1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Did I fix it? (WinAntiSpyware 2007)

Discussion in 'Virus & Other Malware Removal' started by SpaceyMom, Aug 17, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    I followedthe instructions I found here: http://forums.techguy.org/malware-removal-hijackthis-logs/610785-my-laptop-contracted-winantispypro2007.html?highlight=WinAntiSpyware+2007 after doing a search on these forums.

    HiJackThis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:36:47 PM, on 8/17/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    E:\WINDOWS\System32\tcpsvcs.exe
    E:\WINDOWS\System32\snmp.exe
    E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\Explorer.EXE
    E:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    E:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\Program Files\iTunes\iTunesHelper.exe
    E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    E:\PROGRA~1\Webshots\webshots.scr
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\MSN Messenger\msnmsgr.exe
    E:\Program Files\MSN Messenger\usnsvc.exe
    E:\WINDOWS\System32\WISPTIS.EXE
    E:\Documents and Settings\Space\Desktop\Lunarpages2\Note Keeper 2\NKLite.exe
    E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    E:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    E:\Program Files\Mozilla Firefox\firefox.exe
    E:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
    E:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbian.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O1 - Hosts: 216.193.202.156 xzzy.org tru7h.org
    O1 - Hosts: 216.227.209.170 eval2hire.com
    O1 - Hosts: 216.227.209.168 morningsidejewelry.com
    O1 - Hosts: 83.143.81.174 eq2i.com
    O1 - Hosts: 83.143.81.174 www.eq2i.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - E:\Program Files\MS-Money\System\mnyside.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] E:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [SunJavaUpdateSched] ;E:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "E:\Program Files\WinAntiSpyware 2007\was7.exe" /min
    O4 - HKLM\..\Run: [uwas7cw] "E:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe" -c
    O4 - HKLM\..\Run: [Salestart] "E:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
    O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Startup: Webshots.lnk = E:\Program Files\Webshots\Launcher.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - E:\Program Files\MS-Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://67.134.151.137/activex/AMC.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.shockwave.com/content/luxor/mjolauncher.cab
    O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://www.shockwave.com/content/tumblebugs/axhost.cab
    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
    O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playgames.comcast.net/online2/zuma/popcaploader_v5.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - E:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 7653 bytes

    ComboFix Log:

    ComboFix 07-08-17.2 - "Space" 2007-08-17 13:46:13.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1431 [GMT -7:00]
    * Created a new restore point


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    E:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
    E:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
    E:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
    E:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
    E:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\Abbr
    E:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\ProductCode
    E:\DOCUME~1\Space\Desktop\WinAntiSpyware 2007.lnk
    E:\Program Files\Common Files\winantispyware 2007
    E:\Program Files\Common Files\winantispyware 2007\err.log
    E:\Program Files\Common Files\WinAntiSpyware 2007\err.log
    E:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
    E:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
    E:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
    E:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
    E:\Program Files\winantispyware 2007
    E:\Program Files\winantispyware 2007\Activate.dat
    E:\Program Files\WinAntiSpyware 2007\Activate.dat
    E:\Program Files\WinAntiSpyware 2007\AsAgents.dll
    E:\Program Files\winantispyware 2007\AsAgents.dll
    E:\Program Files\winantispyware 2007\AsAgents.xml
    E:\Program Files\WinAntiSpyware 2007\AsAgents.xml
    E:\Program Files\winantispyware 2007\atl71.dll
    E:\Program Files\WinAntiSpyware 2007\atl71.dll
    E:\Program Files\winantispyware 2007\bnlink.dat
    E:\Program Files\WinAntiSpyware 2007\bnlink.dat
    E:\Program Files\WinAntiSpyware 2007\database\enemies.dat
    E:\Program Files\winantispyware 2007\database\enemies.dat
    E:\Program Files\WinAntiSpyware 2007\database\knownfiles.dat
    E:\Program Files\winantispyware 2007\database\knownfiles.dat
    E:\Program Files\WinAntiSpyware 2007\database\TEBase.dat
    E:\Program Files\winantispyware 2007\database\TEBase.dat
    E:\Program Files\WinAntiSpyware 2007\database\vbpv.dat
    E:\Program Files\winantispyware 2007\database\vbpv.dat
    E:\Program Files\winantispyware 2007\fopnl.dll
    E:\Program Files\WinAntiSpyware 2007\fopnl.dll
    E:\Program Files\WinAntiSpyware 2007\InstHelp.exe
    E:\Program Files\winantispyware 2007\InstHelp.exe
    E:\Program Files\winantispyware 2007\InstUp.exe
    E:\Program Files\WinAntiSpyware 2007\InstUp.exe
    E:\Program Files\WinAntiSpyware 2007\lapv.dat
    E:\Program Files\winantispyware 2007\lapv.dat
    E:\Program Files\winantispyware 2007\license.rtf
    E:\Program Files\WinAntiSpyware 2007\license.rtf
    E:\Program Files\winantispyware 2007\manual.pdf
    E:\Program Files\WinAntiSpyware 2007\manual.pdf
    E:\Program Files\winantispyware 2007\manual.url
    E:\Program Files\WinAntiSpyware 2007\manual.url
    E:\Program Files\WinAntiSpyware 2007\mfc71.dll
    E:\Program Files\winantispyware 2007\mfc71.dll
    E:\Program Files\WinAntiSpyware 2007\msvcp71.dll
    E:\Program Files\winantispyware 2007\msvcp71.dll
    E:\Program Files\WinAntiSpyware 2007\msvcr71.dll
    E:\Program Files\winantispyware 2007\msvcr71.dll
    E:\Program Files\WinAntiSpyware 2007\ps.dat
    E:\Program Files\winantispyware 2007\ps.dat
    E:\Program Files\winantispyware 2007\pv.dat
    E:\Program Files\WinAntiSpyware 2007\pv.dat
    E:\Program Files\WinAntiSpyware 2007\readme.rtf
    E:\Program Files\winantispyware 2007\readme.rtf
    E:\Program Files\winantispyware 2007\settings.ini
    E:\Program Files\WinAntiSpyware 2007\settings.ini
    E:\Program Files\winantispyware 2007\shellext.dll
    E:\Program Files\WinAntiSpyware 2007\shellext.dll
    E:\Program Files\winantispyware 2007\shellext.xml
    E:\Program Files\WinAntiSpyware 2007\shellext.xml
    E:\Program Files\winantispyware 2007\sr.log
    E:\Program Files\WinAntiSpyware 2007\sr.log
    E:\Program Files\winantispyware 2007\support.url
    E:\Program Files\WinAntiSpyware 2007\support.url
    E:\Program Files\WinAntiSpyware 2007\threatnet.ini
    E:\Program Files\winantispyware 2007\threatnet.ini
    E:\Program Files\WinAntiSpyware 2007\unins000.dat
    E:\Program Files\winantispyware 2007\unins000.dat
    E:\Program Files\WinAntiSpyware 2007\unins000.exe
    E:\Program Files\winantispyware 2007\unins000.exe
    E:\Program Files\WinAntiSpyware 2007\uninstall.ico
    E:\Program Files\winantispyware 2007\uninstall.ico
    E:\Program Files\WinAntiSpyware 2007\UnWizard.exe
    E:\Program Files\winantispyware 2007\UnWizard.exe
    E:\Program Files\winantispyware 2007\unwizard.xml
    E:\Program Files\WinAntiSpyware 2007\unwizard.xml
    E:\Program Files\winantispyware 2007\up.dat
    E:\Program Files\WinAntiSpyware 2007\up.dat
    E:\Program Files\winantispyware 2007\updater.dat
    E:\Program Files\WinAntiSpyware 2007\updater.dat
    E:\Program Files\winantispyware 2007\WAS7.url
    E:\Program Files\WinAntiSpyware 2007\WAS7.url
    E:\Program Files\winantispyware 2007\WAS7.xml
    E:\Program Files\WinAntiSpyware 2007\WAS7.xml
    E:\WINDOWS\system32\drivers\ApiMon.sys
    E:\WINDOWS\system32\drivers\fopn.sys
    E:\WINDOWS\system32\f10WtR
    E:\WINDOWS\system32\stera.exe


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_FOPN
    -------\LEGACY_IPRIP
    -------\ApiMon
    -------\fopn
    -------\Iprip


    ((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 )))))))))))))))))))))))))))))))


    2007-08-17 13:44 51,200 --a------ E:\WINDOWS\nircmd.exe
    2007-08-17 13:36 <DIR> d-------- E:\Program Files\Trend Micro
    2007-07-25 16:40 24,192 --a------ E:\DOCUME~1\Space\usbsermptxp.sys
    2007-07-25 16:40 22,768 --a------ E:\DOCUME~1\Space\usbsermpt.sys
    2007-07-25 15:32 53,760 --a------ E:\WINDOWS\system32\drivers\vfwwdm32.dll
    2007-07-25 15:31 82,148 --a------ E:\WINDOWS\system32\drivers\VcommMgr.sys
    2007-07-25 15:31 77,824 -ra------ E:\WINDOWS\system32\drivers\SioUi2k.dll
    2007-07-25 15:31 7,680 --a------ E:\WINDOWS\system32\btinstall.dll
    2007-07-25 15:31 63,488 -ra------ E:\WINDOWS\system32\drivers\wssbtr1f.sys
    2007-07-25 15:31 61,312 --a------ E:\WINDOWS\system32\drivers\VComm.sys
    2007-07-25 15:31 51,169 -ra------ E:\WINDOWS\system32\drivers\OXSER.SYS
    2007-07-25 15:31 49,152 --a------ E:\WINDOWS\system32\btfunc.dll
    2007-07-25 15:31 48,556 -ra------ E:\WINDOWS\system32\drivers\SktBt2k.sys
    2007-07-25 15:31 48,076 -ra------ E:\WINDOWS\system32\drivers\Sio9502k.sys
    2007-07-25 15:31 40,960 -ra------ E:\WINDOWS\system32\drivers\SCTray.exe
    2007-07-25 15:31 28,271 --a------ E:\WINDOWS\system32\drivers\BTHidMgr.sys
    2007-07-25 15:31 23,000 --a------ E:\WINDOWS\system32\drivers\btcusb.sys
    2007-07-25 15:31 20,480 --a------ E:\WINDOWS\system32\drivers\blueletaudio.sys
    2007-07-25 15:31 148,830 --a------ E:\WINDOWS\system32\drivers\bcbthub.sys
    2007-07-25 15:31 13,304 --a------ E:\WINDOWS\system32\drivers\BTNetFilter.sys
    2007-07-25 15:31 116,021 --a------ E:\WINDOWS\system32\drivers\fw203x.sys
    2007-07-25 15:31 11,860 --a------ E:\WINDOWS\system32\drivers\vbtenum.sys
    2007-07-25 15:31 11,736 --a------ E:\WINDOWS\system32\drivers\VHIDMini.sys
    2007-07-25 15:31 10,804 --a------ E:\WINDOWS\system32\drivers\BtNetDrv.sys


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-15 08:03 --------- d-------- E:\DOCUME~1\Space\APPLIC~1\.gaim
    2007-07-26 09:23 --------- d-------- E:\Program Files\MSN Messenger
    2007-07-25 17:12 --------- d--h----- E:\Program Files\InstallShield Installation Information
    2007-07-12 22:13 --------- d-------- E:\Program Files\iTunes
    2007-07-12 22:13 --------- d-------- E:\Program Files\iPod
    2007-07-12 22:12 --------- d-------- E:\Program Files\QuickTime
    2007-07-12 22:09 --------- d-------- E:\Program Files\Common Files\Apple
    2007-07-12 22:08 --------- d-------- E:\Program Files\Apple Software Update
    2004-09-16 00:34 456 --a------ E:\Program Files\INSTALL.LOG


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="E:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 16:28]
    "SoundMAX"="E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2003-05-30 09:42]
    "SunJavaUpdateSched"=";E:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" []
    "AVG7_CC"="E:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-16 02:49]
    "ATICCC"="E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43]
    "QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
    "iTunesHelper"="E:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 03:43]

    E:\Documents and Settings\Space\Start Menu\Programs\Startup\
    Webshots.lnk - E:\Program Files\Webshots\Launcher.exe [2004-09-16 13:22:34]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{4567AB12-B980-44A5-B259-9B09EBEA6331}"= E:\Program Files\WinAntiSpyware 2007\shellext.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
    "E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    E:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    "E:\Program Files\iTunes\iTunesHelper.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    E:\WINDOWS\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
    E:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "E:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    E:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

    R1 DcCam;Kodak Camera Proxy;E:\WINDOWS\system32\DRIVERS\DcCam.sys
    R2 DCFS2K;Kodak DCFS2K Driver;E:\WINDOWS\system32\drivers\dcfs2k.sys
    S1 Exportit;Exportit;E:\WINDOWS\system32\DRIVERS\exportit.sys
    S3 DcFpoint;DcFpoint;E:\WINDOWS\system32\DRIVERS\DcFpoint.sys
    S3 DcLps;Legacy Polling Service;E:\WINDOWS\system32\DRIVERS\DcLps.sys
    S3 DcPTP;dcptp;E:\WINDOWS\system32\DRIVERS\DcPTP.sys
    S3 MaRdPnp;MaRdPnp;E:\WINDOWS\system32\DRIVERS\MaRdP2K.sys
    S3 PCTINDIS5;PCTINDIS5 NDIS Protocol Driver;\??\E:\WINDOWS\System32\PCTINDIS5.SYS


    Contents of the 'Scheduled Tasks' folder
    2007-08-17 02:16:02 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job - E:\Program Files\Apple Software Update\SoftwareUpdate.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-17 13:52:15
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-17 13:55:21 - machine was rebooted
    E:\ComboFix-quarantined-files.txt ... 2007-08-17 13:55

    --- E O F ---

    Is that it?

    Thanks in advance. :)
     
  2. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    I ran ad-aware after this and it found registry entries for WinAntiSpyware 2007 and they now seem to be removed.

    I hope I did all this right. I've never had betrayware before...

    ~SpaceyMom
     
  3. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    So far so good but we'll do more

    Download the HostsXpert 3.8 - Hosts File Manager.
    • Unzip HostsXpert - Hosts File Manager to a convenient folder such as C:\HostsXpert - Hosts File Manager
    • Run HostsXpert - Hosts File Manager from its new home
    • Click "Make Hosts Writable?" in the upper right corner (If available).
    • Click Restore Microsoft’s Host File and then click OK.
    • Click the X to exit the program.
    • Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
    ================

    Download Superantispyware (SAS) free home version

    http://www.superantispyware.com/superantispywarefreevspro.html

    Install it and double-click the icon on your desktop to run it.
    · It will ask if you want to update the program definitions, click Yes.
    · Under Configuration and Preferences, click the Preferences button.
    · Click the Scanning Control tab.
    · Under Scanner Options make sure the following are checked:
    o Close browsers before scanning
    o Scan for tracking cookies
    o Terminate memory threats before quarantining.
    o Please leave the others unchecked.
    o Click the Close button to leave the control center screen.
    · On the main screen, under Scan for Harmful Software click Scan your computer.
    · On the left check C:\Fixed Drive.
    · On the right, under Complete Scan, choose Perform Complete Scan.
    · Click Next to start the scan. Please be patient while it scans your computer.
    · After the scan is complete a summary box will appear. Click OK.
    · Make sure everything in the white box has a check next to it, then click Next.
    · It will quarantine what it found and if it asks if you want to reboot, click Yes.
    · To retrieve the removal information for me please do the following:
    o After reboot, double-click the SUPERAntispyware icon on your desktop.
    o Click Preferences. Click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o It will open in your default text editor (such as Notepad/Wordpad).
    o Please highlight everything in the notepad, then right-click and choose copy.
    · Click close and close again to exit the program.
    · Please paste that information here for me regardless of what it findswith a new HijackThis log.

    This will take some time!!!!!!!!
     
  4. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    Thank you so much!

    Here's the log from SAS:

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 08/17/2007 at 05:16 PM

    Application Version : 3.9.1008

    Core Rules Database Version : 3289
    Trace Rules Database Version: 1300

    Scan type : Complete Scan
    Total Scan Time : 00:41:56

    Memory items scanned : 611
    Memory threats detected : 0
    Registry items scanned : 5851
    Registry threats detected : 0
    File items scanned : 47084
    File threats detected : 10

    Adware.Tracking Cookie
    E:\Documents and Settings\Space\Cookies\[email protected][1].txt
    E:\Documents and Settings\Space\Cookies\[email protected][2].txt
    E:\Documents and Settings\Space\Cookies\[email protected][3].txt
    E:\Documents and Settings\Space\Cookies\[email protected][5].txt
    E:\Documents and Settings\Space\Cookies\[email protected][6].txt
    E:\Documents and Settings\Space\Cookies\[email protected][7].txt

    Trojan.WinAntiSpyware 2007
    E:\QOOBOX\QUARANTINE\E\PROGRAM FILES\COMMON FILES\WINANTISPYWARE 2007\WAS7MON.EXE.VIR
    E:\SYSTEM VOLUME INFORMATION\_RESTORE{C1D71694-432B-4E28-854E-2FB8D255AF62}\RP1033\A0097901.EXE

    Trojan.Downloader-Stera/WinSoftware
    E:\QOOBOX\QUARANTINE\E\WINDOWS\SYSTEM32\STERA.EXE.VIR
    E:\SYSTEM VOLUME INFORMATION\_RESTORE{C1D71694-432B-4E28-854E-2FB8D255AF62}\RP1033\A0097917.EXE
     
  5. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    New hijack log
     
  6. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:27:05 PM, on 8/17/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    E:\WINDOWS\System32\tcpsvcs.exe
    E:\WINDOWS\System32\snmp.exe
    E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\Explorer.EXE
    E:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    E:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\PROGRA~1\Webshots\webshots.scr
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    E:\Program Files\Sony\Station\LaunchPad\LaunchPad.exe
    E:\Program Files\Mozilla Firefox\firefox.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbian.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - E:\Program Files\MS-Money\System\mnyside.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] E:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Startup: Webshots.lnk = E:\Program Files\Webshots\Launcher.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - E:\Program Files\MS-Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1187390692296
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://67.134.151.137/activex/AMC.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.shockwave.com/content/luxor/mjolauncher.cab
    O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://www.shockwave.com/content/tumblebugs/axhost.cab
    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
    O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playgames.comcast.net/online2/zuma/popcaploader_v5.cab
    O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 6152 bytes
     
  7. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
  8. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    Everything seems to be running great, except EverQuest 2. It hangs on the launcher. I have no idea if it's related but worked fine (last night) before this ordeal.

    I really do appreciate your help!

    ~SpaceyMom
     
  9. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    EverQuest sounds like a game - have no idea
     
  10. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    Yeah, it is a game, but worked fine before all this. It now hangs when trying to connect. Some troubleshooting I've done indicates my computer is somehow blocking it from running/connecting, but I can't figure out where. Windows Firewall is off and that's the only firewall I have.
     
  11. SpaceyMom

    SpaceyMom Thread Starter

    Joined:
    Aug 17, 2007
    Messages:
    9
    At some point today my BITS (background intelligent transfer service) got hosed. My husband figured this out by checking the event log. It had a bunch of DCOM errors. I have no idea if it was the WinAntiSpyware 2007 crap that did it, or one of the fixes I used... but we corrected it by installing WindowsXP-KB923845-x86-ENU.exe from the Microsoft Download site. Now my game works and everything is running perfectly.

    Thanks again for all your help!
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/611352

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice