| Live Chat & Podcast at 1:00PM Eastern on Sunday! |
| | |
| Thread Tools |
|
06-Jul-2008, 03:40 AM
#1 |
| HEY AND THANKS IN ADVANCED!!!! ![]() I'm having some problems with my pc. A few weeks ago we got the dreaded fake windows security pop ups in our task bar. My dad made the mistake of clicking on them. (UGH!) I've ran every scanner under the sun and rolled back my pc to a week earlier than the attack date. Problem is, the scans found nothing and roll back only seemed to push the problem away and not actually fix it. I'm still having a few random pop ups, but the pc is just sloooooow. For instance I'm having to wait just for my text to catch up while typing. There is something terribly wrong and I need some help. OH ANDDD When trying to download recommended software my pc won't let me. It claims the files are in use and can't be renamed. Ughhh. I dunno. I'm in a mess. HEEEEEEELP. Or I'm a dead woman. Here is ze log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:59:18 AM, on 7/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Common Files\AOL\1102879321\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe C:\WINDOWS\Explorer.EXE C:\Program Files\mcafee.com\personal firewall\MPFService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\PROGRA~1\mcafee.com\ANTIVI~1\OasClnt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\mcafee.com\personal firewall\MPFTray.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {82A78643-5B90-46FC-86AC-CC06E61525A9} - C:\WINDOWS\system32\jkkjh.dll (file missing) O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\mcafee.com\personal firewall\MPFTray.exe" O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKLM\..\RunServices: [McAfee Online Virus Scanner] avp.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/en...ach_core_1.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.com/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - https://objects.aol.com/mcafee/molbi...3/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - https://objects.aol.com/mcafee/molbi...20/McGDMgr.cab O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - http://download.newaol.com/bkpromo/d...ormerSetup.cab O20 - Winlogon Notify: jkkjh - C:\WINDOWS\system32\jkkjh.dll (file missing) O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll (file missing) O20 - Winlogon Notify: xxyyyxy - xxyyyxy.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1102879321\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 10567 bytes Last edited by amandaisnothxc; 06-Jul-2008 at 04:00 AM.. Reason: added log. |
| |
|
07-Jul-2008, 07:13 AM
#2 |
| Here's the renaming pop up during installation I was talking about: ![]() ![]() |
13-Jul-2008, 10:23 PM
#3 | ||||||
| Welcome to TSG ![]() Download Combofix from this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix **Note: It is important that it is saved directly to your desktop** -------------------------------------------------------------------- 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on combofix.exe & follow the prompts.
Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
|
13-Jul-2008, 11:51 PM
#4 |
| Thank you so much! ![]() Combofixlog: ComboFix 08-07-13.6 - Amanda Jackson 2008-07-13 20:54:25.1 - NTFSx86 Running from: C:\Documents and Settings\Amanda Jackson\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Amanda Jackson\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini C:\Documents and Settings\Amanda Jackson\My Documents\My Videos\Desktop.ini C:\Documents and Settings\Connie Jackson\Application Data\macromedia\Flash Player\#SharedObjects\N5X32KMH\www.broadcaster.com C:\Documents and Settings\Connie Jackson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Connie Jackson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\Connie Jackson\My Documents\My Videos\Desktop.ini C:\Documents and Settings\Jessica Jackson\My Documents\My Videos\Desktop.ini C:\Documents and Settings\Rickey Jackson\My Documents\My Videos\Desktop.ini C:\Program Files\Common Files\companion wizard C:\WINDOWS\system32\aotunafi.ini C:\WINDOWS\system32\hjkkj.bak1 C:\WINDOWS\system32\hjkkj.bak2 C:\WINDOWS\system32\hjkkj.ini C:\WINDOWS\system32\hjkkj.ini2 C:\WINDOWS\system32\hjkkj.tmp C:\WINDOWS\system32\hnyfnpcc.ini C:\WINDOWS\system32\iubkpbbl.ini C:\WINDOWS\system32\mafhmurr.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\oxohpqxr.ini C:\WINDOWS\system32\qoMEUOGw(2).dll C:\WINDOWS\system32\sikokcjn.ini C:\WINDOWS\system32\stera.log C:\WINDOWS\system32\thnxdkkc.ini C:\WINDOWS\system32\ubwavthx.ini C:\WINDOWS\system32\uttss.bak1 C:\WINDOWS\system32\uttss.bak2 C:\WINDOWS\system32\uttss.ini C:\WINDOWS\system32\uttss.ini2 C:\WINDOWS\system32\uttss.tmp C:\WINDOWS\system32\vbbfgaoi.ini C:\WINDOWS\system32\vipnjrrd.ini C:\WINDOWS\system32\vtUlJyXo.dll C:\WINDOWS\system32\wGOUEMoq.ini2 . ((((((((((((((((((((((((( Files Created from 2008-06-14 to 2008-07-14 ))))))))))))))))))))))))))))))) . 2008-07-13 20:32 . 2008-07-13 20:35 <DIR> d-------- C:\Program Files\RegScrubXP 2008-07-13 19:57 . 2008-07-13 19:57 <DIR> d-------- C:\Documents and Settings\Amanda Jackson\Application Data\HP 2008-07-08 01:42 . 2008-07-08 01:42 <DIR> d-------- C:\Program Files\RogueRemover FREE 2008-07-07 07:54 . 2008-07-07 07:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-07 05:48 . 2008-07-07 05:48 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-07 05:43 . 2008-07-07 06:36 <DIR> d-------- C:\SDFix 2008-07-07 04:22 . 2008-07-07 04:22 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-07-07 04:22 . 2008-07-07 04:22 <DIR> d-------- C:\WINDOWS\system32\en 2008-07-07 04:22 . 2008-07-07 04:22 <DIR> d-------- C:\WINDOWS\l2schemas 2008-07-07 03:21 . 2008-04-13 19:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll 2008-07-07 03:21 . 2008-04-13 19:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll 2008-07-07 03:21 . 2008-04-13 19:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll 2008-07-07 03:21 . 2008-04-13 19:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll 2008-07-07 03:21 . 2008-04-13 19:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll 2008-07-07 03:21 . 2008-04-13 19:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll 2008-07-07 03:21 . 2008-04-13 19:12 32,768 --------- C:\WINDOWS\system32\setupn.exe 2008-07-07 03:21 . 2008-04-13 13:40 10,240 --a------ C:\WINDOWS\system32\drivers\sffp_mmc.sys 2008-07-07 03:19 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-07-07 03:18 . 2008-04-13 19:11 233,472 --------- C:\WINDOWS\system32\azroles.dll 2008-07-07 03:18 . 2008-04-13 19:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll 2008-07-07 03:18 . 2008-04-13 19:11 12,800 --------- C:\WINDOWS\system32\credssp.dll 2008-07-07 03:18 . 2008-04-13 19:11 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll 2008-07-07 02:24 . 2008-07-07 02:24 142 --a------ C:\WINDOWS\system32\HFX13.tmp 2008-07-06 02:48 . 2008-07-06 02:48 <DIR> d-------- C:\Documents and Settings\Amanda Jackson\.housecall6.6 2008-07-06 01:57 . 2008-07-06 01:57 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-05 21:01 . 2008-07-05 21:01 <DIR> d-------- C:\Program Files\Webroot 2008-07-05 20:59 . 2008-07-05 20:59 164 --a------ C:\install.dat 2008-07-05 11:44 . 2008-07-05 11:44 <DIR> d-------- C:\Documents and Settings\Amanda Jackson\Application Data\Viewpoint 2008-07-05 04:33 . 2008-04-22 23:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-07-05 04:33 . 2007-04-17 04:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-07-05 04:33 . 2007-03-08 00:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-07-05 04:33 . 2008-04-22 23:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-07-05 04:33 . 2008-04-22 23:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-07-05 04:33 . 2008-04-22 23:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-07-05 04:33 . 2008-04-22 23:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-07-05 04:33 . 2008-04-22 23:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-07-05 04:33 . 2008-04-22 02:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-07-02 07:20 . 2008-07-02 07:20 <DIR> d-------- C:\Documents and Settings\Amanda Jackson\Application Data\PC Tools 2008-07-02 07:12 . 2007-12-06 15:51 28,568 --a------ C:\WINDOWS\system32\drivers\AVHook.sys 2008-07-02 07:12 . 2007-12-06 15:51 21,912 --a------ C:\WINDOWS\system32\drivers\AVRec.sys 2008-07-02 07:12 . 2008-02-12 10:44 21,904 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys 2008-07-02 07:11 . 2008-07-02 07:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools 2008-06-27 03:01 . 2008-06-27 03:01 <DIR> d-------- C:\VundoFix Backups 2008-06-26 04:54 . 2008-06-26 04:55 <DIR> d-------- C:\Program Files\CCleaner 2008-06-26 04:46 . 2008-06-26 04:46 153 --a------ C:\WINDOWS\wininit.ini 2008-06-26 03:49 . 2008-06-26 03:49 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-26 03:49 . 2008-06-26 04:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-26 02:56 . 2008-06-26 02:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-26 02:01 . 2008-06-26 02:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-26 02:01 . 2008-06-26 02:01 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-26 01:52 . 2008-06-26 01:52 <DIR> d-------- C:\Program Files\Norton Security Scan 2008-06-26 01:50 . 2008-06-26 01:50 <DIR> d-------- C:\Program Files\Sony 2008-06-26 01:50 . 2008-06-26 01:50 <DIR> d-------- C:\Program Files\Bethesda 2008-06-26 01:48 . 2008-06-26 01:49 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-25 21:39 . 2008-06-25 21:39 32,256 --a------ C:\WINDOWS\system32\winbjv32(2).dll 2008-06-25 20:30 . 2008-06-26 13:41 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-06-25 17:53 . 2008-06-25 17:53 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-25 17:53 . 2008-06-26 02:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-25 16:14 . 2008-06-26 01:49 <DIR> d-------- C:\Documents and Settings\Amanda Jackson\Application Data\ErrorSmart 2008-06-25 00:18 . 2008-07-13 19:56 <DIR> d-------- C:\Program Files\PC Tools AntiVirus 2008-06-25 00:18 . 2008-06-25 00:18 <DIR> d-------- C:\Program Files\Common Files\PC Tools 2008-06-24 23:44 . 2008-06-24 23:44 <DIR> d-------- C:\Program Files\ImTOO 2008-06-24 14:53 . 2008-06-26 01:54 <DIR> d-------- C:\53cf7d40918bb6df2144b03f 2008-06-20 12:46 . 2008-06-20 12:46 245,248 --a--c--- C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 12:46 . 2008-06-20 12:46 147,968 --a--c--- C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 06:51 . 2008-06-20 06:51 361,600 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 06:40 . 2008-06-20 06:40 138,496 --a--c--- C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 06:08 . 2008-06-20 06:08 225,856 --a--c--- C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-19 22:08 . 2008-06-13 06:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-19 11:39 . 2003-07-12 17:35 231,936 --a------ C:\WINDOWS\epsuninst.exe 2008-06-18 00:25 . 1999-12-17 11:13 86,016 --a------ C:\WINDOWS\unvise32.exe 2008-06-16 11:08 . 2008-06-26 03:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-14 00:57 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-08 11:00 --------- d-----w C:\Program Files\Java 2008-07-08 05:58 --------- d-----w C:\Documents and Settings\Amanda Jackson\Application Data\BitTorrent 2008-07-07 12:38 --------- d-----w C:\Program Files\Windows Installer Clean Up 2008-07-05 08:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-01 02:17 --------- d-----w C:\Program Files\Lx_cats 2008-06-27 07:46 --------- d-----w C:\Documents and Settings\Amanda Jackson\Application Data\OpenOffice.org2 2008-06-26 10:02 --------- d-----w C:\Program Files\7-Zip 2008-06-26 06:52 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-26 06:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative 2008-06-26 06:48 --------- d-----w C:\Documents and Settings\Connie Jackson\Application Data\PC Tools 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-23 00:24 --------- d--h--w C:\Program Files\Creative Installation Information 2008-05-23 00:24 --------- d-----w C:\Program Files\Creative 2008-05-22 04:50 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-22 04:39 --------- d-----w C:\Documents and Settings\Amanda Jackson\Application Data\Creative 2008-05-22 03:56 --------- d-----w C:\Program Files\BitZipper 2008-05-22 03:55 --------- d-----w C:\Documents and Settings\Amanda Jackson\Application Data\BitZipper 2008-04-14 00:12 69,120 ----a-w C:\WINDOWS\notepad.exe 2008-04-14 00:12 50,688 ----a-w C:\WINDOWS\twain_32.dll 2008-04-14 00:12 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll 2008-04-14 00:12 33,280 ----a-w C:\WINDOWS\Help\sstub.dll 2008-04-14 00:12 32,866 ------w C:\WINDOWS\slrundll.exe 2008-04-14 00:12 283,648 ----a-w C:\WINDOWS\winhlp32.exe 2008-04-14 00:12 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll 2008-04-14 00:12 146,432 ----a-w C:\WINDOWS\regedit.exe 2008-04-14 00:12 10,752 ----a-w C:\WINDOWS\hh.exe 2008-04-14 00:12 1,033,728 ----a-w C:\WINDOWS\explorer.exe 2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll 2008-04-14 00:11 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll 2008-04-14 00:11 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll 2008-04-14 00:11 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll 2008-04-14 00:11 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll 2008-04-14 00:11 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll 2007-04-04 02:49 87,608 -c--a-w C:\Documents and Settings\Connie Jackson\Application Data\ezpinst.exe 2007-04-04 02:49 47,360 -c--a-w C:\Documents and Settings\Connie Jackson\Application Data\pcouffin.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 22:49 4662776] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-20 22:36 1207080] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "AOL Fast Start"="C:\Program Files\America Online 9.0b\AOL.EXE" [2005-07-12 07:17 50776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 11:21 69632] "MPFEXE"="C:\Program Files\mcafee.com\personal firewall\MPFTray.exe" [2006-03-07 16:05 992808] "PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2008-03-05 09:37 1238928] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\Rickey Jackson\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Amanda Jackson^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\Amanda Jackson\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Amanda Jackson^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk] path=C:\Documents and Settings\Amanda Jackson\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Connie Jackson^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk] path=C:\Documents and Settings\Connie Jackson\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] --a------ 2002-12-17 12:28 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] --a------ 2005-07-12 07:17 50776 C:\Program Files\America Online 9.0b\aol.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLSPScheduler] --a------ 2006-11-20 15:42 8784 C:\Program Files\Common Files\AOL\1102879321\EE\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] --a------ 2008-02-27 14:53 587568 C:\Program Files\BitTorrent\bittorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD] --a------ 2002-09-10 21:26 368706 C:\Program Files\BroadJump\Client Foundation\CFD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 19:12 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe] --------- 2007-07-17 11:03 868352 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan] --a------ 2005-10-19 13:13 460336 C:\Program Files\mcafee.com\antivirus\mcvsescn.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint] --a--c--- 2005-06-08 13:19 94208 C:\Program Files\Lexmark 2300 Series\ezprint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2006-06-20 22:36 1207080 C:\PROGRA~1\MI3AA1~1\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] --a------ 2006-09-25 19:52 50736 C:\Program Files\Common Files\AOL\1102879321\EE\aolsoftware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a--c--- 2007-03-11 22:34 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-02-16 16:15 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-02-16 16:15 81920 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe] --a--c--- 2005-05-04 20:24 200704 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe] --a------ 2006-03-07 16:05 992808 C:\Program Files\mcafee.com\personal firewall\MpfTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2003-07-28 15:19 4841472 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt] --a------ 2005-08-18 17:57 116272 C:\Program Files\mcafee.com\antivirus\oasclnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-10 16:27 385024 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-10-14 14:42 1404928 C:\Program Files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sscRun] --a------ 2006-11-20 15:42 153168 C:\Program Files\Common Files\AOL\1102879321\EE\sscRun.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-03-30 11:49 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2006-11-30 22:49 4662776 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser] --a------ 2006-07-21 17:19 129536 C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2003-07-28 15:19 323584 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Creative Service for CDROM Access"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= C:\\Program Files\\Yahoo!\\Messenger\\yserver.exe "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0b\\waol.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "C:\\Program Files\\Common Files\\AOL\\1102879321\\EE\\AOLServiceHost.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\WINDOWS\\system32\\lxcgcoms.exe"= "C:\\Program Files\\Common Files\\AOL\\1102879321\\EE\\aolsoftware.exe"= "C:\\Program Files\\Common Files\\AOL\\1102879321\\EE\\aim6.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-04-03 22:03] R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 16:38] S0 OCDE;ZTekWare Original CD Emulator Service;C:\WINDOWS\system32\Drivers\OCDE.sys [] S3 2109f671-c852-482b-b602-148e5c0925d7;2109f671-c852-482b-b602-148e5c0925d7;E:\CDS300\cds300.dll [] S3 DCamUSBVeo532;Veo Web Camera;C:\WINDOWS\system32\Drivers\ubVeo532.sys [] S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 13:47] S3 ypn30s;ypn30s;C:\WINDOWS\system32\DRIVERS\ypn30s.sys [] S3 ypn30u;Samsung YP-N30 Audio Player Control Driver;C:\WINDOWS\system32\Drivers\ypn30u.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder "2008-07-13 10:06:00 C:\WINDOWS\Tasks\Disk Cleanup.job" - C:\WINDOWS\system32\cleanmgr.exe . - - - - ORPHANS REMOVED - - - - Notify-ssttu - C:\WINDOWS\system32\ssttu.dll Notify-xxyyyxy - xxyyyxy.dll MSConfigStartUp-GPLv3 - C:\WINDOWS\system32\ccpnfynh.dll MSConfigStartUp-iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe MSConfigStartUp-McAfee Online Virus Scanner - avp.exe |
|
13-Jul-2008, 11:52 PM
#5 |
| Hijack this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:51, on 2008-07-13 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Common Files\AOL\1102879321\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe C:\Program Files\mcafee.com\personal firewall\MPFTray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\mcafee.com\personal firewall\MPFService.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\America Online 9.0b\waol.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\PROGRA~1\mcafee.com\ANTIVI~1\OasClnt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\America Online 9.0b\shellmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\mcafee.com\personal firewall\MPFTray.exe" O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/en...ach_core_1.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.com/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - https://objects.aol.com/mcafee/molbi...3/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - https://objects.aol.com/mcafee/molbi...20/McGDMgr.cab O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {D9EA64B2-B966-E177-332C-78B69886526D} - http://download.newaol.com/bkpromo/d...ormerSetup.cab O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll (file missing) O20 - Winlogon Notify: xxyyyxy - xxyyyxy.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1102879321\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 9382 bytes |
14-Jul-2008, 06:58 AM
#6 | ||||||
| Run HijackThis, and press "Do a System Scan Only". 1. When the scan is complete place a check mark next to the following entries: O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll (file missing) O20 - Winlogon Notify: xxyyyxy - xxyyyxy.dll (file missing) 2. After checking these items CLOSE ALL open windows EXCEPT HijackThis and click "Fix Checked." Then, reboot your computer... How is everything running??
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
|
14-Jul-2008, 04:01 PM
#7 |
| Hello. I deleted the two things like you told me to to do. But alas, I still cannot download certain programs. And the online scanners will not work for me. :\ Oh and I don't know if this is normal but since I ran combofix, when I reboot my computer, before the windows logo pops up, a selection menu flashes on then off. It says something like windows xp (couldn't read the rest) and windows xp recovery something. Like I said it flashes too fast for me to read it. Its like when you press f8 to get to the menu to go into safe mode. am I making any sense? lol :P Last edited by amandaisnothxc; 14-Jul-2008 at 04:08 PM.. |
14-Jul-2008, 05:40 PM
#8 | ||||||
| Let me check. |
|
15-Jul-2008, 02:04 AM
#9 |
| Hey some weird stuff happened today. :P This morning I updated my virus/spyware protection (its through aol) to the new mcafee security center. I did a full can and 3 files were said to be infected. So I let the program fix them, then proceeded to use ccleaner to clean up my registry. Then bam! It spotted a bunch of stuff related to unintallers that didn't work anymore and repaired/deleted them. Well my dad has a friend who recommended a program called regscrubxp to reaaaally clean up the registry, well I though I would try to download it and it actually let me! (Yay!) and it did realllly clean up our registry (it was like 290 problems x.x.) Then I proceeded to do an online scan which sudenly worked (yay!) at http://www.bitdefender.com/scan8/ie.html (I had seen byteman had recommended it to someone else on here.) Well I feel asleep on the couch while it was scanning. And when I woke up it was gone, but there was a pop up from mcafee saying it had found something suspecious and needed to be deleted. I clicked okay. Well the pop up returned like 10 times with different file names. I clicked okay each time. Then suddenly it said "Downloader.gen.a (trojan) had been deleted!" I clicked okay. Then another one popped up and claimed to deleted another trojan (forgot the name x.x) and the last one claimed it deleted two cases of vundo? But yeah. Sounds good to me! hahaha What do you think? Do I need to do a repost of my hijack this log? |
|
15-Jul-2008, 03:08 AM
#10 |
| I went ahead and did a MBAM scan: Malwarebytes' Anti-Malware 1.20 Database version: 951 Windows 5.1.2600 Service Pack 3 1:05:16 AM 15-Jul-08 mbam-log-7-15-2008 (01-05-16).txt Scan type: Quick Scan Objects scanned: 45401 Time elapsed: 13 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\winbjv32(2).dll (Dialer) -> Quarantined and deleted successfully. C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully. |
16-Jul-2008, 06:45 AM
#11 | ||||||
| Quote:
That's related to the installation of the recovery console and combofix changed the timeout to only 2 seconds. How is everything running? |
|
16-Jul-2008, 08:15 AM
#12 |
| Its running so much better. ![]() Thank you so much for your help! No more pop ups and it doesn't take forever and a day to type stuff out now :] Is there any other things I need to do to patch up my system? And can I uninstall comboxfix? If so how? Sorry for all the questions so early in the morning lol :P |
16-Jul-2008, 09:56 PM
#13 | ||||||
| Your Welcome !!!! Go to Start ---> Run ----> Type ComboFix /u and press Enter. The command will remove ComboFix and create a new restore point. Ugrading Java:
Here is some useful information on keeping your computer clean:
Here are the link to install SiteAdisor in Internet Explorer and Firefox
__________________ Microsoft Valuable Professional Consumer--Security 2007-2010 Please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here |
|
17-Jul-2008, 03:06 AM
#14 |
| Updated java, uninstalled combo fix, and added siteadisor (which btw, is amazzzzzing. Thank you so much for the rec.) Everything is running smoothly and great. I'm looking into buying more ram, and I'm uninstalling bittorrent as we speak! Thank you so much for your time and advice, you're an angel! Edit: So I went in today and did a free scan with spysweeper just to be 100% sure everything was gone. Weeeell it said I was still infected. With venusseek (eros), trojan-rbot, and hotbar/zango. Should I be worried? I did an online scan again with the same site as before (http://www.bitdefender.com/scan8/ie.html) and it didn't turn up anything. x.x Last edited by amandaisnothxc; 17-Jul-2008 at 05:41 AM.. |
17-Jul-2008, 05:14 PM
#15 | ||||||
| Since i don't have a log to go by, i can't tell what it is. However, its probably just some leftover registry keys or values. |
| Tags |
| blackworm, slow computer, slow pc, slow typing |

|
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |

| Thread Tools | |
| |
| You Are Using: |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 10:20 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. | |

