1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Help Please! Malware Infection

Discussion in 'Virus & Other Malware Removal' started by damain, Apr 9, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    A few days ago I started noticing that every time I log onto windows from the password prompt it says "1 program running." I've looked in the task manager and nothing shows. Prior to this, I can't remember the last time I've run Ad-Aware and it actually found something. I'm a pretty cautious user and Ad-Aware always tells me "0 infections detected." However, since I started seeing this background program, now I've run Ad-Aware 3 time and the first time it said "55 infections detected." I removed them and ran again. It said "6 Infections detected." And now I've ran the program again and it say "65 infections detected."

    This is the Ad-Aware log file:
    Infections Found
    ===========================
    Family Id: 725 Name: Tracking Cookie Category: DataMiner TAI:3
    Item Id: 600000144 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat doubleclick.net test_cookie /
    Item Id: 600000263 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat mediaplex.com svid /
    Item Id: 600000187 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat advertising.com ACID /
    Item Id: 600000187 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat advertising.com BASE /
    Item Id: 600000187 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat advertising.com ROLL /
    Item Id: 600000187 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Corey\Cookies\index.dat advertising.com F1 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt revsci.net rsi_segs_1000000 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt revsci.net rsi_cls_1000000 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt revsci.net NETSEGS_K06578 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt revsci.net NETSEGS_H07710 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt revsci.net NETID01 /
    Item Id: 600000144 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt doubleclick.net id /
    Item Id: 600000400 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt anad.tacoda.net /PC /
    Item Id: 600000212 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt 2o7.net s_vi_mcx7Eibalobxxgx7Dzo /
    Item Id: 600000212 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt 2o7.net s_vi_x7Ecgozoezfo /
    Item Id: 600000179 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt atdmt.com AA002 /
    Item Id: 600000085 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt questionmarket.com CS1 /
    Item Id: 600000085 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt questionmarket.com ES /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIBannerCounter27091 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAICampaignCounter948 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIBanners948 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAILastHit948 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIBanners1047 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIBannerCounter30204 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIFirstHit1047 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAILastHit1047 /
    Item Id: 600000263 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt mediaplex.com svid /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAICampaignCounter1047 /
    Item Id: 600000555 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt insightexpressai.com IXAIFirstHit948 /
    Item Id: 600000126 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ehg-space.hitbox.com DM531015F8DSV6 /
    Item Id: 600000126 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt hitbox.com CTG /
    Item Id: 600000126 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt hitbox.com WSS_GW /
    Item Id: 600000187 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt advertising.com F1 /
    Item Id: 600000187 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt advertising.com ROLL /
    Item Id: 600000187 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt advertising.com BASE /
    Item Id: 600000187 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt advertising.com ACID /
    Item Id: 600000138 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt fastclick.net pluto /
    Item Id: 600000138 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt fastclick.net pjw /
    Item Id: 600000138 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt fastclick.net vt /
    Item Id: 600000138 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt fastclick.net adv_ic /
    Item Id: 600000083 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt realmedia.com RMID /
    Item Id: 600000304 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt cgm.adbureau.net LE2 /
    Item Id: 600000304 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt cgm.adbureau.net GUID /
    Item Id: 600000126 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ehg-globalgamingleague.hitbox.com DM5605204KADV6 /
    Item Id: 600000126 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ehg-globalgamingleague.hitbox.com DM560802B8DAV6 /
    Item Id: 600000050 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt tribalfusion.com ANON_ID /
    Item Id: 600000458 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt adlegend.com PrefID /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com uid /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com vuday1 /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com bh /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com ih /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com pv1 /
    Item Id: 600000460 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ad.yieldmanager.com fl_inst /
    Item Id: 600000513 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ads.adbrite.com ihc_620311 /
    Item Id: 600000513 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt adbrite.com b /
    Item Id: 600000513 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt adbrite.com Apache /
    Item Id: 600000513 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt adbrite.com fq /
    Item Id: 600000447 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt apmebf.com S /
    Item Id: 600000052 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt trafficmp.com uid2 /
    Item Id: 600000415 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt ads.revsci.net rsi_us_1000000 /adserver
    Item Id: 600000052 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt trafficmp.com dly2 /
    Item Id: 600000052 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt trafficmp.com dmg2 /
    Item Id: 600000052 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt trafficmp.com hst2 /
    Item Id: 600000052 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt trafficmp.com rth /
    Item Id: 600000201 Value: Browser: Firefox Cookie: C:\Documents and Settings\Corey\Application Data\Mozilla\Firefox\Profiles/1lwshyv3.default\cookies.txt media.adrevolver.com BIGipServerar-slave /
     
  2. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    And this is my log when I ran hijackthis:

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 4:39:23 PM, on 4/9/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\1XConfig.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Rainlendar2\Rainlendar2.exe
    C:\Documents and Settings\Corey\Desktop\HiJackThis_v2.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1188259719605
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Unknown owner - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
     
  3. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    Does anyone see anything malicious?
     
  4. DawnS

    DawnS

    Joined:
    Apr 9, 2008
    Messages:
    97
    That definately sounds like malware. I do not see anything that jumps out at me, yet I am only aware of certain patterns. If you would not mind a second suggesstion, I would have you download Spyware Doctor. It is free.

    http://www.pctools.com/spyware-doctor/?ref=google_a&gclid=CLHOw_3Az5ICFQUilwod-R4hGg

    Spyware Doctor has consistently been awarded Editors' Choice, by leading PC magazines and testing laboratories around the world, including United States, United Kingdom, Sweden, Germany and Australia. In addition, after leading the market in 2005, Spyware Doctor was awarded the prestigious Best of the Year at the end of 2005 and again in 2006.

    Perhaps this program may find what we do not see here. I also use Spyware Doctor and like the application.

    I hope that aids you.
     
  5. haycg

    haycg

    Joined:
    Jun 11, 2007
    Messages:
    377
    I would fix this one, but don't delete until your sure.
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.ex
     
  6. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    Spyware Doctor detected all of the usual 50 or so tracking cookies but it also detected 2 trojans.

    1 trojan was just a benign, low-threat trojan. The other was Tanspy which seems to be some password gathering trojan. I'm still running scans but they seem to be gone. If you know anything extra I need to do, let me know.
     
  7. ozrom1e

    ozrom1e

    Joined:
    May 15, 2006
    Messages:
    11,849
    I would offer a suggestion ot two.

    First the HJT log file you posted is from a Beta version of HijackThis I would suggest to remove this version from your computer and all of its log files you have also and then download the newest version below and repost the log file for a HJT expert with the gold shield to diagnose.

    Second To let the gold shield work on this isnce they are the only ones certified on this forum to do so.

    To download HJTsetup.exe from TrendSecure To Download HijackThis go to the following at the File Repository
    Click on the link below to Download HijackThis Self Installer:

    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    Save the file to your desktop.
    Double click on the HJTsetup.exe icon on your desktop.
    By default it will install to C:\Program Files\HijackThis.
    Continue to click Next in the setup dialog boxes until you get to the Select Additional Tasks dialog.
    Put a check by Create a desktop icon then click Next again.
    Continue to follow the rest of the prompts from there.
    At the final dialog box click Finish and it will launch Hijack This.
    Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    Click Save to save the log file and then the log will open in notepad.
    At the top of the Notepad HJT log screen, hit Edit then Select All then click Edit and then click Copy doing that copies the text to the clipboard, you won't see it yet....
    Come back here to this thread and Paste the log in your next reply.
    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
    A security expert with a gold shield to the right of their name should take a look at your log - please be patient.
     
  8. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    Alright, here's my new HijackThis log for the gold shield expert to look at:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:30:57 AM, on 4/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\System32\1XConfig.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1188259719605
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Unknown owner - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 6734 bytes
     
  9. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    My computer still says "1 program running" sometimes. Also, both Adaware and Spyware Doctor are still detecting anything from 20 to 50 tracking cookies everytime I run them. These aren't listed as malicious cookies or anything and if, in the past, I had frequently detected loads of tracking cookies on my PC, I wouldn't think anything about it. However, I usually have nothing that comes up when I do a scan and it's only recently that I've started detecting so much garbage on my PC.

    I'm not detecting those two trojans anymore, but the large amounts of trash cookies are still being detected and my PC still says "1 program running." I'm kind of starting to get frustrated. I think I've ruled out everything legitimate as being that "1 program running." I thought it might be Rainlendar but I can turn that off and it still says "1 program running." It also still says "1 program running" if I turn off antivirus, spyware doctor, google updater, and anything else.
     
  10. ACA529

    ACA529

    Joined:
    Nov 15, 2005
    Messages:
    6,117
    This thread should really be in security........
     
  11. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.

    Click Exit on the Main menu to close the program.



    Download (save and select your desktop to save it to) SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive and all other fixed drives..
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
    • Click Close to exit the program.


    Please perform a scan with Kaspersky Webscan Online Virus Scanner
    • Read the Requirements and Privacy statement, then select "Accept".
    • A new window will appear promting you to install an ActiveX component from Kaspersky - "Do you want to install this software?".
    • Click "Yes" or select "Install" to download the ActiveX controls that allows ActiveScan to run.
    • When the download is complete it will say ready, click "Next".
    • Click "Scan Settings" and check the option to use the Extended Database if available otherwise Standard).
    • Click "Scan Options" and select both "Scan Archives" and "Scan Mail Bases".
    • Click "OK".
    • Under "Select a target to scan", click on "My Computer".
    • When the scan is complete choose to save the results as "Save as Text" named kaspersky.txt to your desktop and post them in your next reply.

    Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for Free Online Virus Scanner. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps here and reboot afterwards if your system does not reboot automatically or it will show 'Kaspersky Online Scanner license key was not found!
     
  12. damain

    damain Thread Starter

    Joined:
    Apr 8, 2008
    Messages:
    8
    SuperAntiSpyware Log:

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 04/10/2008 at 07:36 PM

    Application Version : 4.0.1154

    Core Rules Database Version : 3436
    Trace Rules Database Version: 1428

    Scan type : Complete Scan
    Total Scan Time : 01:15:05

    Memory items scanned : 390
    Memory threats detected : 0
    Registry items scanned : 5094
    Registry threats detected : 0
    File items scanned : 80927
    File threats detected : 0


    new HijackThis Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:54:44 PM, on 4/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\1XConfig.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1188259719605
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Unknown owner - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 6462 bytes


    Kaspersky Log:

    *KASPERSKY ONLINE SCANNER REPORT*
    Friday, April 11, 2008 7:05:52 AM
    Operating System: Microsoft Windows XP Professional, Service Pack 2
    (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 11/04/2008
    Kaspersky Anti-Virus database records: 696566

    *Scan Settings*
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true
    *Scan Target* My Computer
    C:\
    D:\
    *Scan Statistics*
    Total number of scanned objects 82668
    Number of viruses found 0
    Number of infected objects 0
    Number of suspicious objects 0
    Duration of the scan process 01:20:25


    *Infected Object Name* *Virus Name* *Last Action*
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\Corey\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-4-10-2008( 18-15-45 ).LOG Object is locked skipped
    C:\Documents and Settings\Corey\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Corey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Corey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Corey\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Corey\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Corey\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Corey\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
    C:\Program Files\Symantec AntiVirus\SAVRT\0465NAV~.TMP Object is locked skipped
    C:\Program Files\Symantec AntiVirus\SAVRT\0641NAV~.TMP Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System VolumeInformation\_restore{001C6F27-FC28-4D28-AED9-5995D2674790}\RP309\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{11899F77-D8D6-4B7A-88E8-0F9F24651EC7}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    *Scan process completed.*


    Perhaps those trojans were all that was on my computer.
     
  13. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/702116

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice