe
or
http://download.bleepingcomputer.com...a/ComboFix.exe

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJack log in your next reply

Note:
Do not mouseclick combofix's window while its running. That may cause it to stall

=====================
Download Superantispyware (SAS) free home version

http://www.superantispyware.com/supe...freevspro.html

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.
· Please paste that information here for me with a new HijackThis log.

This will take some time!!!!!!!!
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
11-Aug-2007, 11:11 PM #3
First, the ComboFix log. I couldn't remember where it was saved, but I think this is it. I hope it is.

ComboFix 07-08-09.3 - "Goober" 2007-08-11 17:08:48.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.543 [GMT -4:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\GOOBER\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\GOOBER\APPLIC~1\WinTouch\WinTouch.exe
C:\DOCUME~1\GOOBER\APPLIC~1\WinTouch\WTUninstaller.exe
C:\DOCUME~1\Goober\Desktop\Download WinAntiSpyware 2007 Free.lnk
C:\DOCUME~1\Goober\STARTM~1\Programs.\Outerinfo
C:\DOCUME~1\Goober\STARTM~1\Programs.\Outerinfo\Terms.lnk
C:\DOCUME~1\Goober\STARTM~1\Programs.\Outerinfo\Uninstall.lnk
C:\DOCUME~1\LOCALS~1\APPLIC~1\.rdr.ini
C:\Program Files\Common Files\smbols~1
C:\Program Files\Common Files\smbols~1\notepad.exe
C:\Program Files\Common Files\smbols~1\s?mbols\
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\WinAntiSpyware 2007\err.log
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2\YazzleBundle-1122.exe
C:\Program Files\MSN Gaming Zone\savej2.dll
C:\Program Files\MSN Gaming Zone\savej4444.dll
C:\Program Files\MSN Gaming Zone\savej5555.dll
C:\Program Files\MSN Gaming Zone\savej83122.dll
C:\Program Files\outerinfo
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\svhost
C:\Program Files\svhost\wr-1-0000077.exe
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.0\wbuninst.exe
C:\Program Files\web buying\v1.8.0\webbuying.exe
C:\Program Files\Windows NT\baqyqypr.html
C:\Program Files\Windows NT\wohucav.dll
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\brr
C:\temp\brr\tmpZTF.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\U.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\csrss.exe
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\DOWNLO~1\UWA7P_0001_N91M0809NetInstaller.exe
C:\WINDOWS\g4356cbvy63.exe
C:\WINDOWS\gkrkfrt.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\retadpu27.exe
C:\WINDOWS\retadpu361.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\smante~1
C:\WINDOWS\spooldr.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\20523257841.dll
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\b06FdUe
C:\WINDOWS\system32\b06FdUe\b06FdUe1083.exe
C:\WINDOWS\system32\byxwxwu.dll
C:\WINDOWS\system32\configs
C:\WINDOWS\system32\configs\kmhp83122.exe
C:\WINDOWS\system32\dllh8jkd1q1.exe
C:\WINDOWS\system32\dllh8jkd1q2.exe
C:\WINDOWS\system32\dllh8jkd1q5.exe
C:\WINDOWS\system32\dllh8jkd1q6.exe
C:\WINDOWS\system32\dllh8jkd1q7.exe
C:\WINDOWS\system32\dllh8jkd1q8.exe
C:\WINDOWS\system32\driver
C:\WINDOWS\system32\driver\w717.exe
C:\WINDOWS\system32\driver\wr73.exe
C:\WINDOWS\system32\drivers\ApiMon.sys
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\dwdsregt.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
C:\WINDOWS\system32\f06WtR
C:\WINDOWS\system32\f06WtR\f06WtR1083.exe
C:\WINDOWS\system32\f10WtR
C:\WINDOWS\system32\f10WtR\f10WtR1099.exe
C:\WINDOWS\system32\F2
C:\WINDOWS\system32\F3
C:\WINDOWS\system32\F3\n553.exe
C:\WINDOWS\system32\ffmbdytj.dll
C:\WINDOWS\system32\fooamevx.dll
C:\WINDOWS\system32\gmc.exe.exe
C:\WINDOWS\system32\jqofhtmt.ini
C:\WINDOWS\system32\kernelwind32.exe
C:\WINDOWS\system32\khfgeda.dll
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\ljjhhgh.dll
C:\WINDOWS\system32\max1d1164v.exe
C:\WINDOWS\system32\msbind32.exe
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\NSIS.Library.RegTool.v2.{777793CC-44B6-4E4B-9C6F-2C5B7F79BE6A}.exe
C:\WINDOWS\system32\NSIS.Library.RegTool.v2.{B151C8B4-BAFD-40E2-BBBD-F05659E2E4EE}.exe
C:\WINDOWS\system32\ocfbgvkq.dll
C:\WINDOWS\system32\Outerinfo-1440.exe
C:\WINDOWS\system32\qkvgbfco.ini
C:\WINDOWS\system32\qqqss.bak1
C:\WINDOWS\system32\qqqss.bak2
C:\WINDOWS\system32\qqqss.ini
C:\WINDOWS\system32\qqqss.tmp
C:\WINDOWS\system32\regscan.exe
C:\WINDOWS\system32\setup155.exe
C:\WINDOWS\system32\smante~1
C:\WINDOWS\system32\smante~1\?canregw.exe
C:\WINDOWS\system32\spoolsvv.exe
C:\WINDOWS\system32\ssqqq.dll
C:\WINDOWS\system32\stera.exe
C:\WINDOWS\system32\TISKY008.exe
C:\WINDOWS\system32\tmthfoqj.dll
C:\WINDOWS\system32\vedxg3am1et3.exe
C:\WINDOWS\system32\vedxg4am1et2.exe
C:\WINDOWS\system32\vedxg6ame4.exe
C:\WINDOWS\system32\vedxga1me4t1.exe
C:\WINDOWS\system32\vedxga3me2.exe
C:\WINDOWS\system32\vedxga4m1et4.exe
C:\WINDOWS\system32\vedxga4me1.exe
C:\WINDOWS\system32\vedxga5me3.exe
C:\WINDOWS\system32\WinCore32.exe
C:\WINDOWS\system32\winnb58.dll
C:\WINDOWS\system32\wmvds32.dll
C:\WINDOWS\system32\wnscpicomsv32.exe
C:\WINDOWS\system32\wvutsss.dll
C:\WINDOWS\system32\xxyxusr.dll
C:\WINDOWS\system32\yshhaiq.dll
C:\WINDOWS\system32\Z1
C:\WINDOWS\system32\Z2
C:\WINDOWS\system32\Z2\nze55.exe
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\TISKY009.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\TTC-4444.exe
C:\WINDOWS\uni_eh44.exe
C:\WINDOWS\uninst1014.exe
C:\WINDOWS\uninst2.htm
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\unist1.htm
C:\WINDOWS\wr.txt
C:\windows\xpupdate.exe
C:\WINDOWS\xpupdate.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CMDSERVICE
-------\LEGACY_FOPN
-------\LEGACY_NETWORK_MONITOR
-------\LEGACY_NET_AGENT
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
-------\fopn
-------\Net Agent
-------\Windows Overlay Components


((((((((((((((((((((((((( Files Created from 2007-07-11 to 2007-08-11 )))))))))))))))))))))))))))))))


2007-08-11 17:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-11 12:50 <DIR> d-------- C:\Program Files\Common Files\çasks
2007-08-11 12:46 393,224 --a------ C:\sysqftn.exe
2007-08-11 12:46 393,224 --a------ C:\sysexmo.exe
2007-08-11 12:34 1,024 --ah----- C:\aaw7boot.cmd
2007-08-11 12:10 <DIR> d--hs---- C:\WINDOWS\Tmltcm9k
2007-08-11 12:10 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-11 04:54 75,328 --a------ C:\WINDOWS\system32\apwwekyq.exe
2007-08-09 17:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-09 17:28 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-09 16:52 9,769 --a------ C:\WINDOWS\system32\user10.exe
2007-08-09 16:52 86,056 --a------ C:\WINDOWS\system32\install.exe
2007-08-09 16:52 8,782 --a------ C:\WINDOWS\system32\waverevenue.exe
2007-08-09 16:52 7,680 --a------ C:\WINDOWS\system32\drivers\i2omgmt.sys
2007-08-09 16:52 7,680 --a------ C:\WINDOWS\system32\dllcache\i2omgmt.sys
2007-08-09 16:52 7,296 --a------ C:\WINDOWS\system32\drivers\changer.sys
2007-08-09 16:52 7,296 --a------ C:\WINDOWS\system32\dllcache\changer.sys
2007-08-09 16:52 37,848 --a------ C:\WINDOWS\system32\SysDAFS.exe
2007-08-09 16:52 35,328 --a------ C:\WINDOWS\system32\shslctr.dll
2007-08-09 16:52 33,408 --a------ C:\WINDOWS\system32\drivers\lbrtfdc.sys
2007-08-09 16:52 33,408 --a------ C:\WINDOWS\system32\dllcache\lbrtfdc.sys
2007-08-09 16:52 30,770 --a------ C:\WINDOWS\system32\is67718.exe
2007-08-09 16:52 169,147 --a------ C:\WINDOWS\TTC-5555.exe
2007-08-09 16:52 135,168 --a------ C:\WINDOWS\tk68.exe
2007-08-09 16:51 67,584 --a------ C:\WINDOWS\system32\l3acdb.dll
2007-08-09 16:51 65,536 --a------ C:\WINDOWS\system32\sdadlrow-t2.exe
2007-08-09 16:51 57,349 --a------ C:\WINDOWS\system32\lqdsrngs.exe
2007-08-04 23:39 192,616 --a------ C:\WINDOWS\system32\kwinrmdt.exe
2007-08-04 23:39 <DIR> d-------- C:\WINDOWS\system32\IMES
2007-08-04 23:39 <DIR> d-------- C:\Temp\1bc
2007-08-04 23:24 9,769 --a------ C:\WINDOWS\filho0578.exe
2007-08-04 12:57 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-08-04 12:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-08-04 12:57 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-08-04 12:53 206,352 --------- C:\WINDOWS\gkrkfrtA.exe
2007-08-04 12:53 <DIR> d-------- C:\Temp


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-11 17:12 384 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000D-00001102-00000004-10031102}.dat
2007-08-11 17:12 384 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000D-00001102-00000004-10031102}.dat
2007-08-11 12:50 --------- d-------- C:\Program Files\Common Files\?asks
2007-08-09 16:52 348288 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-08-09 16:52 348288 --a------ C:\WINDOWS\system32\dllcache\tcpip.sys
2004-04-01 19:51 21904 --a------ C:\DOCUME~1\Goober\APPLIC~1\GDIPFONTCACHEV1.DAT
2005-07-29 20:24:26 472 --sha-r C:\WINDOWS\Tmltcm9k\nA5QwA64.vbs

C:\WINDOWS\system32\drivers\tcpip.sys ... is infected !! (additional data below)
348,288 2007-08-09 20:52:18 C:\WINDOWS\system32\drivers\tcpip.sys
348,288 2007-08-09 20:52:16 C:\WINDOWS\system32\dllcache\tcpip.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-10-29 16:50]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 03:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 14:54]
"gkrkfrtA"="C:\WINDOWS\gkrkfrtA.exe" [1989-12-12 10:10]
"svhost"="C:\WINDOWS\svhost.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM95\aim.exe" [2004-09-01 11:26]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2005-08-25 23:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-07-29 19:34]
"Amne"="C:\PROGRA~1\COMMON~1\SMBOLS~1\notepad.exe" []
"Vcn"="C:\WINDOWS\system32\S?mantec\?canregw.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-03-03 18:00:44]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Windows NT\baqyqypr.html
FriendlyName=

R0 HPT3xxNT;HPT3xxNT;C:\WINDOWS\System32\drivers\HPT3xxNT.sys
R2 CVPND;Cisco Systems, Inc. VPN Service;"C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
R2 CVPNDRVA;Cisco Systems IPsec Driver;\??\C:\WINDOWS\System32\Drivers\CVPNDRVA.sys
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\System32\DRIVERS\AN983.sys
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\System32\DRIVERS\dne2000.sys
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\System32\DRIVERS\CVirtA.sys
S3 pnicml;pnicml;\??\C:\DOCUME~1\Goober\LOCALS~1\Temp\pnicml.sys
S3 RimUsb;RIM Handheld;C:\WINDOWS\System32\Drivers\RimUsb.sys
S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Standard 2004 (Win32 x86)\Sandra.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-11 17:14:01
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-11 17:15:13 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-11 17:15

--- E O F ---


There wasn't room for the SUPERAntiSpyware log, so I'll post the HijackThis log and make a second reply with the SUPERAntiSpyware log.


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:07:49 PM, on 8/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Goober\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gkrkfrtA] C:\WINDOWS\gkrkfrtA.exe
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Amne] "C:\PROGRA~1\COMMON~1\SMBOLS~1\notepad.exe" -vt yazb
O4 - HKCU\..\Run: [Vcn] C:\WINDOWS\system32\S?mantec\?canregw.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.0\webbuying.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WinCore32.exe] C:\WINDOWS\System32\WinCore32.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OuterinfoUpdate] "C:\Program Files\Outerinfo\OuterinfoUpdate.exe" (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

--
End of file - 6015 bytes
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
11-Aug-2007, 11:12 PM #4
Here's the SUPERAntiSpyware log:




SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/11/2007 at 06:49 PM

Application Version : 3.9.1008

Core Rules Database Version : 3284
Trace Rules Database Version: 1295

Scan type : Complete Scan
Total Scan Time : 01:27:43

Memory items scanned : 357
Memory threats detected : 1
Registry items scanned : 4745
Registry threats detected : 14
File items scanned : 53397
File threats detected : 222

Trojan.Downloader-SysMon
C:\WINDOWS\GKRKFRTA.EXE
C:\WINDOWS\GKRKFRTA.EXE
C:\WINDOWS\Prefetch\GKRKFRTA.EXE-2A4CB81A.pf

Adware.Tracking Cookie
C:\Documents and Settings\Goober\Cookies\goober@ads.k8l[1].txt
C:\Documents and Settings\Goober\Cookies\goober@server.iad.liveperson[2].txt
C:\Documents and Settings\Goober\Cookies\goober@atdmt[3].txt
C:\Documents and Settings\Goober\Cookies\goober@clicksor[1].txt
C:\Documents and Settings\Goober\Cookies\goober@questionmarket[2].txt
C:\Documents and Settings\Goober\Cookies\goober@redorbit.us.intellitxt[1].txt
C:\Documents and Settings\Goober\Cookies\goober@doubleclick[3].txt
C:\Documents and Settings\Goober\Cookies\goober@statcounter[1].txt
C:\Documents and Settings\Goober\Cookies\goober@heavycom.122.2o7[2].txt
C:\Documents and Settings\Goober\Cookies\goober@stats.drivecleaner[2].txt
C:\Documents and Settings\Goober\Cookies\goober@cgi-bin[7].txt
C:\Documents and Settings\Goober\Cookies\goober@realmedia[2].txt
C:\Documents and Settings\Goober\Cookies\goober@directtrack[2].txt
C:\Documents and Settings\Goober\Cookies\goober@burstnet[4].txt
C:\Documents and Settings\Goober\Cookies\goober@www.burstnet[2].txt
C:\Documents and Settings\Goober\Cookies\goober@47172510[2].txt
C:\Documents and Settings\Goober\Cookies\goober@try.starware[1].txt
C:\Documents and Settings\Goober\Cookies\goober@zedo[4].txt
C:\Documents and Settings\Goober\Cookies\goober@revenuesense[1].txt
C:\Documents and Settings\Goober\Cookies\goober@tacoda[2].txt
C:\Documents and Settings\Goober\Cookies\goober@anad.tacoda[2].txt
C:\Documents and Settings\Goober\Cookies\goober@tribalfusion[2].txt
C:\Documents and Settings\Goober\Cookies\goober@toseeka[1].txt
C:\Documents and Settings\Goober\Cookies\goober@cpvfeed[3].txt
C:\Documents and Settings\Goober\Cookies\goober@winantispyware[2].txt
C:\Documents and Settings\Goober\Cookies\goober@www.drivecleaner[2].txt
C:\Documents and Settings\Goober\Cookies\goober@buzznet.112.2o7[1].txt
C:\Documents and Settings\Goober\Cookies\goober@localsrv[3].txt
C:\Documents and Settings\Goober\Cookies\goober@ad.yieldmanager[2].txt
C:\Documents and Settings\Goober\Cookies\goober@h.starware[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ad.outerinfo[2].txt
C:\Documents and Settings\Goober\Cookies\goober@media.top-banners[2].txt
C:\Documents and Settings\Goober\Cookies\goober@banners.searchingbooth[1].txt
C:\Documents and Settings\Goober\Cookies\goober@www.amaena[1].txt
C:\Documents and Settings\Goober\Cookies\goober@vhost.oddcast[2].txt
C:\Documents and Settings\Goober\Cookies\goober@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Goober\Cookies\goober@oddcast[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.pointroll[4].txt
C:\Documents and Settings\Goober\Cookies\goober@interclick[4].txt
C:\Documents and Settings\Goober\Cookies\goober@drivecleaner[3].txt
C:\Documents and Settings\Goober\Cookies\goober@redorbit[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.addynamix[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ehg-maniatv.hitbox[1].txt
C:\Documents and Settings\Goober\Cookies\goober@adsrevenue[1].txt
C:\Documents and Settings\NetworkService\Cookies\network service@ads4.think-adz[1].txt
C:\Documents and Settings\LocalService\Cookies\local service@ads.k8l[1].txt
C:\Documents and Settings\Goober\Cookies\goober@atwola[1].txt
C:\Documents and Settings\Goober\Cookies\goober@creativeby.viewpoint[1].txt
C:\Documents and Settings\Goober\Cookies\goober@drt.directtrack[2].txt
C:\Documents and Settings\Goober\Cookies\goober@a.websponsors[2].txt
C:\Documents and Settings\Goober\Cookies\goober@qnsr[2].txt
C:\Documents and Settings\Goober\Cookies\goober@windowsmedia[1].txt
C:\Documents and Settings\Goober\Cookies\goober@atwola[2].txt
C:\Documents and Settings\Goober\Cookies\goober@www.guptamedianetwork[2].txt
C:\Documents and Settings\Goober\Cookies\goober@atwola[3].txt
C:\Documents and Settings\Goober\Cookies\goober@doubleclick[1].txt
C:\Documents and Settings\Goober\Cookies\goober@adecn[1].txt
C:\Documents and Settings\Goober\Cookies\goober@windowsmedia[2].txt
C:\Documents and Settings\Goober\Cookies\goober@dist.belnk[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ad.outerinfo[1].txt
C:\Documents and Settings\Goober\Cookies\goober@rightmedia[2].txt
C:\Documents and Settings\Goober\Cookies\goober@creativeby.viewpoint[3].txt
C:\Documents and Settings\Goober\Cookies\goober@nextag[4].txt
C:\Documents and Settings\Goober\Cookies\goober@nextag[1].txt
C:\Documents and Settings\Goober\Cookies\goober@adopt.specificclick[2].txt
C:\Documents and Settings\Goober\Cookies\goober@nextag[3].txt
C:\Documents and Settings\Goober\Cookies\goober@icc.intellisrv[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.pointroll[1].txt
C:\Documents and Settings\Goober\Cookies\goober@qnsr[1].txt
C:\Documents and Settings\Goober\Cookies\goober@winantispyware[1].txt
C:\Documents and Settings\Goober\Cookies\goober@atwola[4].txt
C:\Documents and Settings\Goober\Cookies\goober@windowsmedia[3].txt
C:\Documents and Settings\Goober\Cookies\goober@belnk[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.blizzard[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ath.belnk[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.realcastmedia[1].txt
C:\Documents and Settings\Goober\Cookies\goober@http.edge.vru4[1].txt
C:\Documents and Settings\Goober\Cookies\goober@www.adserv[1].txt
C:\Documents and Settings\Goober\Cookies\goober@adknowledge[2].txt
C:\Documents and Settings\Goober\Cookies\goober@adopt.hbmediapro[2].txt
C:\Documents and Settings\Goober\Cookies\goober@admarketplace[2].txt
C:\Documents and Settings\Goober\Cookies\goober@zedo[2].txt
C:\Documents and Settings\Goober\Cookies\goober@mediamgr.ugo[2].txt
C:\Documents and Settings\Goober\Cookies\goober@dist.belnk[3].txt
C:\Documents and Settings\Goober\Cookies\goober@ar.atwola[1].txt
C:\Documents and Settings\Goober\Cookies\goober@exitexchange[1].txt
C:\Documents and Settings\Goober\Cookies\goober@xiti[1].txt
C:\Documents and Settings\Goober\Cookies\goober@doubleclick[2].txt
C:\Documents and Settings\Goober\Cookies\goober@banner[1].txt
C:\Documents and Settings\Goober\Cookies\goober@heavycom.122.2o7[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.pointroll[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.cc214142[2].txt
C:\Documents and Settings\Goober\Cookies\goober@hurricanedigitalmedia[2].txt
C:\Documents and Settings\Goober\Cookies\goober@icc.intellisrv[3].txt
C:\Documents and Settings\Goober\Cookies\goober@nextag[2].txt
C:\Documents and Settings\Goober\Cookies\goober@interclick[1].txt
C:\Documents and Settings\Goober\Cookies\goober@yieldmanager[1].txt
C:\Documents and Settings\Goober\Cookies\goober@regalinteractive[2].txt
C:\Documents and Settings\Goober\Cookies\goober@campaign.indieclick[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.realtechnetwork[1].txt
C:\Documents and Settings\Goober\Cookies\goober@winantivirus[2].txt
C:\Documents and Settings\Goober\Cookies\goober@adopt.specificclick[3].txt
C:\Documents and Settings\Goober\Cookies\goober@sales.liveperson[2].txt
C:\Documents and Settings\Goober\Cookies\goober@server.cpmstar[2].txt
C:\Documents and Settings\Goober\Cookies\goober@adecn[3].txt
C:\Documents and Settings\Goober\Cookies\goober@hits.clickandtrack[1].txt
C:\Documents and Settings\Goober\Cookies\goober@burstnet[2].txt
C:\Documents and Settings\Goober\Cookies\goober@www.burstbeacon[1].txt
C:\Documents and Settings\Goober\Cookies\goober@data1.perf.overture[1].txt
C:\Documents and Settings\Goober\Cookies\goober@www.winantivirus[1].txt
C:\Documents and Settings\Goober\Cookies\goober@drivecleaner[2].txt
C:\Documents and Settings\Goober\Cookies\goober@zedo[3].txt
C:\Documents and Settings\Goober\Cookies\goober@hc2.humanclick[2].txt
C:\Documents and Settings\Goober\Cookies\goober@cpvfeed[2].txt
C:\Documents and Settings\Goober\Cookies\goober@www.xctrk[2].txt
C:\Documents and Settings\Goober\Cookies\goober@a.websponsors[3].txt
C:\Documents and Settings\Goober\Cookies\goober@winantivirus[1].txt
C:\Documents and Settings\Goober\Cookies\goober@media.top-banners[1].txt
C:\Documents and Settings\Goober\Cookies\goober@kanoodle[1].txt
C:\Documents and Settings\Goober\Cookies\goober@adknowledge[1].txt
C:\Documents and Settings\Goober\Cookies\goober@belnk[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ehg-bestbuy.hitbox[1].txt
C:\Documents and Settings\Goober\Cookies\goober@yieldmanager[2].txt
C:\Documents and Settings\Goober\Cookies\goober@track.bestbuy[2].txt
C:\Documents and Settings\Goober\Cookies\goober@network.realmedia[1].txt
C:\Documents and Settings\Goober\Cookies\goober@burstnet[3].txt
C:\Documents and Settings\Goober\Cookies\goober@login.tracking101[2].txt
C:\Documents and Settings\Goober\Cookies\goober@adecn[2].txt
C:\Documents and Settings\Goober\Cookies\goober@interclick[3].txt
C:\Documents and Settings\Goober\Cookies\goober@www.burstbeacon[2].txt
C:\Documents and Settings\Goober\Cookies\goober@dist.belnk[4].txt
C:\Documents and Settings\Goober\Cookies\goober@adopt.specificclick[4].txt
C:\Documents and Settings\Goober\Cookies\goober@atdmt[2].txt
C:\Documents and Settings\Goober\Cookies\goober@track.webgains[2].txt
C:\Documents and Settings\Goober\Cookies\goober@ads.realtechnetwork[2].txt
C:\Documents and Settings\Goober\Cookies\goober@tracking.webdiversity.co[1].txt
C:\Documents and Settings\Goober\Cookies\goober@ad.yieldmanager[1].txt
C:\Documents and Settings\Goober\Cookies\goober@server.iad.liveperson[1].txt
C:\Documents and Settings\Goober\Cookies\goober@stats[1].txt
C:\Documents and Settings\Goober\Cookies\goober@directtrack[1].txt
C:\Documents and Settings\Goober\Cookies\goober@popularmedia.directtrack[2].txt
C:\Documents and Settings\Goober\Cookies\goober@winantispyware[3].txt
C:\Documents and Settings\Goober\Cookies\goober@atwola[6].txt
C:\Documents and Settings\Goober\Cookies\goober@a.websponsors[4].txt
C:\Documents and Settings\Goober\Cookies\goober@mediaservices.myspace[2].txt
C:\Documents and Settings\Goober\Cookies\goober@geo.precisionclick[1].txt
C:\Documents and Settings\Goober\Cookies\goober@clicksector[2].txt

Registry Cleaner Trial
HKCR\CLSID\{205FF73B-CA67-11D5-99DD-444553540013}
HKCR\CLSID\{205FF73B-CA67-11D5-99DD-444553540013}\Implemented Categories
HKCR\CLSID\{205FF73B-CA67-11D5-99DD-444553540013}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKCR\CLSID\{205FF73B-CA67-11D5-99DD-444553540013}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKU\S-1-5-21-1078081533-764733703-854245398-1003\Software\Registry Cleaner
C:\Program Files\Registry Cleaner Trial\rcs_fcax7.exe
C:\Program Files\Registry Cleaner Trial\Install.log
C:\Program Files\Registry Cleaner Trial
C:\Documents and Settings\Goober\Application Data\Registry Cleaner\RegClean.ini
C:\Documents and Settings\Goober\Application Data\Registry Cleaner

Trojan.Windows Overlay Components/SysMon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OvMon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OvMon#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OvMon#UninstallStr ing

Adware.ClickSpring/Yazzle
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#Disp layName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#Unin stallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#Help Link
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#Publ isher
C:\WINDOWS\PREFETCH\YAZZLE1122OINADMIN.EXE-0A0C4823.PF
C:\WINDOWS\PREFETCH\YAZZLEBUNDLE-1122.EXE-0E9F0099.PF
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1122OINADMIN.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1122OINUNINSTALLER.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\INETGET2\YAZZLEBUNDLE-1122.EXE.VIR

Adware.IST/ISTBar (Slotch Bar)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main#BandRest [ Never ]

Adware.WebBuying-Installer
C:\WINDOWS\SYSTEM32\IMES\WB72.EXE

Trojan.ZenoSearch
C:\WINDOWS\SYSTEM32\KWINRMDT.EXE
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MDUV432H\DT[1].EXE

Trojan.Downloader-LDCore
C:\WINDOWS\SYSTEM32\USER10.EXE
C:\WINDOWS\FILHO0578.EXE
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\YZARC36R\USER9[1].EXE
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\YZARC36R\USER10[1].EXE
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\LDCORE.DLL.VIR

Trojan.Rootkit-TnCore/Installer
C:\WINDOWS\SYSTEM32\INSTALL.EXE
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\YZARC36R\INSTALL[1].EXE

Trojan.Downloader-SP2F/Resident
C:\WINDOWS\SYSTEM32\JY.DLL

Trojan.ZQuest-Installer
C:\WINDOWS\TK68.EXE
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\IVYVU56F\TK68[1].EXE
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SZ29QL87\TK58[1].EXE
C:\QOOBOX\QUARANTINE\C\WINDOWS\TK58.EXE.VIR

Trojan.Unknown Origin
C:\WINDOWS\TMLTCM9K\NA5QWA64.VBS
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\WNSCPICOMSV32.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\CONFIGS\KMHP83122.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNINSTALL_NMON.VBS.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\B104.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNIST1.HTM.VIR

Adware.Adservs
C:\WINDOWS\TMLTCM9K\ASAPPSRV.DLL

Adware.ZenoSearch
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\IVYVU56F\TISKY008[1].EXE
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\DWDSREGT.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\TISKY008.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\TISKY009.EXE.VIR

Trojan.Downloader-Gen/Win
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\IVYVU56F\RETADPU[1].EXE
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\X4WRYELJ\RETADPU[1].EXE
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\I7ADSLMH\RETADPU[1].EXE
C:\QOOBOX\QUARANTINE\C\WINDOWS\RETADPU27.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\RETADPU361.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\RETADPU77.EXE.VIR

Trojan.TagASaurus
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\DESKTOP\SEARCHUS.EXE
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\DESKTOP\SEARCHUS.EXE

Adware.RAC
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MDUV432H\83122[1].EXE

Worm.Sober Variant
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\SMBOLS~1\NOTEPAD.EXE.VIR

Trojan.WinAntiSpyware 2007
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\WINANTISPYWARE 2007\WAS7MON.EXE.VIR

Adware.k8l
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WINDOWS NT\BAQYQYPR.HTML.VIR

Trojan.ZQuest
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WINDOWS NT\WOHUCAV.DLL.VIR

Unclassified.Unknown Origin
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MSN GAMING ZONE\SAVEJ83122.DLL.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MSN GAMING ZONE\SAVEJ2.DLL.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MSN GAMING ZONE\SAVEJ5555.DLL.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MSN GAMING ZONE\SAVEJ4444.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\YSHHAIQ.DLL.VIR

Adware.WebBuying Assistant-Installer
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WEB BUYING\V1.8.0\WBUNINST.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WEB BUYING\V1.8.0\WEBBUYING.EXE.VIR

Dialer.Dial/Gen Variant
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\MAX1D1164V.EXE.VIR

Adware.ClickSpring/Resident
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\FOOAMEVX.DLL.VIR

Adware.Vundo Variant
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\BYXWXWU.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\KHFGEDA.DLL.VIR

Adware.ClickSpring
C:\QooBox\Quarantine\C\WINDOWS\system32\SMANTE~1\CANREG~1.VIR

Adware.SysMon
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\F3\N553.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\Z2\NZE55.EXE.VIR

Adware.Mirar/NetNucleus
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\WINNB58.DLL.VIR

Adware.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\ZXDNT3D.CFG.VIR

Trojan.Downloader-Stera/WinSoftware
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\STERA.EXE.VIR

Trojan.WinAntiSpyware/WinAntiVirus 2006
C:\QOOBOX\QUARANTINE\C\WINDOWS\DOWNLO~1\UWA7P_0001_N91M0809NETINSTALLER.EXE .VIR

Trojan.Downloader-Gen/BasicMath
C:\QOOBOX\QUARANTINE\C\WINDOWS\DLS0523PMW.EXE.VIR

Trojan.Downloader-VisFX
C:\QOOBOX\QUARANTINE\C\WINDOWS\OFFUN.EXE.VIR

Unclassified.Unknown Origin/System
C:\QOOBOX\QUARANTINE\C\WINDOWS\UNINST2.HTM.VIR

Trace.Known Threat Sources
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\X4WRYELJ\wr-1-361[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YZARC36R\winzl[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\X4WRYELJ\winmm[1].exe
MFDnNC's Avatar
Member with 49,015 posts.
  
Join Date: Sep 2004
12-Aug-2007, 01:49 PM #5
You may want to print this or save it to notepad as we will go to safe mode.

Fix these with HiJackThis – mark them, close IE, click fix checked

O4 - HKLM\..\Run: [gkrkfrtA] C:\WINDOWS\gkrkfrtA.exe

O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"

O4 - HKCU\..\Run: [Amne] "C:\PROGRA~1\COMMON~1\SMBOLS~1\notepad.exe" -vt yazb

O4 - HKCU\..\Run: [Vcn] C:\WINDOWS\system32\S?mantec\?canregw.exe

O4 - HKUS\S-1-5-19\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.0\webbuying.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [WinCore32.exe] C:\WINDOWS\System32\WinCore32.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [OuterinfoUpdate] "C:\Program Files\Outerinfo\OuterinfoUpdate.exe" (User 'NETWORK SERVICE')

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe

O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

DownLoad http://www.downloads.subratam.org/KillBox.zip or
http://www.thespykiller.co.uk/files/killbox.exe

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following line(s) one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\Program Files\Web Buying
C:\WINDOWS\gkrkfrtA.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\System32\WinCore32.exe

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Not all temp files will delete and that is normal
Empty the recycle bin
Boot and post a new hijack log from normal NOT safe mode




How are things???????????
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
12-Aug-2007, 06:01 PM #6
I got a little ahead of myself and went to safe mode first, not realizing until afterwards that I was supposed to do the HijackThis fixes first.

I couldn't find:

O4 - HKUS\S-1-5-19\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.0\webbuying.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [WinCore32.exe] C:\WINDOWS\System32\WinCore32.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [OuterinfoUpdate] "C:\Program Files\Outerinfo\OuterinfoUpdate.exe" (User 'NETWORK SERVICE')

the first time around while in safe mode, but I did fix them once I rebooted to normal mode. I hope this doesn't mean I need to do everything again. Here's my HijackThis log:


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:58:55 PM, on 8/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Goober\Desktop\HiJackThis_v2.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

--
End of file - 5254 bytes
MFDnNC's Avatar
Member with 49,015 posts.
  
Join Date: Sep 2004
12-Aug-2007, 06:05 PM #7
Fix this

O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

How are things???
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
12-Aug-2007, 06:27 PM #8
It doesn't seem to fix. Here's another log, though.



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 6:26:29 PM, on 8/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Goober\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = niaid.nih.gov
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\baqyqypr.html

--
End of file - 5234 bytes


Can I use KillBox on that file?
MFDnNC's Avatar
Member with 49,015 posts.
  
Join Date: Sep 2004
12-Aug-2007, 06:31 PM #9
It was previously remove - i wouldn't worry about it

Clean
If you feel its is fixed mark it solved via Thread Tools above

Turn off restore points, boot, turn them back on – here’s how

http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

This clears infected restore points and sets a new, clean one.
riafoo's Avatar
Computer Specs
Junior Member with 6 posts.
THREAD STARTER
  
Join Date: Aug 2007
Experience: Beginner
12-Aug-2007, 06:51 PM #10
Thanks a million for your help. You're my hero.
Email This Email  Print This Print  Tweet This Send to Facebook Send to MySpace Send to StumbleUpon Digg This | More Services More
Reply
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join Today!

(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!

« Previous Thread | Virus & Other Malware Removal | Next Thread »

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


TECH SUPPORT GUY
WELCOME
FOLLOW US
 
You Are Using: Server ID
All times are GMT -4. The time now is 03:51 PM.
Advertisements do not imply our endorsement of that product or service.
Copyright © 1996 - 2013 TechGuy, Inc. All rights reserved. Privacy & Terms.

Trusted Website Back to the Top ↑